{ "Event": { "published": true, "date": "2021-06-18", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-06-18", "timestamp": 1624060981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "fe5c8a35-0c42-437b-a3f7-5bd1f2edd014", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca37ca98-cff7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623994872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994872, "uuid": "b1152ac9-da05-49d2-884b-4f0229940a51", "comment": "Malware payload (AgentTesla)", "value": "7550725a3d85e16db22c537c77bbe0be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994872, "uuid": "116a4851-cda7-4e33-884b-04767f81cdf7", "comment": "Malware payload (AgentTesla)", "value": "000f72da09396d3bf401f056b888a2c5d2b9e485bde07cceffb272c78ca973e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994872, "uuid": "233f0024-5d66-49b0-af5c-723b971ca134", "comment": "Malware payload (AgentTesla)", "value": "6316a83186223c10f5d1bed5f3d6b79e3b0d5cc1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994872, "uuid": "ffc19110-9e75-4e48-91cc-bdc1ba389e1a", "comment": "Malware payload (AgentTesla)", "value": "861f355f76d233041b194ae9768164a7c150640667168d5aad8946b9ecc0c3b048832b9f8b1453c8b144b377d8de1d72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994872, "uuid": "ac9e2e44-58df-4f6f-85d1-9c8a36bc7032", "value": "4B25BF574ECF476BC66408B65731EC4782F24CAA2958B3213EC074BDD93B1EE9A9F502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994872, "uuid": "1dd27156-d7b9-469d-b42a-80002bbb150a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994872, "uuid": "c87e2da0-1451-47cf-a38a-3164dd6ad389", "value": "12288:IwgKSMPQipP599kPFU3X0VTh694kxGhieJ1Rut1krBbdBbEprkIfHYO:Oip6NEXIh64hieHRVlwrPPYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623994872, "uuid": "0c7c44ba-6e58-46ac-99a9-188cb8dac7af", "value": 1003520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623994872, "uuid": "04a7ec17-b466-4fc6-8ef4-76f90ef3fa6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994872, "uuid": "d45eea17-4d8b-43c7-a400-b7bc1fc1ce3b", "value": "$$$$$.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad5faf7-cffa-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623996054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996054, "uuid": "ae2d2cc1-6631-40a5-a345-7d9c2ff87881", "comment": "Malware payload (NanoCore)", "value": "8feae2e9d6da860a2908df9c71341e66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996054, "uuid": "d25d11ec-58a0-42f5-aebd-862976bde455", "comment": "Malware payload (NanoCore)", "value": "00283c596db208ba1bc96ecac73c67fba068699850a31bb9dbcbb44b633d0b2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996054, "uuid": "ef4f5d62-dea7-4c12-901d-48eabe66e201", "comment": "Malware payload (NanoCore)", "value": "0fb53c73d863682e4474639e3d6107f2c8fae320", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996054, "uuid": "25427258-f8ba-454b-b5ec-d2d7200438b9", "comment": "Malware payload (NanoCore)", "value": "582c1d8216c956d00b9bd54dc5ea0ff0784ac50e158f2114dbb390d8423f684ba3119e184d842d95ce21c5e2c2beca0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996054, "uuid": "0a6d93f9-9d75-476f-956d-baaf6c2422d7", "value": "3B15D0202AEA5115F173AF745FD079929BBEFF237702E45E2891338B1633981CD9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996054, "uuid": "1f25684f-e51c-4b44-91c2-af7bab300f31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996054, "uuid": "c0c3906c-ecac-4076-bcab-8886bed2a029", "value": "12288:Rrnhlm4S4F3M9yx/vmhLsSbLfZs7CQnwQ8b7y8obb8ewdPqNSQmSOlhMWTrozIyx:RdWuvc3Lfa+2F8eCSHodjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623996054, "uuid": "7f9183f7-fe73-4c4d-b330-64e09b4994d5", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623996054, "uuid": "32397ccd-60cc-4fc1-a7f8-1ee342074313", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996054, "uuid": "ce91023e-eaea-4a77-b80f-8e3c0d3ea55c", "value": "REMITTAN.SCR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea24910-d01e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011603, "uuid": "3906211a-bc47-41fa-8d82-9459963cf935", "comment": "Malware payload (Mirai)", "value": "f51fb608a39320c29cae06bb2c396c09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011603, "uuid": "59c4df8e-0fe3-4cf1-8fa9-816d957ebaf1", "comment": "Malware payload (Mirai)", "value": "0070b84b1e7bf6d3878a2b943be55bd7fd5542d7862c4c8070a19182bd92baa0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011603, "uuid": "592ffa41-7ece-4711-9ccd-4f7af93e4de4", "comment": "Malware payload (Mirai)", "value": "ad36c83221ca17a2806cfc5da14430fd4969ffd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011603, "uuid": "2d8c0052-ffa5-4fc1-87a7-44704aa975a3", "comment": "Malware payload (Mirai)", "value": "d941cd979b9da68abf903d34ac25e4b786d749652ff25ba98baa8d763d917f90fd1b0fdfe9c203f4d4bc6f0f876024f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011603, "uuid": "1d425c59-f843-4cb7-afb4-a8222fdc4a16", "value": "9A33F155C0A7CD93DF3494BA8B3E0D052D082FF5E147BA71123DC5B899F12AB672AE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011603, "uuid": "a0518c9f-f44a-49da-b690-51c12f5d7f5b", "value": "768:hZ5Ownk8NoJCw3Rij1VSFsH9l9gKM0J9wiOrLIS+D79q3UELgXwJY9aiYD5dDzEl:h6ckGsy9ll6iW0HaLgXwi0Z1BzEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011603, "uuid": "3babe57c-78f4-467e-9a19-338a631ea4e9", "value": 52680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011603, "uuid": "fad2e9e9-4ed6-4701-a403-d562ab0db31f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011603, "uuid": "bc2217be-db01-4519-8936-52aabe87d39f", "value": "f51fb608a39320c29cae06bb2c396c09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68f6649-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623976827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976827, "uuid": "500f5cf0-17d0-471d-beb3-b432c341ce9f", "comment": "Malware payload (Loki)", "value": "f31e6d171211c38f03e182a6e74462fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976827, "uuid": "1fced06f-5013-425c-85c8-df07f9c41edf", "comment": "Malware payload (Loki)", "value": "00969485768d60df4cd9c2055424b89dc7a241ab99a15c221f40dc601d4abf52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976827, "uuid": "9d8ce3b7-8c47-4eb9-8ab1-c7c56609c46c", "comment": "Malware payload (Loki)", "value": "d44da61b1758d5e9c5de37eca573ba72948dea28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976827, "uuid": "1a5bccda-5535-44e2-8d97-afc3eb10a714", "comment": "Malware payload (Loki)", "value": "132a1695df630f992eb82518ff218f551eef2d076847bf1d2e27b12173e2a9263eeb148c22a7876cd1741c1da1f63685", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976827, "uuid": "997e9751-195e-4a40-8052-7c714a31e5f3", "value": "31745C00A791C035F6F326F05AB992B9953EBEA1AF2450CF52D52AED97346E0EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976827, "uuid": "70d23372-14d9-4fe8-b63f-8477c6ad3152", "value": "ae9cc11fb3f0560dbb76d6972f229f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976827, "uuid": "f5ea9802-d197-45a9-a862-bcd0f3b8b1b6", "value": "6144:vhiuglGnqM19Vr3Sn7PKZGCHgJNaYyL2U0UN63h3TGlwMc7:vQu4Gnq6/r3qPKZGC4NafH0Uch3TGlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976827, "uuid": "8640d71a-4d01-46de-b7ba-1de2c34e2b8b", "value": 347136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976827, "uuid": "736313b9-0422-4679-a38e-4813ce6a6220", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976827, "uuid": "0bee7dca-1ebc-4b4d-9fc4-0873d9e38240", "value": "F31E6D171211C38F03E182A6E74462FE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0114d5dd-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1623976925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976925, "uuid": "a772741d-27a9-4f6a-b484-4360b5f2f2ac", "comment": "Malware payload (BitRAT)", "value": "3ff1fdbc7330f1105e1294bdb960dd92", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976925, "uuid": "8c9acb58-bead-487c-867b-265ebdcbd060", "comment": "Malware payload (BitRAT)", "value": "00f78c334f5baf236af6841f6332d157dbbd91cbaaad20138cd4ca0de9c0cde8", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976925, "uuid": "f8538332-1d61-4a1b-8988-37709f88f955", "comment": "Malware payload (BitRAT)", "value": "2b8907703f19612c71302b93edff467ac2eb902b", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976925, "uuid": "d530d278-8324-4940-a0fc-80c078f15756", "comment": "Malware payload (BitRAT)", "value": "67017219ef01c6e19d70a02fb427d55dd1ca0458334f4d855cacd4616a42b41606feb17fa58fbc119f8ee5ab4db81537", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976925, "uuid": "fad2db7f-1252-4838-877f-4b11f2514db8", "value": "46A5122429E99129F177BF7506E07C959B7EBF227B03E44D2851338B0633A81DDD263A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976925, "uuid": "011c7761-dd77-45c7-a6f9-61d4cda2463f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976925, "uuid": "502a922c-6b20-4ff6-b4e4-294edeb84bc0", "value": "49152:UGDFAbQJd/KnDgJGmybglAx8T7qxqp4XFVrpX8K:U7bwoDgJGmybgl5GUiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976925, "uuid": "61e0c508-a8bf-47c7-a3d9-86e138101840", "value": 2147840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976925, "uuid": "9a2aa85c-6479-404b-9234-935204ac9640", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976925, "uuid": "47a93b0a-acce-47cc-8b61-b750990a25c4", "value": "M113461 order sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edd18cd-cffa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623995873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995873, "uuid": "0ed11563-2466-409a-94c4-3432c3d8e625", "comment": "Malware payload (AgentTesla)", "value": "22ec3bbc99bae9d21d80e411e812a8c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995873, "uuid": "3e372acf-b366-4390-9284-3b1c20dc56f5", "comment": "Malware payload (AgentTesla)", "value": "02b3e2180394b3057040cdb77fc9efc7a0b26b61a9ff4a530564a277b12e179d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995873, "uuid": "4fc56391-368f-45d0-b794-18694bed42d2", "comment": "Malware payload (AgentTesla)", "value": "05315d13b59780898420b70a31b770a635320542", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995873, "uuid": "be49e412-d07d-424a-b078-c629d413d086", "comment": "Malware payload (AgentTesla)", "value": "55bb492a01606af9f984ab94c4c194f0d805e9fb75a2f3df8454fa0c5e5c702bc096bf351d62a46cde9697ae83052f2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995873, "uuid": "306244a6-498e-4549-8a70-0eff1edb7fa7", "value": "42F4333DCB774282450AE8AED2A4C6558983FD80F4FA2711D2965C132BE4F52C73DAE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995873, "uuid": "15400ac3-b2cd-4b52-92e6-e7dbf17a0d3a", "value": "12288:ozV7RUvACKx5YWBAnVKq87hx57pMshHlJwYYImwjDdlsQ6+TeA7kXep:ohdSAbSWBAM7hz7p/hFJwrImQgQ6+v/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623995873, "uuid": "481791cd-d220-4a8d-bc80-f6a423f24eea", "value": 793309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623995873, "uuid": "62fb339b-acab-4ac8-b7af-5ef34097aff8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995873, "uuid": "362d4a55-bed3-44cf-9d06-c0e4bf46b240", "value": "statement of account.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b70e6ca-d02b-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624017073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017073, "uuid": "4ab5a21c-6834-41d5-a409-5c0a08217696", "comment": "Malware payload (RedLineStealer)", "value": "dca0ccf458dbd4b3cf4ed22ff0aa9a95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017073, "uuid": "a884325b-f3f5-47df-8cca-2fa098db8971", "comment": "Malware payload (RedLineStealer)", "value": "02e47b36e385eaf02b7db59d493b9b27f7a0b52f6946ffcf03e79aa9e8000b01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017073, "uuid": "e17c3ccd-e096-4304-8798-747a133ebd9b", "comment": "Malware payload (RedLineStealer)", "value": "9c8b7083bc0c52638dcc7e16af08abaa467819e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017073, "uuid": "5ea47e86-2317-44ee-86c7-3b15806a20fd", "comment": "Malware payload (RedLineStealer)", "value": "9af459c593f6a8af853c7d99f2afca56f9b3bf6e64fcf8412e70ebce234e326ac41ae0e03557420d310b681cbbd5a2f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017073, "uuid": "bff07cac-a154-41f0-9232-1a7d8f2ca29d", "value": "2C84BF20FB90C035F5F212F85ABAD3B8A52D7AB1576494CF62D52AE917346E0EC3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017073, "uuid": "9316b5d4-878f-4726-adce-92915852474e", "value": "7b1dc6cbb65eee334207b62238bf5f24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017073, "uuid": "bfe3411d-fc44-4b5d-a888-b0d0534392d7", "value": "6144:TENCjnAoJ9I9rMCxBD2aHhzyqbwWXWnWDCQLltVe6ylBV7VTFSy9koIJqCp:wCjAoJu9rMmBPzPbBR/ltVMlrVJV28Cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624017073, "uuid": "feff4165-77cd-476b-95cd-aa42971a39ef", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624017073, "uuid": "5f53f1d9-12e8-45f0-9edb-2783c186df79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017073, "uuid": "d7b257ba-f93b-4d29-a8b2-f0d5e1323c0b", "value": "dca0ccf458dbd4b3cf4ed22ff0aa9a95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8457ad90-cffd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623997331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997331, "uuid": "c53ea895-16d9-48e2-9e57-2e40e02c5301", "comment": "Malware payload", "value": "205ef26465f1de1ef0c95551e0c46858", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997331, "uuid": "87fbb366-bf7a-4996-bfd7-81840d0e698f", "comment": "Malware payload", "value": "02fcea1909693abf6a1cb489c5f75cb09cfeb7fe46038ee05825e658d42cac75", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997331, "uuid": "df7a4a74-8325-4139-9b4d-70f0a672c1d8", "comment": "Malware payload", "value": "514d73271270e7f3c13cbaccf39fca9b3e25c979", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997331, "uuid": "aced1fe6-dd5a-4289-8f23-f0a1f648220c", "comment": "Malware payload", "value": "0f53b8aaf316f151fadb5eec39aeeaf29431b5861fbec139b330a292de9d4accbb529186b054ea00e6a652ea01dbc4a6", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997331, "uuid": "a66afc5b-aac0-4229-b49b-9194d0f436c7", "value": "21C3BF9276A3D506DD4F03792CE682CB2752BC114E7F52B7B3A5FB0ECB70A84490261B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997331, "uuid": "f9e01085-1f47-408b-922d-5f63cd8f21b2", "value": "3072:Ik3hOdsylKlgryzc4bNhZFGzE+cL2knAmioo1gaSNAPZesWFPO7YiR6PJEcjjaPE:Ik3hOdsylKlgryzc4bNhZF+E+W2knAmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997331, "uuid": "9696def8-6b8e-47c0-a86d-e0b5e7659e63", "value": 120832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997331, "uuid": "8381c603-d5d5-4820-beba-3c7a7230d874", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997331, "uuid": "648886a9-0d8b-4630-8a31-6835a52e5649", "value": "IMG_00021017890.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95957055-d080-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624053624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624053624, "uuid": "497698ee-6b27-4b66-9b4d-3914cb626d9f", "comment": "Malware payload", "value": "fb86ed78e2744a971f928d6c20113906", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624053624, "uuid": "d17c830b-5a67-4760-91f8-5decdb1e945f", "comment": "Malware payload", "value": "038cddc8bc5812130be9e23add40a280ad0823b4dee813baf49bea4300ef0d39", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624053624, "uuid": "b6bc9361-b0fc-4c5c-aa74-398a27146a58", "comment": "Malware payload", "value": "ce4ddc8f07ad6b0e9d7123c36f299f495288093a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624053624, "uuid": "2111061b-54d5-4ec7-9705-c13df4469919", "comment": "Malware payload", "value": "638e1aa850e1e7f31372085832b88dd15504d50f4db0100ddabae8fdf9138e18f3d971570200bf729f02778307a6b0d9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624053624, "uuid": "3853dd6a-833d-4880-ad4e-cacb608fedd8", "value": "7A64028BEF36BC1BCB001FF125DB4F9DA96C675B82C7E0A1B6C0444F26E51C6B691285", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624053624, "uuid": "81df257f-a9e3-4ba7-8fc9-f49db07de465", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xio:p3lOYoaja8xzx/0wsxzSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624053624, "uuid": "01d00692-8b65-483f-9e27-0d874fb6e2a2", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624053624, "uuid": "4ebc9363-d972-457c-ad7d-a356b61c47c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624053624, "uuid": "39448a14-3792-4c9b-ab2e-d4c91d43f5eb", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a317f1-cffe-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623997553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997553, "uuid": "189c33a0-9e43-446f-9645-874bd1a0065c", "comment": "Malware payload (Loki)", "value": "cede8c1c9af0b1adb14fb1271ad9043d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997553, "uuid": "cb94ce37-35cc-4119-a55f-34c091322937", "comment": "Malware payload (Loki)", "value": "03cb9990038aa9076d4fb5e8870847378578863f0e477f75347db015123fc6da", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997553, "uuid": "d49f0019-a9dc-4e1c-96f9-4442bf84d981", "comment": "Malware payload (Loki)", "value": "c6baef784bcf353ea2d8bf046015114b2278deb8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997553, "uuid": "c7b729b9-1da6-4406-a5ac-78ffe25b7836", "comment": "Malware payload (Loki)", "value": "179bcfafc98697f1e930e680a5e89f5f3f5001b477729fe11315bfb7cf43ba728d698285b03dd829d0044539e6dd274b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997553, "uuid": "a77d8c98-1db0-4eb5-95a9-53ea33dd0420", "value": "3C352362F8DA6743C2F307794072CD21596FEEC27BF19E6613883A9E31316352DE15A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997553, "uuid": "df4c265e-0259-4b97-8957-e5ef1e54f6d1", "value": "24576:qfeZyG/8Vz0FWfVnG/xqX0Ss6oP/+zulnqwIyEhQ/mR+PuqGJV:3/8V3f1qqX0XZeonqoEGOROGJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997553, "uuid": "a926bcd7-63e8-463c-94bb-58022658d7e5", "value": 1105920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997553, "uuid": "ed877119-5020-4392-be3f-506acfef5ef3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997553, "uuid": "f868d92d-9810-4cbe-95be-feeed04762a2", "value": "SwiftRefINV08899211.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c80945c-d06b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624044590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624044590, "uuid": "45f1fdd4-a953-496e-b024-6af93d871cc0", "comment": "Malware payload", "value": "1ba9f0cff517d4f42fd88857de31f27b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624044590, "uuid": "5d88a4a5-2921-458b-8b8b-a1547c1d5230", "comment": "Malware payload", "value": "04253e566268069d633182f191b77a0f0f994d907da2f3512dbe344576baec06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624044590, "uuid": "ac33a6e6-db89-40e6-8d33-b3b96989a884", "comment": "Malware payload", "value": "59f33cd5d80f850a6de452c026e6d937217b9cff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624044590, "uuid": "b5c90fb4-c494-4e70-9ed9-e5c0a5f3f9bd", "comment": "Malware payload", "value": "28f7214ce6028b5a02844cd1fdaa8be43567c225f83230979fed2b822a18b57fa6477281a77c97355d477343c92d0ae9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624044590, "uuid": "57ee4e04-e62d-444c-b87a-d261fc249450", "value": "21156B9D721072EFC867D4729EA81C68EA507C7B831F5203942375ADAA7D887CF245F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624044590, "uuid": "076939ee-4863-45a4-9bcd-0553d3d9bd8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624044590, "uuid": "800a20fb-c0a8-4245-bdb6-86f859f2e9ca", "value": "12288:VAFD1AZxTYiOXgiS+gGVXKdZoi5ZjjTMafN7xc3HPCEqV5+4mi7w36oGWW9nrJhf:KRdg55ZjPmXPb4mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624044590, "uuid": "0a803949-e612-47fd-826c-7439afe6490d", "value": 948224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624044590, "uuid": "d0d578e1-8cf2-4c69-bcdd-c9a93e3bd4f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624044590, "uuid": "ad08f013-479b-4dd3-a560-5cfcc8cb1c05", "value": "SecuriteInfo.com.Artemis1BA9F0CFF517.9160.10698", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32fd2c5-d01e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011610, "uuid": "eac453e8-e7fc-4982-8772-7f14c6a0e78e", "comment": "Malware payload (Mirai)", "value": "a397c340830625b0af92136a2a0dd26e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011610, "uuid": "3e17a193-ae81-4929-aca8-82939bffef5b", "comment": "Malware payload (Mirai)", "value": "0492d878ca2905114719daed3346700e2deaa221eded9e90e9cfdeb3049345ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011610, "uuid": "6c70878c-7890-4bd8-a898-c7fc332c7a96", "comment": "Malware payload (Mirai)", "value": "8a4cb8092dcd6d9f5549f85f2d46877faee77c98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011610, "uuid": "8f9a48a0-8bab-4bd1-abb5-cd07c8c80a1f", "comment": "Malware payload (Mirai)", "value": "c26e98ecc203116d1d7d4f77f4b191241333ffbe387e1ca0b4c4a5836b21ecb0a6567a1480c039fbe5b64019d53e163b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011610, "uuid": "18a5af6a-8855-49d5-b63d-aadff2236a8e", "value": "83833A38A93C2A62C8D4F47A31FB8755B2F5321D2874998E7C610E6DFF2479059862F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011610, "uuid": "53e3d482-0795-4332-ac15-757792341916", "value": "1536:5r4qO6fOSf2ePCG9slu7ESDapCKfJCGr96vfhEH61W6ly7Fp:5+6fPFh9so7rD2CVGr0v5313lyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011610, "uuid": "73f0c13f-3f3a-422f-9e18-8e4370255db0", "value": 83552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011610, "uuid": "58372124-56dd-4960-9976-0431708505ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011610, "uuid": "3a399ec3-2c66-4d09-91ca-854ce5f30c33", "value": "a397c340830625b0af92136a2a0dd26e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f7e26e-d01e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011284, "uuid": "167df749-f605-4692-99fc-4080e45efd58", "comment": "Malware payload (Mirai)", "value": "93a2e54de3b85d656d9cb751b8568ff3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011284, "uuid": "e4b6b34c-c896-4a81-ac55-37a49e6c98bb", "comment": "Malware payload (Mirai)", "value": "056e580f38ce3b629de21f5b6ba32e42f9e7e897d264303806194fb6a9abdd9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011284, "uuid": "443296c2-6a31-4494-b5c5-fe17adf8eba0", "comment": "Malware payload (Mirai)", "value": "d87d673d513581696614bdc682aa564a183d0f88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011284, "uuid": "e6d75c96-a98d-4da3-bff2-46bf42834d7e", "comment": "Malware payload (Mirai)", "value": "bb1fab2a27e5648bafc35b3dfb02c9807c5924bdd0f57f683870d69382afeb12045a6930dee9cf305b7eaf2f6c47bfcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011284, "uuid": "9a547ce1-7e53-4895-9769-00360c380db5", "value": "03E2E1CD3386DCA5E336CA7EBD9DCA5567D52BACB1E1907A1A004B08ED0E548637C203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011284, "uuid": "890687ae-e80d-4e8d-909a-c53c936c668d", "value": "768:eEJRqAclSPDtybIeyHRrtnqEWangnA379BLxgt4s3Uozf:eTNSrtybRKR5qdnA37bAzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011284, "uuid": "a03d64de-2a3e-453a-bb5e-cb11f68b693d", "value": 32024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011284, "uuid": "00e9719b-0f81-4068-a02e-2c99c98beba0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011284, "uuid": "059d9ded-ceb3-4d1f-a526-b2fb4fb870c2", "value": "93a2e54de3b85d656d9cb751b8568ff3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1450ae05-d02c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624017330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017330, "uuid": "6fca701b-e5f6-493a-8e37-858c607db2ed", "comment": "Malware payload", "value": "26570091816228a12254d983eeb6c4a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017330, "uuid": "8b8c29e3-506c-47a6-9cb7-c068f4e48a07", "comment": "Malware payload", "value": "061440ab984f239b28629ea346d516114705dac4f20f44a5700000f31cdcd00d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017330, "uuid": "0717d514-821c-4a42-a4b1-c065c1182388", "comment": "Malware payload", "value": "fd554b2b97721872d6d74b8ed39e251886120c96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017330, "uuid": "82eeea6c-8dd4-49ae-8609-903b00753159", "comment": "Malware payload", "value": "fddede49a48fdfca8032798616a9474cb6b097a61216ee2b0378bb09fe049a06b1d9f1104007e036460f0e54a15973c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017330, "uuid": "19d30750-c731-4b34-ba29-7100a5f83a92", "value": "6D82D0605228F062E88107753C219EEB15BA3DD1EE676E2574C0364E1F2FF95A0B4E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017330, "uuid": "4cac17eb-1ccc-4b36-9463-0d6e2fa1eb41", "value": "384:bywipfujgh20I6kIvbA+AxtAxamwKNtCgzKPudRgOoAY4q6UcciFqcJ6:GwIfujgZkSytGamwdgzKW4fv96Uls4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624017330, "uuid": "2164ec96-eab4-45a9-8b56-8d18c1ddeb77", "value": 18660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624017330, "uuid": "78e3a4bf-59d4-4e46-9ae3-937a83dd1511", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017330, "uuid": "7edecc1b-d3b1-48fe-88b5-93be8b1cab6b", "value": "Samael.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa0bdc7-d025-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1624014656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014656, "uuid": "0e43a0f5-bcf5-4078-8730-f6047fc3ff4b", "comment": "Malware payload (DCRat)", "value": "d3fb616d27d61d531716122db1dfe285", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014656, "uuid": "11af9c18-81f1-4fb1-b7d5-72fdd0b36dd8", "comment": "Malware payload (DCRat)", "value": "07320618398ed0b0322593914abe7e50794763ec9038ca328678d5ff392c7079", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014656, "uuid": "e310bd3c-077a-44d8-95a0-dc752c2fa390", "comment": "Malware payload (DCRat)", "value": "7bdcf5e8b4ee0d7d20cc2b743001d25397036102", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014656, "uuid": "8d7e390c-de5e-4cfc-8e92-65b7c7778ac0", "comment": "Malware payload (DCRat)", "value": "582ec244b0b3d20d361ead772b9527b2e7aab6c2a6736203b17c59b94ec0cad311a9f7b8e96d58c2cea44ccb7ae214e7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014656, "uuid": "f5d11524-6dcb-436f-97a6-19b4c2ef60f0", "value": "649419282AED5925F1BF9B7DD9F06556DB3DB5633B43A90E04E1038A0A23741DDC0A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014656, "uuid": "da709196-9999-446e-be92-768c50014d6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014656, "uuid": "c6416e6f-1010-49f4-86c7-77a6a83f21d4", "value": "12288:KqnhaXX7MPnQLAaPR1THORn2Z7lclN+1MAmTp2zd:K+wQOAaphOZnBsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624014656, "uuid": "99a51993-506f-40a6-ab54-34d1897ff6cf", "value": 435712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624014656, "uuid": "e05ac32e-9a22-4458-9818-45f7594743d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014656, "uuid": "a5d4e0d2-c71f-487d-882c-fa1478d3ac26", "value": "D3FB616D27D61D531716122DB1DFE285.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389da251-d030-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624019109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019109, "uuid": "3069bf90-b901-424b-981d-a2a80f46e97e", "comment": "Malware payload (Formbook)", "value": "805c3f59ef47445bc2f306972c37004f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019109, "uuid": "4434cad4-3d0c-46b0-a8da-f17a698fecfc", "comment": "Malware payload (Formbook)", "value": "08a114290e163012bd07c759c83c1af7ea872c1032fecf14987953c6e85a2080", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019109, "uuid": "f2fb6719-1f29-429b-a58e-63483175308a", "comment": "Malware payload (Formbook)", "value": "7bfa57a4ef8528d7755c5bcf90f46bd24e7400d8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019109, "uuid": "1d1446e8-e014-43f0-8fb6-0882a05edfdf", "comment": "Malware payload (Formbook)", "value": "d2ea0b542b3dd40768aafab9286e98ba1c35583e7b1b9d7047434ea353096c0ac08791acf009a0dc0442b19ad64924bc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019109, "uuid": "932ddba0-398c-468d-82ba-ffe32547f606", "value": "BE15231368A82F9EDF3604B8375FFD10825FDF00E6B99E13A95A761E563636178D0072", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019109, "uuid": "393fe606-7ad9-4956-9a07-6f317660f4f7", "value": "24576:u9UYjOwXUnqUu75ldCCadg9kvkxVV2W9CGXXtD:cVj7SqXFl46R32gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624019109, "uuid": "e66a8cff-d985-42fb-8a2d-b9c1f118e6b9", "value": 926208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624019109, "uuid": "82030821-8c43-4ccd-a6eb-e06fdef89f84", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019109, "uuid": "d0dce1ec-a92a-40b8-95d5-0b69b82f096e", "value": "Purchase Requirements.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6375254-d01b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624010407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010407, "uuid": "a67b2dd0-b1c2-47d8-886a-dfcb6ac24588", "comment": "Malware payload (Mirai)", "value": "ce7dd45a8a92a2cd9c27e2ac204aaa16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010407, "uuid": "fa718594-74d4-4df3-bb00-d2f20d2be427", "comment": "Malware payload (Mirai)", "value": "08b488964ffc4c4994fc8a8f642cb5bbfba29a313e5fc05035d62c0d4157b154", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010407, "uuid": "ead80b89-2ee3-4bb7-b46f-3a215e05862b", "comment": "Malware payload (Mirai)", "value": "28ede48790d792058ce9a88d7bee25d3035796c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010407, "uuid": "e17bd122-7212-4c46-9c3b-3e1ebeb66146", "comment": "Malware payload (Mirai)", "value": "7a3a2da9c54dfa996895bda5ac6864343142a56edaaa5852e741e5ddb52697ffcc976bda5c88c7ead1cd5a609d7f2913", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010407, "uuid": "cd53be0e-6d28-4935-ab9c-5ce0fbac5ab4", "value": "FE735DC5A593DDF5EC100A353077FF319AB6F13E2169EB87D3A8A636AD42602E00725D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010407, "uuid": "00d03226-813f-4750-a5a9-8ebf8b97fbf5", "value": "1536:/LGfYklyNkSw0FLDqtQ5DkvSgh7kPrrFYjXU2SU8q/I7S:DGAklyNFw0FLDUS46t/FYrn5Q7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624010407, "uuid": "4d5d7a76-53a3-4d24-a589-b2a61fe70d54", "value": 74608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624010407, "uuid": "f0b3fac3-937f-4cc1-b23f-5f503b3ed3c9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010407, "uuid": "2a1e0ed6-1d2c-4c4e-ab31-a9386bda5e7a", "value": "ce7dd45a8a92a2cd9c27e2ac204aaa16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ce043c-d026-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624015106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015106, "uuid": "4525926f-7e50-4cd1-9f64-da7af33ae07d", "comment": "Malware payload (Mirai)", "value": "cfdaa01b8a0d78a2966379e0e39dc4b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015106, "uuid": "d0c62a2b-7ca1-42bd-9e38-2bad5284151a", "comment": "Malware payload (Mirai)", "value": "0a590155a5b751d44fd99df89fea5ef5d4e5bf0a730a30fc610d01b5d2fa0229", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015106, "uuid": "9412fafa-5c0b-4e77-84c8-6a54a0ffb32c", "comment": "Malware payload (Mirai)", "value": "0003f2262ca43d6dd9bb8788e658e5d49ce98371", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015106, "uuid": "989a4086-1e28-43eb-a8a8-8bb86db1eddf", "comment": "Malware payload (Mirai)", "value": "462e340b6c406811719a594adf3a6831b6345017bd38127ebf923ef25c488b52f4215af986af8e19363c06e1bdd12b04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015106, "uuid": "39aa50d1-c8f5-48ac-bc0c-cab332db0384", "value": "93334BC4F543DBF9D84900717036EF369B33F0FA226DD997D3995A32AC92502A907A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015106, "uuid": "2277e2e4-5199-4b71-92ac-686b1a1bb627", "value": "1536:vbxZ+QmM0P+IWFWidh8dsSBnwu440iIBIF0x5L:dZ+QmBto9NjB+Eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624015106, "uuid": "3a604403-08e7-40d5-a6aa-3b306120e059", "value": 51508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624015106, "uuid": "66685180-1c0b-4b48-8dfb-ec12ee2f0bba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015106, "uuid": "d044c4a0-f4a8-4e55-ba10-dddcf18d6df6", "value": "cfdaa01b8a0d78a2966379e0e39dc4b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c71c8dd-d035-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624021236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021236, "uuid": "49d7d010-4ca7-42c4-942a-c4ba44e633d9", "comment": "Malware payload", "value": "355583a086e74e0f82d93eb5a3a69401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021236, "uuid": "9c2d96cc-2daf-4157-99c4-5ec171c2c6ae", "comment": "Malware payload", "value": "0db3bd35b25826c66d2ebc8f3d009b44dcffbf66e7998b19be0cf4c0d8fec258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021236, "uuid": "6c12cb4e-867e-4cfb-a299-e282a50b3e14", "comment": "Malware payload", "value": "0ce6d6df6365a753e787d43ee7b9eb9c28112751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021236, "uuid": "71bd4592-2068-4ad5-b697-ad4003d8c170", "comment": "Malware payload", "value": "25ee128647e704c1e62490e36e8dcd205e5b4a1faf1bdc8b868f4ccf42ec1c04ab89700c8399adda3399821841dc80e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021236, "uuid": "ea4bb06e-0c41-4d55-9ac1-58b0c80fa4d8", "value": "C4F4EF236474611AC7E3323A4F61F9F963191D0DC8A05C1AB6F0BFC7B5BC283AE99645", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021236, "uuid": "e706f01d-7242-41a5-b515-f9c7cadb935c", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021236, "uuid": "5e458408-8382-4ef3-a230-5339b2ba5b8a", "value": "12288:Bgd+/Ft5qYyBsGCuhxGjcOc3+y0+Tl37zt+JI8Z5x/eu:Kd+/CqGCQxq/KJ0I37ztV8Z5xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624021236, "uuid": "5886a977-4cfa-4976-a01b-413595afcd94", "value": 748370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624021236, "uuid": "87a614f4-e414-479f-aaf0-246ade22b800", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021236, "uuid": "e2a0f532-57c6-4b9c-89c3-02b1a9fca7f9", "value": "Img-347654566091234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d19a3b-d047-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624029172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029172, "uuid": "26131614-1912-415e-bee7-f43d4cdc788f", "comment": "Malware payload (AgentTesla)", "value": "bbf3392b78d7733b58d028d91e323d72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029172, "uuid": "14df69fc-7bb7-40bf-a2b7-ba9ada72c3c9", "comment": "Malware payload (AgentTesla)", "value": "0ddcbed6d8dd0e3ff4e2df474a8557b5935c69e5daf405903af90977bff03d83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029172, "uuid": "a3f8e8a2-9ade-45f4-b153-3c77aa1a10fd", "comment": "Malware payload (AgentTesla)", "value": "b45d893cd7d6346e7f18c0e8143e65f876b02fbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029172, "uuid": "e15e780d-5420-4b8b-8cc4-4150f59fd8b4", "comment": "Malware payload (AgentTesla)", "value": "ea4af0efee3311a8232662dce6d794c8c0fb6f13a70d16d6cb1a38c52dc445845641f5e353968416ae43be4a47dcc00f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029172, "uuid": "6aeda622-e103-4ab6-959f-0f3176f6ca22", "value": "B705335B601B9F290414905CB2CE1AF520FAB5D0B3CDBBE419EBDE74898C734D99CA8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029172, "uuid": "4f159e4e-f001-4c40-a009-08bfd93378bb", "value": "24576:5McaIGqMOCNABsu0JfuWIcL29HGFflR42:5dGf00xIcL2ZY7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624029172, "uuid": "755e67be-8e93-46e5-a75c-a08f2d1f7358", "value": 824185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624029172, "uuid": "9bf617de-54e6-4d99-83af-e910edee4a15", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029172, "uuid": "d9f7dd78-79a3-4f83-a48e-d853a3295795", "value": "70654 SSEBACT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaca3fe5-d000-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623998792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998792, "uuid": "96461106-b496-4146-ac88-8cff1933084e", "comment": "Malware payload (NanoCore)", "value": "94420de44dea3beb84e29d69e42fc632", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998792, "uuid": "39a5a9e5-f063-4f4c-90b0-871579aeff70", "comment": "Malware payload (NanoCore)", "value": "0dec63ec7747612b9bb8ea25ff9b15c61635af01dcab0cf099fdb23bc5f58132", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998792, "uuid": "19e02737-1219-43e6-9da8-bf4626f9e3b2", "comment": "Malware payload (NanoCore)", "value": "7cff483aa64a13d8e7bc60934ceb945d071946dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998792, "uuid": "a0d49ae2-3833-422c-b07c-58514241c429", "comment": "Malware payload (NanoCore)", "value": "f7e11f9d14523249a8222ab9df08f4b19c5a6df696c202cf34b291c7800d37f7cbdaf7805a76e313ef9b6d508a04f72b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998792, "uuid": "f4fc2416-1f64-422d-8908-9da5a25c4165", "value": "17B402013BAC5B5EC8BD9BF6A55B40000771BD2B50B1EB0E9CC631D59AB7B818727E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998792, "uuid": "43b6c1df-29c9-434d-9cdc-bda8ff6ec9ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998792, "uuid": "94897d3a-d027-4e24-9004-297f534c2061", "value": "12288:UhcWUDl9YsiEygVN0rh2+K6bY06Jxft3wAQzZy80Xpw4Pb+:UhcWUDrVVNy2+q3zv5w4Pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998792, "uuid": "5f219797-90ba-4a38-bcb4-b22755a7ac8b", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998792, "uuid": "db1f255e-02f4-471a-bc2d-176e89d896c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998792, "uuid": "bfb50e33-2445-49e7-abc2-7abec74489ee", "value": "IXt6FiWjDF0RSBU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4159b03b-d001-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623998937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998937, "uuid": "e9d9934c-3b6d-4278-913a-d25cb6e405e0", "comment": "Malware payload (DanaBot)", "value": "61310ba96c1aaff280a5cee3bdcc264e", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998937, "uuid": "f7751f86-b579-45ab-83ff-037c321c02c3", "comment": "Malware payload (DanaBot)", "value": "0e28b97dc1ae0e9af704ff2fa7761c8c35b5b76f136fe14883e84906ed1304ed", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998937, "uuid": "fed02515-c0e7-4d37-86ea-96600ffbf53c", "comment": "Malware payload (DanaBot)", "value": "a990fa175431f495085dca849b62aec7ea71f3a7", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998937, "uuid": "d62ecd41-fe04-4537-af4f-ce355c32a225", "comment": "Malware payload (DanaBot)", "value": "5df8e227684818099e66c6514e287463ff847f242f26ce806fb070bde10cf92ba4416e544784f3e149c9b438fe427594", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998937, "uuid": "6bc36b47-25f4-4251-a9a2-3cb50c6a7e48", "value": "B2351211B7A0C034E1FB12FD4975D378A7293AB0972854CB52D529EE9738AE4EC3235B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998937, "uuid": "6ff85215-e6fe-4738-b854-7c04b41a49bb", "value": "924d9a2d7cc05ebebcdeae3f0201835c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998937, "uuid": "e4f2a85c-7851-44a9-a09a-7305d792bc4d", "value": "24576:3czOCFBzcNMhvWCv76Th6jXwHtX5qHDaj6uKEKwzB:gSNMhU64XpWuKEvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998937, "uuid": "af641262-f40f-416d-80dc-79fc82f8356e", "value": 1145856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998937, "uuid": "d82e558c-5fdd-4162-a14e-1375f948322e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998937, "uuid": "36ae34fa-16ac-4d84-9e5a-d4eeb8d40fe7", "value": "61310ba96c1aaff280a5cee3bdcc264e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca66c467-d00c-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624003891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624003891, "uuid": "77550492-75ce-43f8-a4b4-396d9d39c586", "comment": "Malware payload (CobaltStrike)", "value": "21f7101edb9f28d281844455f23ea62d", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624003891, "uuid": "ce7369b5-8e3c-4c19-bdab-1f2641e924cd", "comment": "Malware payload (CobaltStrike)", "value": "0ec278df12215701d1c1a31b797ffcc7cc25f04d9e563e48bea600b3397b40b2", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624003891, "uuid": "9f45e133-b8b4-44b2-aeb3-bd65589a6572", "comment": "Malware payload (CobaltStrike)", "value": "57c28debae6c9562766c230698e5cd59c8b5a4c5", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624003891, "uuid": "e9c0c14d-91eb-4662-a3d5-c759861f9629", "comment": "Malware payload (CobaltStrike)", "value": "3bb85bbf26069351aed2dd11155ec21f2df36950d2106bc19f17d6ce76f943f59eab393aca606f455bcf1eb63c606145", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624003891, "uuid": "16e875ba-fe48-4a4f-8e51-ab3185fd5397", "value": "C62423BA1AA463C6E9C0B901CFE6611DB1485B53CC32C9FF9247E527EF7A3019C38665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624003891, "uuid": "be6b36f9-5808-46f9-8004-53833b898cc3", "value": "6144:/ZrO/8k/5yakLNGETx/JDhXDfwomV8kZB:/ZrnseTpVhT6/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624003891, "uuid": "5006f4c1-aa97-49aa-8d1c-7fbd12c65f0a", "value": 213936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624003891, "uuid": "a006085c-e89f-499f-8188-a16c630ad196", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624003891, "uuid": "a668f635-e6e8-4be7-9b0c-968b2fbd0fe9", "value": "coba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b487ab2-d079-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624050493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050493, "uuid": "68e5f605-5bd5-4e08-8add-d6166a32b974", "comment": "Malware payload", "value": "7d6fbe7943dcbf29b56707fa93faf996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050493, "uuid": "52bbb990-6b5b-40d9-883e-6ced8c73700c", "comment": "Malware payload", "value": "0f1be07b091e7a584ec7244d05647f2a8aa761c0a29060a72e00ae9638b72f6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050493, "uuid": "6eb34baa-83ab-43f8-b4fb-613d0bb37539", "comment": "Malware payload", "value": "22ee611cca6aee446323fbad3bde90a9afd6873e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050493, "uuid": "4c026827-afc5-45d0-bdc5-b6f66dc3c861", "comment": "Malware payload", "value": "cda278729e3b66e4fb7da510da6b5661a5ff758a7758a42af9c447fe71f0e9876b5a2b38082fd7d526f3fbd25f495ca9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050493, "uuid": "3fad28f6-6886-4237-8c74-ce2b268721ce", "value": "54256BDD322072EEC867D4729EA81C64EA517C7B871B4103902735AEEA7D897DF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050493, "uuid": "b411ce59-347d-4664-a23d-f7f4a297249c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050493, "uuid": "bdcb0ac5-e1a3-42b5-bfa6-00285ae51703", "value": "24576:my6NFC5U4Dk+rZrqyd+LhMOlRqlPrPbBlt+v5mIF:mlNFC64DlFrrE7MXUvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624050493, "uuid": "a5b0c390-e667-48aa-9b80-ca2d1d08cc5f", "value": 995328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624050493, "uuid": "ad3a5981-fdfc-4b3c-ac9d-07e318dd67a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050493, "uuid": "5f00c38e-3670-4202-9bdb-c4c6cfb62f26", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45476f97-d008-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624001950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001950, "uuid": "ece5f734-03a5-4adb-ad56-da86995d40c2", "comment": "Malware payload (AgentTesla)", "value": "2ee14bf16671a7f8b4f76d6e7e5f2ce8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001950, "uuid": "b1998eed-c130-4e3f-b097-3a697f51f249", "comment": "Malware payload (AgentTesla)", "value": "106301b785929cd53a354ecf196577606e5946e51cb3e87a851506c1b439faf4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001950, "uuid": "4d27ae3a-7f45-4fff-81b3-83ad71fd3966", "comment": "Malware payload (AgentTesla)", "value": "e94c2a05713cce05ddc738fd9245a44a54f3d0c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001950, "uuid": "33046f1f-5f82-4c87-81d8-eb9dff7cece7", "comment": "Malware payload (AgentTesla)", "value": "9e23019801447f3f1e159a665db63759deaca7e9b85e0e3f5d3fce9e665c7c6c4a4cfd1fe70921f9834d5d583e73986f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001950, "uuid": "863b41ff-aa91-417a-925b-c6e412a28a74", "value": "39E4C0243AEA6129F177EF365AE475D69BFEF6233703D81D2891038B0612E41DEC153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001950, "uuid": "3aebe0dd-341f-4adb-a3cc-fd8f6fc2cca9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001950, "uuid": "17f284c3-5daf-4142-b2a0-fb45d8421e9f", "value": "12288:u+Ffhlm4S4F3M9yCm2iNiY8Q6IPyxRze7cB/xqvGGHjyDVUN9YHt6hpbZTXhFC9f:u4WK1kvQwHl/xlGmDVULYNspbphFC9Uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624001950, "uuid": "7e299286-1b99-4026-87c6-c2b36c8bde64", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624001950, "uuid": "504b62a5-225d-4249-8deb-4521030c7cbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001950, "uuid": "5f0bf7ef-ad6b-4628-90d1-877c541bcda3", "value": "2ee14bf16671a7f8b4f76d6e7e5f2ce8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0107d1-d01f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011924, "uuid": "3420bada-cb4b-47a6-8ff9-b0b4dcfad7fc", "comment": "Malware payload (Mirai)", "value": "f84d6c5b7df0480626585eb052df820f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011924, "uuid": "9ad39399-6498-4b29-a8e3-6d23a646147e", "comment": "Malware payload (Mirai)", "value": "114d706ac0aa832ad65fbb7940d4d50f75dec4f377020c089376a1bd2d920d92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011924, "uuid": "212ea2d8-d6e7-440d-9847-6d967e98b2e0", "comment": "Malware payload (Mirai)", "value": "f47107c9e0c9562d8eb624f06b701cd1d1126cf6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011924, "uuid": "2d86ed0b-a52b-48c8-9c18-167495bba39e", "comment": "Malware payload (Mirai)", "value": "2abcbd5addb8ea3f593bd3090f8b372e7084a475806d53442b3860007ff7c0c435e140232c5ed97b83f488e50126d264", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011924, "uuid": "0170b08f-ed38-4583-b8f6-0bc636ec374f", "value": "E1539DB1C56DFDA4D1044AB4BD258B789313E50086672EFADB45C69A804BEECF61C3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011924, "uuid": "3279377b-2a81-4818-a21c-bab263f0b288", "value": "1536:91+wtA4TYU3DI/MKDjQs3h7Ol/qaQedwKC4OT:91+cJ3D7SQ+hij5dwKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011924, "uuid": "4b1aa0fe-dab8-498a-8853-2bf5789821ec", "value": 62452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011924, "uuid": "1b43361b-0dd0-4ab5-9770-3694b12b05aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011924, "uuid": "b9605f1e-aab3-4ce1-a11c-64bd9f7d2ab8", "value": "f84d6c5b7df0480626585eb052df820f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03890417-d079-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624050373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050373, "uuid": "0beb1d42-3be0-4737-8577-0f9500727fb2", "comment": "Malware payload", "value": "e31c2e4b3ac0c48e04b7ca4b7c702a36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050373, "uuid": "c0d94af7-b3f7-4160-bd24-68d55c847a06", "comment": "Malware payload", "value": "11d04c12597ad35e1a5be1ae7cc53114fb0796812d7370dcfc21e126e8aafa80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050373, "uuid": "dfd871f3-6411-40b9-b505-91c754f427de", "comment": "Malware payload", "value": "7361af49a61af295dd85dceb38b83e47cc77a608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050373, "uuid": "b424bfaa-e0aa-4a86-b825-9da9369ebf30", "comment": "Malware payload", "value": "aef931b18583c8686944de09839156919224bac2dbd4de719aecaeb84bd8c00b42ffeda2f7fc68aaf387890162daee03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050373, "uuid": "13a88b1d-0c72-4692-93a4-779714930737", "value": "3905C0213AEA5119F077AF785FD0B5959BAEFF237702E48D189133871A33981CD9063A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050373, "uuid": "4de3b7bf-2582-40a9-ac70-d6becfee76a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050373, "uuid": "69fdc76a-8c6b-4c32-9970-0d50ce9c26d3", "value": "12288:AYk1hlm4S4F3M9yWa/vmhLsGbLfZsrVBZLbCn9lg74Y7YCBHn4AnhhQXXwGNuGhb:AtW1Evc/LfavleLS7FH4M0X2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624050373, "uuid": "8c295f43-0cf1-4a71-81ad-a0c349e0f3d8", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624050373, "uuid": "017dc963-8602-49e2-bbc2-b1de227889e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050373, "uuid": "c18194e0-f0ce-4393-90ff-7298824bd480", "value": "RFQ_TERMS_107_10702062207_0_US.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6810440-cfef-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623991429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623991429, "uuid": "6976c40c-8af5-44de-9dfa-f14d4dc007a7", "comment": "Malware payload (SnakeKeylogger)", "value": "bc072b150caeb0468ce7d122b7489a4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623991429, "uuid": "bfbf4755-85d2-4f8c-a4ae-89c079469ccc", "comment": "Malware payload (SnakeKeylogger)", "value": "11e07ec0803f49241e31cf05330b2624a04380a7304ca6281e5d4c49746f3c89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623991429, "uuid": "1fcccc37-ab0d-4587-9e68-10a68805a7ab", "comment": "Malware payload (SnakeKeylogger)", "value": "966dab902c8359560e9e2bc057ca0aa937d02c46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623991429, "uuid": "929cd888-a10d-4bd4-a6ab-eb91b9c90ec2", "comment": "Malware payload (SnakeKeylogger)", "value": "b6a50a46bdf17565d1cebbb943005a52b5f5fb4e00137394644631ad588c692e2c6749789c80f239acedef53b39417fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623991429, "uuid": "1fcbe26c-e23c-4559-845e-f1df81353636", "value": "5D65E1203EEA5514F0F7DF795ED07DB19A6EBED32A12D02E2495738A1633A81CC9113E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623991429, "uuid": "1368035b-f6d4-40df-9160-79a284923f55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623991429, "uuid": "1269eade-4e3d-4909-8a9e-70b700bae0a0", "value": "24576:pvcvLfa9VLhTPtJNfIh+4kXHZGkPdsa4yU4MHwMhqkJDRcT2/Xc6:pefa9Bp79I4xF947zQMhq8GK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623991429, "uuid": "53ae20fd-49e9-4d7d-b405-f3c40cc0f87b", "value": 1505280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623991429, "uuid": "fc10d260-c735-472d-8dde-32b4fd8aa67b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623991429, "uuid": "59e6b9da-2243-40fc-9c53-7e8085e62bd6", "value": "SecuriteInfo.com.Scr.Malcodegdn30.10949.31820", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ecbda0-cfff-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623998144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998144, "uuid": "a9644d2a-73d8-4bf1-bb1a-fed9c5c6d050", "comment": "Malware payload (AsyncRAT)", "value": "689281d034271b8a0c5134b856447d3c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998144, "uuid": "3f9c7b2c-2c30-4702-8116-840a981dc195", "comment": "Malware payload (AsyncRAT)", "value": "14756b4b337d96a2f0fc3b796ec537b5a395654d20bed09f0dcfe6541d6c75b4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998144, "uuid": "cd877cb8-800c-4b75-806b-46b375d3bbbb", "comment": "Malware payload (AsyncRAT)", "value": "8778c7c2323e4f70d4c9b07b49748ddd3795aa04", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998144, "uuid": "5d3426bc-cefd-4a3e-97ed-46027f1f6c94", "comment": "Malware payload (AsyncRAT)", "value": "ca5f7f1f7e400224853a31031e6a8a4073ef02d78452d4c9e52fa02b3e18753102223626c1dfa8b3cbf702bd764073d3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998144, "uuid": "d3f10d00-28e0-410e-8a54-82d6b4ccdcb0", "value": "C6D02220ED02F9D1221A52AD020E0CA6CAD1406C4F39C4427B25C030705E49B9C9E9E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998144, "uuid": "935c5735-2acf-4ffd-abf4-e875d895b530", "value": "3:+HgwX95CIW3oLUJkyWFoVnovmmOi32VMdE5CITQYAYO3WBQOjk8CHF4sTxv65VMn:iCIo4jFoVnovzGLcITGYmWa/l4KxvEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998144, "uuid": "fce749be-1d47-4059-a93e-03b54f836573", "value": 210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998144, "uuid": "6b68fe13-e62d-4cbc-9efa-f016730480dd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998144, "uuid": "ed71dd51-4143-49a0-9ad0-13a77279b17e", "value": "eBill-ID134674494416833.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68df9c3b-d002-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623999433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999433, "uuid": "1d9678f3-9990-4be9-912a-af9ddb580de8", "comment": "Malware payload (AgentTesla)", "value": "164b50f65da42ff885f0957de32d7462", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999433, "uuid": "5f93913b-ad19-427f-bb15-4e9bbecf7946", "comment": "Malware payload (AgentTesla)", "value": "161fa711cb6048634162e4af6f974dd0fac50b2362a061a2d20317938d40df67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999433, "uuid": "a8ba70a8-caea-432b-bdfe-c43728d27f39", "comment": "Malware payload (AgentTesla)", "value": "d36044dc6182a7f5410fcfbad5edc3e52949db89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999433, "uuid": "ffda4869-2fc4-4e82-93fd-34b65035394a", "comment": "Malware payload (AgentTesla)", "value": "a6c0c847bf48d3c73e4fd45973dc897190bd4ff466eabc12416b43deb744143017808dae8e3932e01e323f88d1afa9b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999433, "uuid": "ea50ed90-f891-453f-a0c3-d3bdc032ced2", "value": "DF15D0213AEA8518F077AFB41EE0B5514AAFFF277606E04E2491334B2733681DD9163E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999433, "uuid": "e0dcef70-b2dc-4eaf-a00a-6e7d9c4cc8b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999433, "uuid": "55cced3d-65ac-46e7-9445-051690507a8d", "value": "24576:m6WtEvc/Lfa6JSBlQHS71hesshL8deDXRsIQiS4P:HmfaeS5gsfkbQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623999433, "uuid": "7c865af1-c964-4232-b239-11561af653fd", "value": 925184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623999433, "uuid": "5cf25202-1e5e-470b-beb7-dd2491499028", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999433, "uuid": "630a9b34-d343-4b95-84cc-fedc1ae32b71", "value": "164b50f65da42ff885f0957de32d7462.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a3be14-d072-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624047496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047496, "uuid": "cddcda37-3a42-4f31-8d9f-4763658d1ce7", "comment": "Malware payload (Mirai)", "value": "5985ea8a94fcc0982cdda949f86e5ac9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047496, "uuid": "54905ee7-f456-429d-a971-d51ae6155e3f", "comment": "Malware payload (Mirai)", "value": "1737c01c8cee6c74b9c801845e0bea583621a09fc86a990b7d020afc933327bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047496, "uuid": "77443954-29ed-4071-a535-586019f014ec", "comment": "Malware payload (Mirai)", "value": "03f64316d48976a7dea0366fcc082e5dfa0d4d7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047496, "uuid": "6cc00af2-1cfd-4e5e-9bb8-71979b762653", "comment": "Malware payload (Mirai)", "value": "6824efdc54b90b3a13fed4d300cb4ab81f51642ef469cb614d4ab33242a59c1b9810aac40860e608970dfba3ba4e7f50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047496, "uuid": "931edfeb-ad97-4645-a4e8-f6a6fa126143", "value": "2C239DB3C42DEDD8C54902797A284E3D5723E50087271EFB5E9A86A59007EECF60A7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047496, "uuid": "a2d5a077-5c49-445a-962b-1220d815fdf3", "value": "768:Ma1/hnrsPxgOH59EEvc9NhG/BJLtsqFaBNjz/CboO+O4ICnP:Ma1/tsFZ/c9NhA4vPzOgICn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624047496, "uuid": "20e2c611-d04b-43e9-a7fe-4293a909f1cf", "value": 47216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624047496, "uuid": "cedf26e7-790f-40bc-833f-6935feb308ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047496, "uuid": "7526e7b7-5128-40d1-a1cb-41759c66b6c3", "value": "5985ea8a94fcc0982cdda949f86e5ac9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f7ef0f-cfdc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623982969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623982969, "uuid": "803c7946-c46a-4be0-9cae-28b50983472c", "comment": "Malware payload", "value": "269e85ccb00b6abe65338dce02866395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623982969, "uuid": "19531786-29b6-444f-973b-ae5cd66722fd", "comment": "Malware payload", "value": "17947346bc76e33d07a4f48e6fa37cc9a923070295ae88d8b8f47e1daf3346a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623982969, "uuid": "ce1d5e61-8bc8-45cd-80da-51a27571bfe0", "comment": "Malware payload", "value": "d13f7e0bddce0df5cf8bfedfa276623c35482dd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623982969, "uuid": "18b515a0-2f2e-45a3-9860-16367206c29a", "comment": "Malware payload", "value": "156c3d43473d5748d227211a19bf55a0f103cd110ee8306cde5ffa77c2500d60c78ced5737ecb78b1be785a50ce4e1ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623982969, "uuid": "fc8e83f8-c754-45e9-89d9-7fd773e92d3a", "value": "58F5270D6602AFAEED1E85F38FB40E54EB30E9EFDA0FD186A35213E9A74D5539D04061", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623982969, "uuid": "e9a598ec-5cc1-4c26-8046-1dd39fec4eff", "value": "ff38dfbf69721f8f7b446ac94c6adbbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623982969, "uuid": "4d8092e3-b5e5-49c5-8d7a-5d78d379fe52", "value": "49152:WB1jmC+E4oEhAcWL5oHuLeTSY8W7DDDDDDNc/9Lqd9gpaPk+hTMX:01V+E4oQkoHu29c/909gpay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623982969, "uuid": "db28262c-9d02-4c27-88db-ded3dd418655", "value": 3535872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623982969, "uuid": "3e053f87-2d47-43cb-a6f5-dcf9b813b340", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623982969, "uuid": "f5dab2d3-79e8-42f7-ab77-ebdc808dcf82", "value": "Resident Evil Village.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336ccc0e-d035-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624021247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021247, "uuid": "b02eeb39-5bbf-48a4-9775-a01c869aa5ef", "comment": "Malware payload (SnakeKeylogger)", "value": "80d0f1025f6f424223497f7be1612a69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021247, "uuid": "a6cfa54f-e6d7-4d93-8b47-c2a7e44d5d28", "comment": "Malware payload (SnakeKeylogger)", "value": "19114d1f7709bcabb6ea19c9145267e114a403a690975c6eac5c8478ed278cf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021247, "uuid": "9a35572b-10ae-4a30-8d8c-6b99e0ddcb00", "comment": "Malware payload (SnakeKeylogger)", "value": "d150c271d6f938f5c7eccb6aabca440be51aa08f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021247, "uuid": "dc78bba4-609d-4dee-a95a-09c21e1e0ff4", "comment": "Malware payload (SnakeKeylogger)", "value": "92a438fc790b9ce444320277ce0430197a55b4f50ed61dc8a38401ea28b4905763b8291cb873163e427f59285320d1fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021247, "uuid": "de7b2e3b-e4d3-47fc-afe8-db20a356c857", "value": "4F948DF16780C465D8A796B9883BDAA7B433A24E9C68490D3D91FF0F7D72347402789B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021247, "uuid": "a4c8d76b-a891-44c8-9dfc-8cee57ceaa62", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021247, "uuid": "a91afb02-dc7d-47fb-a044-79e07158c2c5", "value": "6144:RBlL/ZuDA1+3+AuF7ac88JTFlnwyE1+6kaLKzoOcE50RNjS4jrmP2bVdd+dX:3zgA03jgdTFlqoraL6jcEiRZjrmPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624021247, "uuid": "a16cb7be-0e4a-4e5a-8471-b5c84b3b6558", "value": 421708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624021247, "uuid": "71d7bccb-a344-4f95-b68f-46cdecf5c7ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021247, "uuid": "a80138e8-ef1a-4a7b-84fa-89205c4acd0e", "value": "Img-347654566091236.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a67b34-d084-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624055339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624055339, "uuid": "541b6f74-5426-4f20-a912-7d7e7f7871ce", "comment": "Malware payload", "value": "d7fcd49553f07ec0dcdf66ee0673bbe5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624055339, "uuid": "70609644-faf8-46f3-9fed-b0cae790f633", "comment": "Malware payload", "value": "1916cceb86e4b64ec370d958a099114c36b3b4fe16c9e27c7935b2aadd3c8ed6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624055339, "uuid": "637f02f2-544f-4bc0-a61a-8a45fb6fc139", "comment": "Malware payload", "value": "ee76ba0c8d2c8e4c9247c64ded770b00a61ca028", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624055339, "uuid": "68a33c55-b228-45ed-9b18-aba4d35cd7f5", "comment": "Malware payload", "value": "d699265f0b7f85f21663d432ea81a2ffe0e32c062be24364463be7bb79801ea5adc0128d1e2c5c67767fed339b7273d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624055339, "uuid": "946bc021-9db3-440e-a45f-ea4bb670c363", "value": "3D351200B2B2D039F5BB12F895798378AB2E7DB1976404CBA2D516EB52387E4EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624055339, "uuid": "4015c847-c33c-4dcb-8994-e6c3444c8b72", "value": "ab2fb56fc05bfc607ada1283b4f9a600", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624055339, "uuid": "4b7c434d-fe03-43aa-bcf2-cf9fb8e61611", "value": "24576:uX9q6VMqYc7BtopAD/n2M2NGcSAPnTK4Q95Z7zoZ:UYM/z24vAPT1Q95Zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624055339, "uuid": "309b15f3-ffc7-4998-b964-e087ea79d72a", "value": 1136640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624055339, "uuid": "02657fed-2b35-4f4a-a03b-9ee9df857da0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624055339, "uuid": "3e8e290a-de1d-471a-add9-d2459a67c929", "value": "d7fcd49553f07ec0dcdf66ee0673bbe5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19384ab6-cffe-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623997581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997581, "uuid": "79a426a2-2235-4d05-b585-d66a5f0b5428", "comment": "Malware payload (GuLoader)", "value": "74d6d7881b0d993e3e2291e889fbf819", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997581, "uuid": "874627e8-49dd-44c0-8fbe-35778d746926", "comment": "Malware payload (GuLoader)", "value": "195f35a6eedbda830050e0b225ad8f2d05832094273a425c26b2679b3b10eba8", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997581, "uuid": "c3f40d65-4915-4ae7-9dff-4f467f3982fc", "comment": "Malware payload (GuLoader)", "value": "5f6a4e1bb0b8a66a6cf2b8f9db5baec97ab079b1", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997581, "uuid": "3d4ef12c-7785-4ca1-8081-562af4446b79", "comment": "Malware payload (GuLoader)", "value": "ff9b9501615320d1950b752bb3f1c0f5467ed64001303b019303e60319377887d7dba2885ca5d1e8057940aa1c1587dd", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997581, "uuid": "4a8f0f75-f51d-4517-a064-f2478a80d87b", "value": "A8652382BFD25BC7E28F64B417578CBD69797C11E202859F3B2C32891C7ADD2436629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997581, "uuid": "962569d9-d60c-4779-b259-bff31b9352ad", "value": "24576:XMAgBhMXgwQ+6Z5NylIW/mlWHPhDRE8y7m9xc8JV5oT1unOUC7M6rf:X0QID3NyXpDRfxrY1DUavrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997581, "uuid": "b3c18fc1-aa65-4ace-981a-7f3d6bbb4085", "value": 1449472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997581, "uuid": "bf05839c-d07f-4e7b-ba4a-87a087508d92", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997581, "uuid": "a161aaa2-e30a-4f18-b395-17600e999c5c", "value": "Booking Confirmation 912146703.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f4c40a-d078-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1624050342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050342, "uuid": "b394623f-326e-4736-9ae6-b164b9abb6af", "comment": "Malware payload (DiamondFox)", "value": "70210bd4707c051f84fb0c770b968865", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050342, "uuid": "a6fb847a-0a12-4483-bfbf-9e31de2225cd", "comment": "Malware payload (DiamondFox)", "value": "19e98771fa63687f7b8e9359b9c50c8a127e61b82397407ae1d7a03d4b7da414", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050342, "uuid": "ad597768-fa66-4a6f-80bb-48534094403b", "comment": "Malware payload (DiamondFox)", "value": "b12d546dd20a8fff1352517cf654153aad6e5528", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050342, "uuid": "f7bbe604-afcf-4c8b-a49a-d92eabcd8b1f", "comment": "Malware payload (DiamondFox)", "value": "a741d4d764a4ca62cafd5fb017b28ba5d5643b3609c167a0e02cab4aa2f27345858f994c8e68e7bff5381a1201a18f89", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050342, "uuid": "dd2d26d1-97c4-4c7e-96d0-8b49a1f1333e", "value": "23363370B510C23DDAB4023DB2DF1E179D8A94DB3EF5A5FBD9E5D785BA02820E126702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050342, "uuid": "d0490bac-5f1e-480f-b0cf-42f7d55812a3", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050342, "uuid": "0b592ef8-d18f-430d-a3d4-0acfaadbdbd5", "value": "98304:Jl5Pi396Hjee6FeFTOgvaNjtdoeZP+7aZ7U+p/HSytuGyhme5thi:Jl509Gqe3Fi4MBhP+7ae+hSYuwezk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624050342, "uuid": "13ae1072-5eb3-4d07-9de7-700bfc052753", "value": 5085954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624050342, "uuid": "6bf52d02-17a0-466a-978b-1b6b0bdca1f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050342, "uuid": "09b332a9-81d3-4e36-8bf5-73eb51828d72", "value": "70210BD4707C051F84FB0C770B968865.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fc2579-cffe-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623997930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997930, "uuid": "52fa232d-e586-465f-912c-e64d9b4d1807", "comment": "Malware payload", "value": "305aa68a10c693fb8d22a8ed2d84331f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997930, "uuid": "9c980b76-902c-4aff-b0c9-0a34d4d27e10", "comment": "Malware payload", "value": "1c46c881c00a6fecd8ec2f5546802ccad62cdebe824e1ebbd77c9bd87c700771", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997930, "uuid": "c75b919d-f0d6-4032-bba9-052ba5bd052e", "comment": "Malware payload", "value": "f0447ef4d39f85c40d3f28576c7e59e2777589a7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997930, "uuid": "42af2bbe-76ea-4902-9408-1521e99120d2", "comment": "Malware payload", "value": "273043da3ac86740b08fe0aeceea56a6ae87e219e0ff5c15d83383d5b6e99a3d28e17cdadadd77756a4e201d9df1e6dd", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997930, "uuid": "0e7b16a6-1497-4988-b53c-6d6e06fa08d5", "value": "DF2149044FE21320E6F79B39AC7AB311CD767C52EE624FCD024051486821611F8B4F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997930, "uuid": "3e9f5f39-5694-41be-ae3a-e5294d67066c", "value": "12:80m/++VSXvk44X3ojsqzKtnWNN5UcCsvXmQL6H/sfECEpHdiN33YqlPcr+9m:8JpHYVKVWB/CWp+7qH/dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997930, "uuid": "f77ffc22-460a-4442-8bf6-f6b384c99729", "value": 1116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997930, "uuid": "5c17ae67-db8d-4a92-830c-2f1726f76e7b", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997930, "uuid": "1e0dac38-05d9-4ca7-873b-fdf18a2e5788", "value": "NewPurchaseOrderJune1.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0e0e33-d05b-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624037767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037767, "uuid": "b1b107d9-6393-46ee-a45e-95b50fae6867", "comment": "Malware payload (RedLineStealer)", "value": "b5521726048a702c1755d277c729ab6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037767, "uuid": "de71e06c-09f2-453f-b361-d8571a982217", "comment": "Malware payload (RedLineStealer)", "value": "1caeecb143509875ed409dafd74b66d1975a382ea262404182cf9949d9ae5385", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037767, "uuid": "9e9da1de-f2a1-4dec-8801-81f9850753d4", "comment": "Malware payload (RedLineStealer)", "value": "5249ef236d378f9520cf5c20c865dbacdb449235", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037767, "uuid": "be11f44a-703b-420a-a66f-c428b012834a", "comment": "Malware payload (RedLineStealer)", "value": "6958db47765f9af725cdf941f86490f1d54a03755ca79f882dd5b14b88aa56e70a7a4a89baef07994aa6dda45fb52aee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037767, "uuid": "3414cb0d-5bea-4d2c-b0b6-e9f761a77e86", "value": "A884CF10FB90C035F1F212F85ABA93B9A53D7AB1A72490CF52D51AEE5634AE0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037767, "uuid": "8f78cc34-d7e7-4db7-a2b0-313235e0d209", "value": "705a372c868b933d973ca642948b7012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037767, "uuid": "b36e2c99-6728-478a-89a7-b4d59bfcf285", "value": "6144:HGl69nnskPwG2MCRZP2aH/TjsUdlJ+01FVievVJUV+I9NDkbUO3G1qx0I:y69nsk4G2MeZ9HsUdbZhiMVJUn9NgbzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624037767, "uuid": "aa015fd7-d8bd-4d2b-86c4-e8a25f7484fc", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624037767, "uuid": "28c1cff0-7b22-44bf-96b0-6ea0026b2345", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037767, "uuid": "723effdc-8bcf-4429-99d1-7c2a27099db5", "value": "b5521726048a702c1755d277c729ab6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24fd47d-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1623976873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976873, "uuid": "e136fe4c-52aa-459a-89ce-0e3f4acf25da", "comment": "Malware payload (BitRAT)", "value": "a7ade659adbe4dcfc2ce0f22058fe090", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976873, "uuid": "dc9d3a71-8e0b-4ebc-86dc-61a354518078", "comment": "Malware payload (BitRAT)", "value": "1d1b9a4c53cd014c19acf98c028f11bad7bcf60bf6f56657d37b3cec1020cc7b", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976873, "uuid": "1e6691d3-d116-41f8-b307-4edc83eaf67b", "comment": "Malware payload (BitRAT)", "value": "33dcb4830c7f3d068ba17278ec9dc214aa500702", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976873, "uuid": "66a38df9-3775-4039-baa4-e8e704cbadf8", "comment": "Malware payload (BitRAT)", "value": "71c9313c2f8783068cc1beaff34c4e27b347faedcdbbf3708f6f1b67e083dca7a83c96b7d2d8f068f0e7deebbd966209", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976873, "uuid": "30933490-cc89-4da6-8f1c-054a8777f726", "value": "338533153FDA19C6DDDC42B39CD06DB88032BBCA6623DD2F7007523B6D9239A8664F94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976873, "uuid": "db300220-687d-426b-8e18-bddfcf4b1bfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976873, "uuid": "0374dea9-09de-4896-a541-d75a9732ff3f", "value": "49152:Zoani5J/mRdzXs0eeaTqXGqgj68ynwV7kCHS0yre9YSK:iZHmR1Xs0YqXqeeS0ycYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976873, "uuid": "33615627-92ab-45e2-aeb8-a8fd22a7bebb", "value": 1787904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976873, "uuid": "610dea99-bdfe-4fa5-932e-4783a784075b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976873, "uuid": "49baaa72-52a8-4caa-98c8-831260ef8a22", "value": "INVOICE.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e944ddb-cfec-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623990074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623990074, "uuid": "f7506bcc-7fde-4df7-bcbb-263085aca0cc", "comment": "Malware payload", "value": "ff1cb9b30854785b3db7805578c85b95", "object_relation": "md5", "Tag": [ { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623990074, "uuid": "ae16bd96-0832-492c-a7b4-e817e0a2e656", "comment": "Malware payload", "value": "1d3c29ed218c02e1fd85495148b7c6da847e7e70f7f186695a0d9f367db7f7ea", "object_relation": "sha256", "Tag": [ { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623990074, "uuid": "232ffcfb-7420-45d0-888e-b9266c2cc093", "comment": "Malware payload", "value": "5967d6f3887be62bc5d1644099586f8005eb36a2", "object_relation": "sha1", "Tag": [ { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623990074, "uuid": "31b8c38d-b0f9-4b39-8382-e85a4c6d9a72", "comment": "Malware payload", "value": "29bdeebe8e0cd30cb91a63c6a4e93f0634a9893910b4d3b38d57d194173f62a47102a7ab856b91873af6e12ab3e65d5a", "object_relation": "sha3-384", "Tag": [ { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623990074, "uuid": "af94c97e-b98d-4a84-b101-502bd51f7da4", "value": "DA160132F49A3362E84DCAB405B01DA403F56DB4126F9BC43376756FC237EAD9A28935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623990074, "uuid": "7996d567-c299-4a4b-ac7e-d31947e02899", "value": "98304:p6Koe+/CrUwZagODxPPr61+tqBZa7Gvnsbz8v:RoNqnZag8K+tq3fsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623990074, "uuid": "e14b3ab2-bc89-456d-9c8c-955714bc23f7", "value": 4311680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623990074, "uuid": "b4ee5787-dede-4cff-91cd-6bc006e35559", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623990074, "uuid": "baec0d3e-ff5e-4023-9b4d-b2d1b557bf3e", "value": "seudebito9896642cqyrs9th nmbofm.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c6184e-d01c-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1624010675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010675, "uuid": "f08b0a2c-8dbe-4fb3-ac71-e387be021979", "comment": "Malware payload (TrickBot)", "value": "a30f49b2c63b5ff5025a7a46e7ee4821", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010675, "uuid": "9f62e058-f320-40ec-8cd7-5e22b9dcb951", "comment": "Malware payload (TrickBot)", "value": "1d66dd1c1693ce08aea4f043c59079e8053bbd916f00eccab1d074b334a5a1a9", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010675, "uuid": "d52cdf4e-e224-42fb-8a64-18d3707a385d", "comment": "Malware payload (TrickBot)", "value": "9a68c78a5311e7e77b6bd6ba21bdd92bd1c90f8d", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010675, "uuid": "441a96a6-d85e-4993-bead-40c1dac170ec", "comment": "Malware payload (TrickBot)", "value": "1f821aa89dfe36e550dff1243dbb7eecc2d6e71dc470c730e330edb9f8d659de5e6db4a9db627c1d2a4fe3b117fdcd93", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010675, "uuid": "76fe238d-d7e8-4a83-aaa9-122ca7204b6b", "value": "06F31206D701B0E8C66350B5594235D97C69707ABD42FE4E6F74BFAAB3010DA32CE716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010675, "uuid": "bca8afd2-e395-427f-a272-9e310cb6735f", "value": "3072:WJU9VlUBWA6CFvA7bRCxAVIKBIKxVymd1xXP4XHwYoQz:WJU3liWA6FsYBfxVyWxf6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624010675, "uuid": "86d627c9-0c7a-4a8e-afef-c64fd7676232", "value": 158973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624010675, "uuid": "f80b2200-0624-459f-8669-9a9785088c9a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010675, "uuid": "0b2111d0-2f6f-4ddd-9a3f-83f94f7bb0a9", "value": "idea-1127603629.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fca14b-d077-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624049518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049518, "uuid": "d1b2d090-4133-4bac-97f1-8500f8c81012", "comment": "Malware payload (AgentTesla)", "value": "cbea272185d589e144f6c4eb0f0b9abe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049518, "uuid": "6f529011-8297-4ed8-a5aa-0bd2ba65787d", "comment": "Malware payload (AgentTesla)", "value": "1d6cac17381e03728882db8d50bef577b65ba46cacd96f12ba3953cd3a50dbc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049518, "uuid": "2720f5e6-f61a-460c-942a-f027f3ce1d66", "comment": "Malware payload (AgentTesla)", "value": "10b75a2215b4354adfb591de9d139567f78a5aae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049518, "uuid": "42215615-7fd4-46d5-acc1-e19f2138f59b", "comment": "Malware payload (AgentTesla)", "value": "0c7b52be2755d0bc9a96f5a6abf56f7ecf9fc21676a34f255d6148bab7bfa4a3c98aa538db1eebcc6d69abea8723d74f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049518, "uuid": "7d1304cf-c6e6-46c6-b864-d163a951a435", "value": "22D4BF243AEEA129F173EF755AE07586DBEEB6633703D45D2891038B0613E40DED193A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049518, "uuid": "98e098f3-34b1-49c6-bea3-53d86bc9b93c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049518, "uuid": "1f8af170-5e56-495e-b7fa-b97312abd9e5", "value": "12288:XOyhlm4S4F3M9ypm2iNfrnDLI7S0txpzIxy3Clqvmi/tpuMuc1:X1Wp1ZnDLUzm4CQic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624049518, "uuid": "f56a8ca1-f15a-4a2c-a39f-0ecdd44b7c32", "value": 655872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624049518, "uuid": "fef9d993-ed95-4933-ac01-8c55d15d13e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049518, "uuid": "75acc5a1-b5ee-4b3e-b44b-e6818f2f9a0c", "value": "Payment Receipt.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4faa39c7-d002-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623999390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999390, "uuid": "a525abdd-5e9e-40af-988c-1f3d8305e11f", "comment": "Malware payload (Loki)", "value": "7e4578c724a5d597eb2e044dc7ffbf64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999390, "uuid": "392c5f67-146f-40c4-ab5e-548b92ab3349", "comment": "Malware payload (Loki)", "value": "1e2dbc83e6cbba7d09aba06c3c7fde3e776dc5f8d50d4711ae1fc3298574e5ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999390, "uuid": "3b859d86-7137-4d2f-a9d2-12c00534407f", "comment": "Malware payload (Loki)", "value": "71b002426e2a4c7b55af3cae6196d2664c64eef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999390, "uuid": "c5248485-7507-4b27-b891-33d3405bde66", "comment": "Malware payload (Loki)", "value": "7a6c5e54115ca4b693d4b7885c4f997839fe3d90a8e4f7b8c8cb19efbafaac0e53e652fe8f8a095879b8a5d79cd69687", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999390, "uuid": "1695146c-7577-4e2c-b249-0349141c486b", "value": "B3F4BF212EEA5119F177EF785FD079959BAEFF237602E44E189133470A33A81CD9063A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999390, "uuid": "17d6d381-a002-4250-b791-e065df555729", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999390, "uuid": "0f276a4b-7625-451f-925f-7edad7b8e954", "value": "12288:jexHhlm4S4F3M9yIa/vmhLsGbLfZs7sRvclrPInfEG/frMx3mJCEqaeIabX:jOW/Evc/Lfao1clrAsGO/nIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623999390, "uuid": "12cc4aa8-53a5-4bf6-af76-48f4ec28fd9a", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623999390, "uuid": "2ae0044f-9f23-4d30-8b0f-754553f0ef28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999390, "uuid": "ef587cae-8fc7-46c6-b033-8466f53767bd", "value": "7e4578c724a5d597eb2e044dc7ffbf64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb2798c-d001-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623998879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998879, "uuid": "fd1952d8-4046-45e4-98fe-fb28f371150a", "comment": "Malware payload (Formbook)", "value": "6d7441568080cf1380f3fda5e53308a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998879, "uuid": "2798991b-8b34-4741-8f1c-2eb922341b45", "comment": "Malware payload (Formbook)", "value": "1e6e22400682ee9a9ec02f1742f84efd44978cb6c2d4ef685d04f650f180cfb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998879, "uuid": "dbae3a01-c257-49df-ae22-baf9874141ba", "comment": "Malware payload (Formbook)", "value": "b2dbea5c5ac64f8d317d2a982df4965e8018d148", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998879, "uuid": "cf92f5ed-efef-4509-a4b0-fa06ab4eb411", "comment": "Malware payload (Formbook)", "value": "468b4ffb1b8cf42a15092ec643e10c6d6bb1b080b0be6c3f6a091048c78e6eb7c539f899a171f715f13224b682db2609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998879, "uuid": "60f50f02-27f9-43f5-9f25-e9027b9e347d", "value": "F234121751F3DCDFC54362B11BB9A763C360FE20002E199F3B954FB9B9A20EA591A14B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998879, "uuid": "590483fa-c609-478c-9181-08ebc75422b4", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998879, "uuid": "919a98b9-2c9b-4bb7-8750-49cff64a5872", "value": "6144:3BlL/3VDGZyKIX6SEL2tk2pzddpApRU1appyBX7pfX:xNVDGg6qj2/ppyRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998879, "uuid": "8a2a182c-2767-4caf-81f9-cbde78a601e2", "value": 247014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998879, "uuid": "5634fbe3-6ccb-48d2-8c2e-9d2150934ed9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998879, "uuid": "bffc19c9-bc39-4f1f-b50a-35ebd82d8a86", "value": "SecuriteInfo.com.Trojan.Loader.839.23961.27176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61118c7-d010-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624005575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005575, "uuid": "11ee8b11-a111-419f-a9eb-290ff0b8f821", "comment": "Malware payload (NanoCore)", "value": "2e92846797bb61e80e05c4550a8bf3cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005575, "uuid": "d4becfcd-81f2-4c47-8861-ed472e73b5a9", "comment": "Malware payload (NanoCore)", "value": "20173033c6ceab87e28448c1b296f28694c9213e6dc9d510cff9d4e1962fed9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005575, "uuid": "47f1b4cd-8877-4aaf-8272-013193b2a71d", "comment": "Malware payload (NanoCore)", "value": "f840f341c0fae93f7abbac5d72bd402053077786", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005575, "uuid": "5db83114-1ed7-4463-8de8-03e7d19da69c", "comment": "Malware payload (NanoCore)", "value": "e1fafe3f406852dd51394c711e753360a06588085c3ebf81fa0638f8bfff2d3222e7d2259f4f9da1f6537b6236249f6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005575, "uuid": "ff84e3d9-3d9d-4bc3-a351-7ff30776bbff", "value": "CEB4120233A84B23D47F13FA949205A09771E6675262F39E9FC5B1DE5C1BB818B23B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005575, "uuid": "2ab710bf-5a67-4796-a50f-fe9efd9e23c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005575, "uuid": "14102f38-c6ba-4e4b-b484-590f6ff54053", "value": "12288:HhcWUDwJo5D/xWFlvEPFYCtTwIWFb+yr3/eOgzOI4Pb:HhcWUDwq18lvEdnt0NFbhL/eOE4Pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624005575, "uuid": "600186dd-bc36-4baf-9f0d-87cc72c58230", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624005575, "uuid": "6836c8a4-9440-4ae1-a45c-a982a93d1083", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005575, "uuid": "14471200-abb6-486c-befc-832b797f90ae", "value": "INV 00286.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b0b572-d01b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624010413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010413, "uuid": "bcc6d1c5-7bdf-4d5d-826a-82b35b2f0b2c", "comment": "Malware payload (Mirai)", "value": "f89a7c6725e831b1014c9d9eb1499b70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010413, "uuid": "27539833-eb60-4b39-aaae-1ba6f74acc24", "comment": "Malware payload (Mirai)", "value": "204bf6ace1d549ef096c6afaf39efc76ca62b545449f4f0060a31c3d8e79b8a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010413, "uuid": "2fa50e66-bc57-4a8a-9d1a-3ebe2b84fdc7", "comment": "Malware payload (Mirai)", "value": "41563d64a17d4d1e5efdb5b6c202dce98ffa0ca0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010413, "uuid": "1da107f9-2d9a-4c6b-ad27-40dd24f776c4", "comment": "Malware payload (Mirai)", "value": "8793dcf3dba695672292cf79901a4238400284a67373f5bf199ceebc2b840029111817b450be01dba41df9532e24c24c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010413, "uuid": "71c61f54-94cb-4ca2-93a9-7f297da25ee7", "value": "ADD2E1464EB98B4CC427057364EEE42718C0C4AEDCBC447FDF86B5B6485AF6B2B9C641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010413, "uuid": "7b35aa8d-931d-4bb8-ad27-9a01de937040", "value": "768:KrDWIsQaRhpF282dGxiawztapiK0gkubcciP3bnbcuyD7UHQRjW:K/sQaRhHqssawZa8WkuIDP3bnouy8HyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624010413, "uuid": "d4422650-7f11-409f-91c2-6fad2f0a3a14", "value": 30896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624010413, "uuid": "43c22b2b-0756-4e3a-bec9-10ada7a0b9ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010413, "uuid": "2b89d678-7097-4490-b25d-1f21972a7e00", "value": "f89a7c6725e831b1014c9d9eb1499b70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d3700f-d026-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624015103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015103, "uuid": "b4bfb46d-5c82-43a2-83b5-ca629c0f864a", "comment": "Malware payload (Mirai)", "value": "73f1b3d7c5ff218147f8faecc3fb51e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015103, "uuid": "42381d39-c75f-41be-b3b7-76bfccf71f0e", "comment": "Malware payload (Mirai)", "value": "208ae3086c769098f1a55ac6d88fb760571010c16f4a0e25c98ee0d33d4bdbbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015103, "uuid": "8523f66b-03d3-4e90-8765-a3a2a81539da", "comment": "Malware payload (Mirai)", "value": "9739558ad3ada188cae99f03461ac3e16903421a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015103, "uuid": "70fc20fe-979e-46e0-b5d0-c0d6068ef1b7", "comment": "Malware payload (Mirai)", "value": "9114e3712ab2e54f5ae276e2656d24662ed5ece0692edd200ebdfaf9bd6b43c6742f25813151596e1cf76ad4e1f8b64a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015103, "uuid": "e56b64ca-7188-4a74-9b25-51d62bb6e5a9", "value": "EE73A61E7E258FEDF799823447B78E216A5823C637E1D2C5D29CD6012E6024E241FFE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015103, "uuid": "177f5438-613f-432f-9a6b-ecf9581efd69", "value": "1536:KztcPRFA6olzsswoBOQkP9lrU8uz99GMbobAQwbFa10r:KC8nwoBOQgmz99G8QU8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624015103, "uuid": "418c626f-5088-4394-b7e9-cd83200ddcaf", "value": 73596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624015103, "uuid": "f0f5d789-0ea5-4f29-8436-a67d0714f01f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015103, "uuid": "c6828e6e-7fb3-4c24-89f8-98686c55bdfc", "value": "73f1b3d7c5ff218147f8faecc3fb51e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e3b97e-cfeb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623989501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623989501, "uuid": "7d571ff4-d1a9-4959-af00-beec42db55e4", "comment": "Malware payload", "value": "287de7cc1dd70e02f2c835d12ff667a8", "object_relation": "md5", "Tag": [ { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623989501, "uuid": "690d8d5e-3a40-46b3-bfae-48708e2a4b3e", "comment": "Malware payload", "value": "211cee55e693cb33ef2875b30e9eb98cc3f4bf3666a1c1e3e6e8bffceafa264f", "object_relation": "sha256", "Tag": [ { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623989501, "uuid": "3d442f21-2ebc-4665-8e2c-cb8043022f39", "comment": "Malware payload", "value": "6862b2386381bd030e127f12246bd6c045d2c61f", "object_relation": "sha1", "Tag": [ { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623989501, "uuid": "b1831078-7ab4-424a-9172-1c0f94c9f457", "comment": "Malware payload", "value": "f698c7ec7e85093d33bc85356092e499188e79fb10c52ecbee58e1536d9aef2fa5a7f40df5eadfa3e837037d2f7de3aa", "object_relation": "sha3-384", "Tag": [ { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623989501, "uuid": "61c082cf-5671-4992-9802-f9503cd89475", "value": "5FC53303F3D792BD4F146E25574B0FB85A44EAF90701742E254ECBD0EB29ACA5A3B50B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623989501, "uuid": "ed280a0c-f59d-4c41-81cd-6dfb714194d6", "value": "49152:1wbaYTIbWvYT7mk/KmQ8H0IJCF6yTZS/sM6B0tTmJjmQK5Uwm9:KbJGWv2yiKmQ8HjZyTM/YUmJynQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623989501, "uuid": "c844fee2-3bf9-4979-a1c4-21a0c353e87e", "value": 2722340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623989501, "uuid": "0dcc6265-ac65-4401-baa6-0359580ea507", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623989501, "uuid": "ea2a80ee-2125-4c85-8e2f-da0e8dfe3bda", "value": "Debito u79u40wnp fas6pyfgdk .zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f580fdea-d01d-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011265, "uuid": "9614f0cf-3fee-4fe1-9676-0143a225b65b", "comment": "Malware payload (Mirai)", "value": "e1f7ae1aebfc434fc4c098a0e8fb1690", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011265, "uuid": "58fce6b6-1dbc-432f-bb28-12a17e2961ee", "comment": "Malware payload (Mirai)", "value": "21906cad68c70047f1caf3a2e40c38d8da30b80f670b24f7c830288d6972a2ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011265, "uuid": "7913c293-b8dc-4a05-b1f2-c7f0ca071339", "comment": "Malware payload (Mirai)", "value": "220e99a3d7292440a35662c939006e93934502df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011265, "uuid": "dfcec65d-f8e1-42c6-908d-bf2135918e5d", "comment": "Malware payload (Mirai)", "value": "507a447e73cf5515fbf693424a6cd6588f2dbe38bc4ec4c49c2cd9d5513dd66a9f0ce76beb5e247e12a06de66d066943", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011265, "uuid": "24ca3500-6d35-4fef-bbae-9ed7bddd9f93", "value": "48E2E1920F02A131DD118CB3B46D5CB234995BF870DFB163129DBB986B83501DABCA83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011265, "uuid": "21cc6fef-663c-4fd6-b29a-b27f9bd070fb", "value": "768:wH65ZalVWo4WXV0Cr3MpmFJmY7FOJqkTEc9q3UELQb:ySQL465r4/MFKqEElLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011265, "uuid": "5f6344d3-b97a-4709-a85f-8884b766ea7a", "value": 33048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011265, "uuid": "f9d39664-dbd6-470b-9c8a-f0419570cd7f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011265, "uuid": "d3b23e6c-938f-45c9-ab19-ff36a1ac48e2", "value": "e1f7ae1aebfc434fc4c098a0e8fb1690", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29dc2b2c-d033-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1624020372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624020372, "uuid": "70fc9769-2f25-4190-abec-ddf18bde08d3", "comment": "Malware payload (Stop)", "value": "434bb3d29a8126fe4e268f48ba27d89d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624020372, "uuid": "095b42f5-bc97-44d6-84b1-aa3e82b5c713", "comment": "Malware payload (Stop)", "value": "234dacbb2d988ef8453d0627ddec732407ccaa151de54abfc9d71a7a0f88bd0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624020372, "uuid": "7c4bbbc3-eef4-4229-a119-32ca651f791e", "comment": "Malware payload (Stop)", "value": "42721befa1a4cda438b4b9be4ed629723968d81f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624020372, "uuid": "3e42b8e1-6cf7-496f-b93a-7732e0dc0ce1", "comment": "Malware payload (Stop)", "value": "669a07d6ff544580bd9599c07b3e94fe2db3eba236cab9f6f704507a033513c8a1835e49fad8f338bd0a37129fbf5260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624020372, "uuid": "2d707390-94ee-493a-9e3e-fac932b69f1b", "value": "70050210BA90C035F1F756F826A6932DA92D3AB16B2455CF53D95EEE27386E0BC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624020372, "uuid": "b3a2b78c-a5a4-4976-8002-32b46ba2b76e", "value": "7b1dc6cbb65eee334207b62238bf5f24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624020372, "uuid": "dbd8d19e-c223-44ab-b214-ca9af45bc818", "value": "24576:R7r5kYXZ0vQrO2ibyAM/7BhfKErMOJA+z9C5Hjf:90vQKvdMjbfTry+z9C5HT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624020372, "uuid": "c47361d8-881c-432e-b3f2-8bbae764aaa6", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624020372, "uuid": "174939fc-0c0a-47ae-8d0e-4e76e2a95c98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624020372, "uuid": "3d239667-1919-4368-9fac-cd3e0688444e", "value": "434bb3d29a8126fe4e268f48ba27d89d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d99c44-d079-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624050430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050430, "uuid": "6e2703f5-9409-4b60-acf5-2a088c598159", "comment": "Malware payload", "value": "cde14562cc1f02c7e2fd6d1c81239b8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050430, "uuid": "9c2e0026-1746-40e4-97df-10677ec07960", "comment": "Malware payload", "value": "241a98fb4d67d6416b143a293a600f14ae8ae51758f7e6a6e55021947c477895", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050430, "uuid": "ee200877-74cc-4811-a5a5-d08c184a9cc8", "comment": "Malware payload", "value": "3f6110ad70f90ce553bd685c7c40d5f229e3df7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050430, "uuid": "f05dc749-28d8-4cfa-ae3e-a0eead02c81a", "comment": "Malware payload", "value": "093aa82ec2b56be017a0d79cd2afb2cc81b2e57c5b7ee003a77f67b3756a8b5d69345523acc767e11bc6e7795315fb01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050430, "uuid": "25628259-8a0b-482b-99f0-d00f41de87c4", "value": "5E257BDD361072EEC867D4729EA81C68EA507C7B931F5103942335AEAA7D897CF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050430, "uuid": "928ffaab-0b0f-4bfc-807b-d188228e1187", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050430, "uuid": "952b20ff-7f2a-402c-bfd6-f0f11b07f476", "value": "12288:H6+kKbzjui4S5nFrsVHKvAUxEX4xKf9HGzJQ0HUPszG/hZpG8e6aCImwzcr7DgtY:H6+1b4S5FeHKvxx/YlHGb+szuZpVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624050430, "uuid": "8ae5ce2c-ac8e-441d-866a-00a112ea4c15", "value": 990208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624050430, "uuid": "5e67bf9b-7234-45e0-be45-d4efe8db9b64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050430, "uuid": "a18b66bb-a36a-45fa-a30c-ffa610884ca8", "value": "Payment_Swift00987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "209fa440-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623976978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976978, "uuid": "9a9aefd4-1a1e-40b5-a677-a21d93a76508", "comment": "Malware payload (DCRat)", "value": "39c223883dcf85554a862ca5f78c1ac9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976978, "uuid": "85aa5b57-6ae2-456d-9d02-82466f5b82d0", "comment": "Malware payload (DCRat)", "value": "248dcb3b32178fb69c8d902a151931b5eb5362931ea5964d7f8c3385d0440643", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976978, "uuid": "fa29659d-e53c-4754-958d-c774489449b8", "comment": "Malware payload (DCRat)", "value": "9d7b5e6a7dc943e063dfa55aedaac89640b1e75a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976978, "uuid": "68981c69-1a22-4a78-a856-52cec8455588", "comment": "Malware payload (DCRat)", "value": "967953d0206587ef7d56422e6fd2aefc7f2099fed378eb0b4564dd6a408e0313c9ba7314b3a45d858fb6f48c9b5378ef", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976978, "uuid": "300a67f7-381d-4820-93c0-9cfff906ba09", "value": "4055335AE2150A91C3AE14FC9BE6AF004FA52FB8E56413E607FC767A7C1325D0A6C371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976978, "uuid": "31c03687-d246-49d5-acee-ae09aa07af75", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976978, "uuid": "d331e2bf-ad92-4bec-bb1e-9fb6540a0c18", "value": "24576:ZOaWGqvRsP9sqtmBQze8XO0NzDluDoANTR39Gr5kNJrMed7vCFcgeu:Q6UByecPQoMzGrSbj7v/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976978, "uuid": "1a3fc8e3-0cd9-43d0-8f70-b4b7232c6c32", "value": 1366016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976978, "uuid": "df4bcdf4-faf9-484b-872c-4dca4f3cdc7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976978, "uuid": "e34f1fb3-cf7e-48f0-aeb2-70310422ce86", "value": "39C223883DCF85554A862CA5F78C1AC9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddb6144-cfe8-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623988301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623988301, "uuid": "1b376eb3-5b84-4ab6-b8b8-a090522c253d", "comment": "Malware payload (Loki)", "value": "1c0e292ec820818b93a4ac0dc01cd649", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623988301, "uuid": "ab820fbc-6764-40e8-b5f3-1d8b69ec298c", "comment": "Malware payload (Loki)", "value": "24a14c2f62d03e35d29e3d0ccc262ee68f88534266f0a252938e5bc544ff9bfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623988301, "uuid": "884f1bcf-6345-43fb-b51d-650253c732b8", "comment": "Malware payload (Loki)", "value": "79793f401a964186115b40e66a0d4a71438118fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623988301, "uuid": "fefbca54-b98a-418b-b6cd-c25efa7dbb6d", "comment": "Malware payload (Loki)", "value": "5699495a85da457b0a2741c36672916ce3f329d72cf8d4246f1d43fa748387126954f13f7166759d3a685a5c1e06ff32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623988301, "uuid": "10a7a00a-effd-492c-8f8d-7719369f3f9b", "value": "0084E1102517F42AE8BDD2762853F14133523F1958735ABAA30B7E3D45B6288AAFFC71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623988301, "uuid": "0470fb54-f933-4960-b812-a68f3c7e1ff5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623988301, "uuid": "ac6547fc-3432-493e-8f93-104bdb30ed77", "value": "12288:7P48ojQY92jRxtqFQZEKnnBZOnMtrWeN2:zojMjRxtqS6KBYMtr1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623988301, "uuid": "e167f593-e6c9-4cb0-b8d7-b8562f9e3e59", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623988301, "uuid": "f4a99cde-a437-4e9e-93d1-6dfda93be40e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623988301, "uuid": "f0a023d5-db85-430a-ae61-13a1f410ef1e", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8a313f-d04a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624030582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624030582, "uuid": "9517bea7-37db-44c0-8bc7-bd6a3f72bd39", "comment": "Malware payload (Loki)", "value": "4932b6d10f8dfa6d3d439e44150549b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624030582, "uuid": "f130dc66-4f60-4e70-a1b1-f20a4cc92b3d", "comment": "Malware payload (Loki)", "value": "254de372db20f35fb440552d22068d975bfb6fafd7902d2826318033b01428a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624030582, "uuid": "62a2882c-3387-4266-8c96-c110bd4eafd3", "comment": "Malware payload (Loki)", "value": "a67ea276899c05f5ed79f85d73519bd0de9c0cb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624030582, "uuid": "7fa8b414-3989-4a6c-81fb-dd4ca0a41464", "comment": "Malware payload (Loki)", "value": "ea4293e04dda73b0dd735389d1f2bbc258e782e5e22d3f73f09d180f5da66811771bad03bef255f81847697c16d9d000", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624030582, "uuid": "9a8d2fca-0066-4692-aae1-94e689205b0a", "value": "3C84F100220BF419E4AAD6777483B0423352BF255CB3AE9AE207363C55B67599AFFD31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624030582, "uuid": "c6ca59bd-5e68-4416-998f-6a49067248bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624030582, "uuid": "c7e6f7e2-5c59-435a-94da-a74321fd4856", "value": "6144:zbQURLW85Rm4OT/ih5seo9cjLj7RXLd3Pdv:zM9859c9cj/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624030582, "uuid": "9d153417-9a0a-4cbc-92a8-d85a22057975", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624030582, "uuid": "9dd62c52-1e5f-414a-8458-3910ea510b3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624030582, "uuid": "985337b9-c97d-4495-bcfa-d6cbf6110434", "value": "HSBCpayment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be755bfa-d087-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624056699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624056699, "uuid": "c09d522e-401a-4bba-a475-e3dfd77d0997", "comment": "Malware payload (AsyncRAT)", "value": "8ce661a03419f333640bc5f74f1673b8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624056699, "uuid": "074f224a-7768-41e0-9dda-fadf2b2b09b7", "comment": "Malware payload (AsyncRAT)", "value": "26ab3342c41fb51bafa05e2dd9f74db1803b217e23e8e9e135cccfa805485af8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624056699, "uuid": "eb9e40c6-fcf7-4201-97f2-dcb4530e5dae", "comment": "Malware payload (AsyncRAT)", "value": "c61c419d0050109d736c4b945c5368bad8c5c1ef", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624056699, "uuid": "e9970110-2176-4287-bc4d-e0b477dc351c", "comment": "Malware payload (AsyncRAT)", "value": "4201af9424f9c8217e1c516364a76decb4dcccdce553e6499e861562a050bbd0ac769ab693d8600367bb255e53a22a72", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624056699, "uuid": "7af215a8-2a14-46bd-830a-875eb67b069a", "value": "69A4234DAAE0C164FFFF0CF3EA87EB4062A671A21614CAC90E9C83D534177D8C55AA5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624056699, "uuid": "b5787e21-55c0-4040-8078-195b1829bad4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624056699, "uuid": "24ff69c7-adab-4c65-9ab2-3fb95a9f73dc", "value": "12288:hUM51mKpXh5doBALnb4WmE/vUhu7qz13T3YuiV5:3pXhb3QIvUhu7q1D3YVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624056699, "uuid": "a28aed96-002c-4f78-8ee2-59d8ce9dea84", "value": 486400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624056699, "uuid": "d7c4ccd4-2f2c-47b1-a38e-8ba19699483a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624056699, "uuid": "16f7dd24-86ae-484b-8616-56ddeb9acdbb", "value": "8ce661a03419f333640bc5f74f1673b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d47a40-d009-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624002318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002318, "uuid": "6df96665-7802-47f3-a72f-7e35fb60ad5e", "comment": "Malware payload (RedLineStealer)", "value": "06ac95deaa340711db9f10e66642fdb4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002318, "uuid": "9146915f-5942-469c-b750-be36efec0cdd", "comment": "Malware payload (RedLineStealer)", "value": "26fbc6a8864ad5ff42b549a9a7b3dbc4cf6b20d57b4942e010ad637530953ab7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002318, "uuid": "18194056-0170-4984-a2c3-bcaea209f77c", "comment": "Malware payload (RedLineStealer)", "value": "5adc62c5e947d400f552d6671ed5e88dae19637f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002318, "uuid": "f9ab9e5d-1610-4add-b2d9-a89de4cda4aa", "comment": "Malware payload (RedLineStealer)", "value": "8cd0104f0bb7766b438d2035ab4f7ee5571ec6a6af8142297f312cfddcc160a7d036d71cae005a3943562e3b532d8cd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002318, "uuid": "e3b32f56-ff0e-4a25-a04a-c794a5620933", "value": "BD84BF10F690C035F4F662F85ABA93B8A52D7AB1972491CF62D51BEE47346E0EC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002318, "uuid": "bb4230de-04d6-4071-a4d4-f3ad290e9029", "value": "0e61e5ee811a73c290e64659dd192375", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002318, "uuid": "e071c2d8-53a4-46a2-98fc-988489ccbc8a", "value": "6144:5WNFDH3wvbpb8DM4jgJptYLenYK7AAShi/o7XGWeuAghtZZE6:SFb3wvbpb8DMhQenYKL0/WWe3Eh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624002318, "uuid": "5b3c430e-5b3d-4865-9e86-a109a404c87f", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624002318, "uuid": "be82af5a-4c83-4c7c-9945-a05efe4c1d17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002318, "uuid": "38a61d16-a250-4688-a108-1f26b01c317e", "value": "06ac95deaa340711db9f10e66642fdb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495a0fee-d008-11eb-875b-42010a9c0053", "comment": "Malware payload (Neshta)", "timestamp": 1624001957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001957, "uuid": "6450cf85-4a1d-40fa-b5b7-64ad2d5384bb", "comment": "Malware payload (Neshta)", "value": "120dd0fcdbecf5b37b0f6578fc541323", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001957, "uuid": "49228fda-8936-42fc-94e8-36d4e07b83c2", "comment": "Malware payload (Neshta)", "value": "27c7af83c87c02b4dc9c0a8d35d42d48f941ff72b2d9ac59971e0127142d084c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001957, "uuid": "824a7ba7-9ac7-4722-b13d-4e743334b5e3", "comment": "Malware payload (Neshta)", "value": "a6dae23b1dd5b8c02f17a8a87312325e429740ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001957, "uuid": "9bc7ac2e-7f99-476b-a95f-011c4b0df856", "comment": "Malware payload (Neshta)", "value": "c11c983f23dee9edd30c9b81f283062b67af3d1fb851ea8257ab0a61bf0b9ece681c98eaa4ad72115e53285a0452d6a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001957, "uuid": "8c423204-94a4-4752-9649-a495dc9407f9", "value": "024602ABB1E4717EE05F2631C57A839058B76A556C2E4E1A17E0DB0DCF3E0600E3F6A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001957, "uuid": "cff2d632-530c-4148-a082-de75abf36ca5", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001957, "uuid": "f31300d0-2c55-4339-af37-b30dc8beb3a3", "value": "98304:VSi2ojtxkoKCd+EAxgi5l+1fTgcKxkqjMZd9:3taoKi+R1rGE9jMZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624001957, "uuid": "781d6af7-189d-40ae-920a-1e884fb4477e", "value": 5377991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624001957, "uuid": "59d2cd4b-3cab-4c9c-8ad8-a2bd14f4ae98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001957, "uuid": "c08d21a0-ef17-42ed-af2c-2d3fffcf8c13", "value": "120dd0fcdbecf5b37b0f6578fc541323", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7b6aed-d00f-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624005262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005262, "uuid": "5594b4a6-f41e-4158-819b-303e6b955d96", "comment": "Malware payload (CobaltStrike)", "value": "f969f7029dcba2649ff53c2ec4a21289", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005262, "uuid": "ed58c07f-aa92-4435-abfd-5ecf76aed234", "comment": "Malware payload (CobaltStrike)", "value": "293b8738ec85a19d31ba1abf99c9922ab2868986cf1042fe0a1f623a9f8dcd07", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005262, "uuid": "b3a98498-632c-4cb5-b601-9bfe7a5dd69b", "comment": "Malware payload (CobaltStrike)", "value": "b00909ac8f0a0fed0ab9fc956cdcc064f7499419", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005262, "uuid": "a2699131-a854-443a-b159-3ed06ab06c1d", "comment": "Malware payload (CobaltStrike)", "value": "b5958e33fbc95bca2dc5480599617fc91883fd5140a87c7f36a8483c07c52e8c8b6b9bf662700de73f69373a2066a290", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005262, "uuid": "3ec36c7b-30df-4b01-b5a2-cdc13e157a6e", "value": "FA64279DFFDA5F27D9A3063E102A8032827ECE560BA8FD175164BD4ACAF03F65761085", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005262, "uuid": "80dde3bd-2b6f-43dd-8751-a3a57938c033", "value": "57c147a9bbc95fb84767ff1e061348f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005262, "uuid": "a4aff963-36fb-4611-ae0b-b7734637121b", "value": "6144:y4xlEgF0yrbegH9ZQIK3q6gK5WDxFHektdXXXXXXXXXXXXXXXXXXXXXXXXXXXXXR:T0Ubem9Ct6854tVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624005262, "uuid": "0c75e3c4-61dc-4b47-9650-c7b307fa03e2", "value": 322216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624005262, "uuid": "25fe5bc1-ab23-4360-b8bd-578e6ac1202c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005262, "uuid": "625cbab6-31da-4861-b827-5d179ff84d93", "value": "cobal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f185ea1-d000-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1623998611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998611, "uuid": "69c12315-2075-4b56-ad3c-5e4ba66e18b4", "comment": "Malware payload (ArkeiStealer)", "value": "ed9e6eabac86b5d1ecf8e0c79ec67303", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998611, "uuid": "8e82da0c-f011-4e2c-b60b-3bb76f656c48", "comment": "Malware payload (ArkeiStealer)", "value": "29ea1afb7eff9de6e637ef41710bf77b0d6292c688a5478edd230d08f29d7502", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998611, "uuid": "cdbfa006-de10-4a7b-bc7e-280e0724a071", "comment": "Malware payload (ArkeiStealer)", "value": "0e13f202b3a086d206ef9155cb2867a87ac5a272", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998611, "uuid": "79ea5acd-7054-40b5-a4f5-c21d18f9e4c1", "comment": "Malware payload (ArkeiStealer)", "value": "6b6a194a89d3a9396acfca8bbb65b96afd030fb31e6fdf8860173034f7bea70db9188b7c57001b4ddd72682d6d29439c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998611, "uuid": "1c66d962-c6cc-4e79-b734-a6756167b080", "value": "AC74AE10B750C035F4B612F85EB6A3BDA52D7AF06B6491CB62D52AEA47346F0EC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998611, "uuid": "2f570f5d-5b36-4c54-8f8b-5b7c95bc79bf", "value": "789f9b51a4c10931fc3f61b83eea1b25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998611, "uuid": "376de6d9-2e88-45d0-8f5c-a42e93d33499", "value": "6144:Npe9T2IQPUMjQLcMpHoEXPPq4SrK7h34vjIz9GItfr:C9KISUMjQL8YPNSrKt3EjWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998611, "uuid": "95a3c956-bda9-4f7e-b5b1-c056c9ae000e", "value": 369152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998611, "uuid": "0bf11b3d-1404-48f2-b9c4-3849a7216ddb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998611, "uuid": "ca064d22-9702-4f5e-a114-380bc286bcb6", "value": "ed9e6eabac86b5d1ecf8e0c79ec67303.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f4c034-cff0-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623991887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623991887, "uuid": "7a8512ae-0d8a-4fda-b7cf-1f2dacf4fca7", "comment": "Malware payload (DCRat)", "value": "a9b5abb5a2dfd946abc6750fa01b43aa", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623991887, "uuid": "6ace014a-ab38-4096-bf35-888f229a46a9", "comment": "Malware payload (DCRat)", "value": "2b0f19f9a31b765f808b37e98156dda980bfdd1185bbeae0474bba8d961ad873", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623991887, "uuid": "371bb353-56d3-44e4-837b-7a1744ded5fa", "comment": "Malware payload (DCRat)", "value": "152ea76f0e81e5e6be8f6bfe547cef99611499dd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623991887, "uuid": "ded0820c-3020-4d30-9d2d-8f6ba5bafdc5", "comment": "Malware payload (DCRat)", "value": "8cbde4214fc2161ae18e39094cf9513a580f53a48099a2b43f04b1bf9270d374df9090abddca8a964f149c931b90f1d5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623991887, "uuid": "ac6cdb63-4e6e-4ead-85ce-7c5bb6102c5f", "value": "34454A243AD9D424F07BDF39D5E025F18A3DBE22E746998F05913F893633A81DD8067A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623991887, "uuid": "9227f6f3-ff61-4654-9875-fac2f63cd2bc", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623991887, "uuid": "beda82f4-dc39-408f-851c-6203ef6a4bb3", "value": "24576:+2G/nvxW3WLtxhQ8eLniQtSu+pRZVIbVr9Ud4:+bA3UQ+ppRDkUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623991887, "uuid": "395d853b-fb92-466c-9b28-d1d7d225a7f5", "value": 1270358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623991887, "uuid": "6ea0053d-d72c-471d-8a05-53db6e48d592", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623991887, "uuid": "e9acb384-2c02-4cee-bb9b-749091a9effe", "value": "a9b5abb5a2dfd946abc6750fa01b43aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283df685-d026-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624014786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014786, "uuid": "87e93fc4-8119-4d26-83f9-a39174158d58", "comment": "Malware payload (Mirai)", "value": "8e28ef93cfbd492ba9de4ac3a9413288", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014786, "uuid": "221fbaa8-5039-4456-8245-8b09d0415f98", "comment": "Malware payload (Mirai)", "value": "2bdd553ad6485d11844c6cb68ae63f083c7f2ee6029f128a1521427e9a29aad5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014786, "uuid": "519ea152-e9f6-4372-954e-66c410fdcde0", "comment": "Malware payload (Mirai)", "value": "2c85239cbf47f7269ab3e99b35d4d2ce1a351306", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014786, "uuid": "78d48ae9-ca9e-4fd0-b0f9-07942e5eb78e", "comment": "Malware payload (Mirai)", "value": "8a066196cc30869e26c2ebf60811ef6a87241c50c17c563ab093409345fd8b5ec19b3994a2f95ba94fea6bb95793611d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014786, "uuid": "5c3097b9-d153-443a-963c-4580e4b9bb74", "value": "0C43299BF8019E3DF40BA6BA94264D0DBE3063C112830B3667B7FDE36D721695D16D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014786, "uuid": "6a5d6f23-531b-4bf4-a73d-4468eecd71ad", "value": "1536:JhYluKdGTfwsTV8KcOwU6zez+m8SaWJtaA2JGI9HLI:JUOwU6zeKVWxAh9rI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624014786, "uuid": "dd495397-0aeb-4878-bb10-2e879366f873", "value": 56484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624014786, "uuid": "918ed9d7-c18f-43fd-af13-fc5e0e16c12a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014786, "uuid": "4ca7f9d4-f82d-4b41-8510-46d811f70a49", "value": "8e28ef93cfbd492ba9de4ac3a9413288", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277f1974-d000-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623998464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998464, "uuid": "d1a9f905-46d2-4d4a-8320-ac486e507050", "comment": "Malware payload", "value": "50a51a9c7446d40962fe0146510319ea", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998464, "uuid": "c72afd24-1baf-4788-9eed-f0007cf33b58", "comment": "Malware payload", "value": "2d47684857bed6c8476cbf88f04ec33a65ca45ce3d3ff750e1457e3c792f9da3", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998464, "uuid": "36725408-0b45-4fdf-b3ae-14fc76349f4b", "comment": "Malware payload", "value": "178b6536161e0ad3577710a51694e7784077e2c0", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998464, "uuid": "82ce42c9-5c1c-4734-85b8-10fb60b7a3d5", "comment": "Malware payload", "value": "7193af23fa02633f21483c1e32266302c0fbf4f35da7f5fa1077a965e1dc0e1b3f228ee891d56f782f8343577bd293a8", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998464, "uuid": "ed2c7632-f5e9-4779-8edc-3b2577d9f3d0", "value": "8A24E048105D524FA9E2DF726BD9D2AD8DEFD330D352F2CB6940CB4E7C8429A172E162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998464, "uuid": "8a88f82c-b8b1-4cc6-9ebc-8ee8c6bd267d", "value": "6144:rD5xnfYQiRY8anf6mz9fYMahEZeYR63L+hJZS3Dj:xxnQRYp1zCsEV3L+RS3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998464, "uuid": "012dfb4b-0e4b-495a-9a6c-ca61d688e411", "value": 210008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998464, "uuid": "9d360aeb-3b21-4474-b9b2-23dc7462e2cf", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998464, "uuid": "9a0306a2-e97d-4b68-8763-ebb5a8d03382", "value": "4fdeb1cb-7451-4717-8250-fd60ad8aeaac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de2b989c-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623976866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976866, "uuid": "c026ced4-8f5c-4e75-867f-a44d4a9f0ec7", "comment": "Malware payload (Loki)", "value": "df12b462dd4b39e28c6101c4ae3a0c9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976866, "uuid": "69e3ba21-f684-4cd4-b1fe-f972331f1f67", "comment": "Malware payload (Loki)", "value": "2d8f2418755792d092562805716017f3a4a4da1b83b5d20f3194a63a40e1ca72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976866, "uuid": "f3e89b45-a05c-4a8c-b2f6-d39a6aed662d", "comment": "Malware payload (Loki)", "value": "e3a7f066ccdcb142c67e5f8370ace3b5c4db7672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976866, "uuid": "843b34b6-302b-491d-b94e-a6bdfcc13ace", "comment": "Malware payload (Loki)", "value": "5a560acdbd533c9121aeebe3f4063d2a6975319e0ec4df49ab17e432970dd35c458c471b18dce01832b460af72c0ceac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976866, "uuid": "ac684804-c37b-460d-beb0-e2eedfa37f1b", "value": "5145089D325075DFC85BCD32CEA81C64EA60B87A830BD607A05716ACDE4DA9BCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976866, "uuid": "3f6cd303-0a9c-4fa6-9c8a-ce65d2542acc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976866, "uuid": "ecacffb5-6c69-458f-b58a-eb1367b17dd2", "value": "12288:TZ/SH+yoJTh/mYqRUf4NwXED9UvSa2sYPqZMFsyo+6vavmJ8QMka0B+mhp4znjMr:wH+yANlGUf4NLD95agqZD+lbQMTmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976866, "uuid": "150e3674-c37a-481b-8fbc-83201915bceb", "value": 1266688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976866, "uuid": "e4d854e5-c629-41b1-9bc4-da113c9dc346", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976866, "uuid": "ab870b11-12f6-4131-ae48-757435e60f90", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c002f3-d002-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623999451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999451, "uuid": "9a9d509b-e2b4-48cb-b24a-ec13dc0a5fcb", "comment": "Malware payload (RedLineStealer)", "value": "021400b4b3ac311163b08ac1dd24fbe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999451, "uuid": "86700391-cdfd-4d85-83ba-f8c5db2cc24c", "comment": "Malware payload (RedLineStealer)", "value": "2e8255a7c4778710bb0df2bfc4c5a64af40a7f52c9aa6b4ff0a446e3400dd0dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999451, "uuid": "6b5bf4ba-ed9a-40dc-8e91-d5c00ee88e8e", "comment": "Malware payload (RedLineStealer)", "value": "5972664d985f3d541c403bf148dd2a51e949707b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999451, "uuid": "d0036e30-a088-4c50-a3df-1e3dbef32835", "comment": "Malware payload (RedLineStealer)", "value": "5b909987a8a125062ae7430dc80eb5b64d6301123a2e4d63fe493d6bab229f8c69801c79ca17dc615b50370a2517f99b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999451, "uuid": "0a699da9-1d9c-4b49-9b32-083dfb691dff", "value": "9184AE10F790C035F4F612F85AB993B9A52D7AB09B2491CB62D51BEE57346E0EC3231B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999451, "uuid": "9d489d07-936d-4550-b2e5-65d69cf18c10", "value": "5bc76f4349f7f0afe0c88e229f50d37f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999451, "uuid": "eed4b5ca-3298-4b7c-8db6-b01f57f79c95", "value": "6144:6aLGTIHREGfK/sHN5uLym7JhBaskL6M59YdjeBVOwSHj/tx:7GcHREGi/sA9hB9i5GjRw8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623999451, "uuid": "20f49d52-925b-40f7-a901-fb07765ceef0", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623999451, "uuid": "488053be-437d-454b-9849-554252d25094", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999451, "uuid": "40e9adbf-80af-404b-82b9-899af130e2d1", "value": "021400b4b3ac311163b08ac1dd24fbe6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3656cd28-cfdc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623983027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623983027, "uuid": "fe01165b-bca6-444f-af7f-16246f9adb13", "comment": "Malware payload", "value": "3aba06c9764464d74c535c7fbf93cddb", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623983027, "uuid": "73b88994-c52b-4554-8e68-6ad2d839bbb0", "comment": "Malware payload", "value": "2f382fe438b4aee43a80ddc6c230624e537b7b630b9548a4bfbb03dc8dabad34", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623983027, "uuid": "77cc9a49-77af-47d5-961f-ff41857b1681", "comment": "Malware payload", "value": "809a8e76efbccab964d339750f19b5dbc9e26a0c", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623983027, "uuid": "a33ca54e-1dfc-4d3b-8bf7-9036d3ffdb3a", "comment": "Malware payload", "value": "4a22b1dc23e4af5e9e4859d8e86c56d588c3501d339daa15256d3785fcb69cce5f3264b3b144f46a0eec5af846c4329f", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623983027, "uuid": "d83d3957-1edd-48f2-a050-fbfd4525b3fd", "value": "4D1733C6D4A1F1A2D0A7BE305879FD2A499B7ED1DC6862076D2FBDD3E93A4C60C24017", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623983027, "uuid": "8301a87f-0ef3-42f2-88aa-c813871368ae", "value": "393216:eB/akkzMeWC9+T0Iq2vOh0XVqdyHs0N02xx0H5D38McC+:e5/Cv+TB921F0NVxxWDMi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623983027, "uuid": "c26c98e6-cf3f-4a3e-8181-ca9076203eeb", "value": 19269668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623983027, "uuid": "2e4acd20-30d5-487e-bb96-9bb4c92363ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623983027, "uuid": "f1b22484-b6b0-4512-9cf2-b6eef0f218c0", "value": "Setup2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46873866-d01c-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1624010542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010542, "uuid": "0cbbc04d-f0f1-447e-97d8-52a8d45b8c61", "comment": "Malware payload (Quakbot)", "value": "1019bfebb97de3eb8ec428358587bef1", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010542, "uuid": "a1cb2438-c2a3-4ebd-9890-99a21c7375e0", "comment": "Malware payload (Quakbot)", "value": "2fe2babfcc7ea5ad682d772d74aee8d1cdbd6e1974274669b262d9a6d4c8aaa3", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010542, "uuid": "8befebea-c0c4-4669-90ab-560b7fa51a30", "comment": "Malware payload (Quakbot)", "value": "964a23bbb0ce3021464518510f1e3df3fef20bc9", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010542, "uuid": "121c500f-fa1f-4dcc-9114-bad0cb021fa0", "comment": "Malware payload (Quakbot)", "value": "b68caaa600240e8e9bcfd34bc317470a42cf3adc8aa6cf18b136221b57fb5add731d3e220a068b640b3d266ad2172b5c", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010542, "uuid": "08679fca-35fd-42ed-a43e-d5a2725eacc6", "value": "C2F3128B61A160FCDE1560310A436DF11E1A702BA751FD8F4AE13F8662229E3375DB9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010542, "uuid": "062bd620-f7fb-4723-8f26-89f587c980d2", "value": "3072:aIIh9vajtC1gBbZmxVymd1xXPMU9VlUBWA6CFvA7bRCxAVIKPMI2:ZIQegBbcxVyWxfMU3liWA6FsYP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624010542, "uuid": "2eee45fe-2f4a-4c49-90d5-aab486d0c237", "value": 159542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624010542, "uuid": "2e24fa00-51f0-40a5-af94-b0d1e91014c5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010542, "uuid": "4b95a145-bc60-4f41-ab96-3b1c43524bd3", "value": "aim-1276697785.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019b86c3-cfe2-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623985516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623985516, "uuid": "edbe6754-d905-40f1-8fda-bdf11bf723a5", "comment": "Malware payload (CryptBot)", "value": "fb4bd33f89ac6417468bb1d4729f8b75", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623985516, "uuid": "3dd788c3-318d-4e6f-b374-b5b25881b099", "comment": "Malware payload (CryptBot)", "value": "3019cbb993e1bbf087a7aaeed07ddf5625ba6d15f28b2120af7d661c42cc7625", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623985516, "uuid": "b3491670-ec9a-49fc-bd96-f1ccc7a4e36d", "comment": "Malware payload (CryptBot)", "value": "189f4da3bd2574c74299b001fa865ceb365ece88", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623985516, "uuid": "038d4f72-5560-470e-8554-83f41c52736e", "comment": "Malware payload (CryptBot)", "value": "06ead984f4239743ca4e48bee52d3e68040488345b9cf8bcfcf4117f75fd98afffc2669a3d4d2e9098958b6bc7f59ca2", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623985516, "uuid": "8035e5ef-15d8-44d2-a071-c6b2201651b1", "value": "43F4F110FA90C035E1F712F85AB9A369A5397A70576850CF92E61BE953746F0FC32B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623985516, "uuid": "2aefd34c-acd2-4caa-a6f2-1bcd353bbe26", "value": "5bc76f4349f7f0afe0c88e229f50d37f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623985516, "uuid": "f6a387f4-0939-4b92-bf4e-469e9d387154", "value": "12288:GXXnoXm98IqzPZXrlHM8WDweYXJUnv7yY6UPK8MOh/Pl9lSo5eOVbK2ZJwi:SoXmGPZ7ZZWDwbOnv7y3UiwPw0eOpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623985516, "uuid": "16813047-1c87-4320-8a80-e8ce33e16cdf", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623985516, "uuid": "64b1e977-235e-47c2-a47c-5a7f33ca2001", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623985516, "uuid": "1011ed9d-d20a-4dc3-8a23-75cc0426278d", "value": "fb4bd33f89ac6417468bb1d4729f8b75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81627516-d049-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624029968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029968, "uuid": "103e438f-6658-449d-986f-46403e8bb470", "comment": "Malware payload", "value": "ec971ac8d109844ac78ed4bd1b790e31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029968, "uuid": "c4073a9a-fe24-48f5-97a2-0381f4e58e9f", "comment": "Malware payload", "value": "30c145de49bb723d4453254b90a552f45467926c303005ab7055220a0fa67ea2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029968, "uuid": "14f53dc6-275c-417a-a78c-e233be3cfe73", "comment": "Malware payload", "value": "3de999a9dd23dc1efc37d09a0ac0f2bb2097527d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029968, "uuid": "829b1956-8d52-4be6-a2e2-16d62bb3eed3", "comment": "Malware payload", "value": "778a8f68558a1ecec9142728c336f24801b075c7562f5bfc15b849a277ef48bef07c1337da56b85f841ff22bfc18610c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029968, "uuid": "a8207b7b-57ae-4f95-a697-c9ea5e59ed89", "value": "1FA66C81EAEB44F9EA03457084A7A23F9731750A8335CBCBD7404E67ED17AE20937B95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029968, "uuid": "e0f78ccf-02e0-4ec7-aeb2-9c6f3a73c51a", "value": "1cd364a9e949d5ecebd6c614e64bc545", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029968, "uuid": "02e3e9d8-08c5-4d64-ba08-97032d7e1fdc", "value": "98304:OEo6Wts9iedW4RxUQ93YLWjS8/XxMLvhhZytTVhg5iq6N:OE3WtgV7xMLphwVhGCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624029968, "uuid": "aff38533-f41a-4030-9ddd-56f7580d5c59", "value": 9585664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624029968, "uuid": "fc86255b-3e82-4ad2-a509-02564a7a3d49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029968, "uuid": "e2d5125d-03d6-4d7e-ba9a-c70e6fd144ea", "value": "30c145de49bb723d4453254b90a552f45467926c303005ab7055220a0fa67ea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b1a30e-d026-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624015099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015099, "uuid": "4e9c9329-160a-40ea-a8c2-7427686524af", "comment": "Malware payload (Mirai)", "value": "34486bc23431c3c13faf660b2348370c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015099, "uuid": "14c48604-358d-495c-95b2-5480e968688d", "comment": "Malware payload (Mirai)", "value": "311ac01e395d96f8017ef95dfa9ee8f00aa527e02cfcd207de371e04e5aed023", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015099, "uuid": "ba024d19-5491-4d6d-be3a-c5cca4deae91", "comment": "Malware payload (Mirai)", "value": "769d4e262796c6639626391404038fe3f74194d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015099, "uuid": "a53b3f96-ed35-44d5-bcf8-ff9ad34963d8", "comment": "Malware payload (Mirai)", "value": "2ae3309b2ff428de9bcfdf837485ebc6caf9c213846365e6682c5793d8e11e1017d10be06d8cad77d1b2b3f734ee9529", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015099, "uuid": "cdafb824-6c83-4ad0-b290-4051edc7b8df", "value": "A4337C75F8291E94D15642B4A4248F352F23E2C893933DF356A1C3B28017AADF91EFB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015099, "uuid": "de6a497c-78ff-4c1a-9b55-8df814967adc", "value": "1536:GamyClrLp7wnwiL4da7D1oZ6XbXCr/3a10:GVyHEWoUXbXmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624015099, "uuid": "ee5170c7-874f-418e-8d83-c4b76d858d7c", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624015099, "uuid": "3f0d2a9c-58d9-4164-8880-9e84e7f81b41", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015099, "uuid": "6ab4219e-c779-4a43-9210-fc18bb216e83", "value": "34486bc23431c3c13faf660b2348370c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae30071-cfe2-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623985585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623985585, "uuid": "0beb6a87-3ce0-4b5c-9602-68f5b57d0331", "comment": "Malware payload (AsyncRAT)", "value": "da7f0d5093612ec0ef16ebfbaa798cf5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623985585, "uuid": "0139cfb3-cc20-4c6a-a4c7-809f0212697b", "comment": "Malware payload (AsyncRAT)", "value": "31e9607bf9e803555d2627f9088a8ba2554d71f1e42b3ff78266388f1eca8b34", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623985585, "uuid": "df20114c-69df-4cd6-8001-2e9a6abf1ea1", "comment": "Malware payload (AsyncRAT)", "value": "f43968eba46be809d45cac3985b82ce890c302e8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623985585, "uuid": "3a2f68ef-92ff-4a76-a9a9-74667c90d66a", "comment": "Malware payload (AsyncRAT)", "value": "03bc4cee7339d7690ad35f1f02765c6265b000b0cfa6007a14545442dc9b6e819003ce0caa6091a09bc7b3ba40ef8020", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623985585, "uuid": "da10e18c-f6d7-478d-ba37-d020f5c35503", "value": "3C64F10237AD4B23C57D0BFA50A1209013B5EA6A6252EB4E9ECA72D65D63F410F53F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623985585, "uuid": "b06de0d6-1422-4d34-b6a5-083f20edb6ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623985585, "uuid": "f740c7b3-cd60-4ca1-92bc-903c1194d5df", "value": "6144:ObZPLl3hcWUD2fVSxjdIXO/RzfL5N3e1XYkDuunzzOFeEflN+8s43QBVF4Pb:01hcWUDsa5hf11eJzihFTf3t+VF4Pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623985585, "uuid": "2ce688cf-b733-41e7-839d-529ab26e8078", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623985585, "uuid": "83fdc9d3-89ae-4b0a-962f-c08cdd6243ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623985585, "uuid": "ec530e73-6f31-4ca1-90f0-18b8e7824c3c", "value": "DHLParcelReceiptpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c104c5-d001-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623999211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999211, "uuid": "1a63778c-45c4-4ef5-bfd6-6122a293c9de", "comment": "Malware payload (Loki)", "value": "ac404aa034c47a857a069e3033e5e3dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999211, "uuid": "bde25f0e-e436-4287-8da6-06eea9f52214", "comment": "Malware payload (Loki)", "value": "32c7e4dedeb83dfc60ae3077e013d408c7c9bfccf8b83daf5bd7b9712fee594b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999211, "uuid": "c45bb390-0858-4cf4-9392-ddbaebf39fbf", "comment": "Malware payload (Loki)", "value": "1cc70557f43a4ef4fc9d8d43eb2be7de1153aa4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999211, "uuid": "dbe31a22-f0ee-4100-bbfb-9f44c0c71d01", "comment": "Malware payload (Loki)", "value": "68ee3d6b9a99182d8a5d35ad78122aff23bff238ab988cfbbe8703c2863494bdbef8cfec4b679147ad903d14f55ce7b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999211, "uuid": "e325cf93-cef0-4026-ae6c-7167d1f9f364", "value": "DA25AE221DCF422AE2769FB55BB0BC87C2B76D663705E2153DC0329DCA33599C8DE522", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999211, "uuid": "41f9555b-0af6-40b3-aff0-cdc73fc35fd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999211, "uuid": "6ae93368-8067-4dbd-a6b3-38662cfe3cae", "value": "12288:Prhlm4S4F3M9yRSMPQipP599kxbWWEhGJFCuG2Lac9a2sTlsK1Zeqt:P9W7ip6VfEhURG2JlKLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623999211, "uuid": "ac878465-7631-4f5e-913f-cf70aa0d0168", "value": 985600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623999211, "uuid": "38323f6a-f2d9-4584-8e72-b83fa9a4746c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999211, "uuid": "a723d285-5714-44f1-950d-8661f89bb802", "value": "ac404aa034c47a857a069e3033e5e3dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f01ebf5-cfff-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623998181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998181, "uuid": "1294c67b-b3b6-4934-a319-06471367a8c0", "comment": "Malware payload", "value": "51bf52acf5121880a65144f201e60b52", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998181, "uuid": "966a8b66-2fb7-4b8c-b4e9-6c43507a37cd", "comment": "Malware payload", "value": "32f9704d37818253fbda931393fe3c1256f37931d0c36539cd20f49100080400", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998181, "uuid": "23391bea-44b4-4bfe-9ee3-2ba7e53c093d", "comment": "Malware payload", "value": "091d1c859cbfe1cd0148fdb96fecd08cd55e1428", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998181, "uuid": "f5391411-e5e7-407a-b2f0-d1d85e3ddb65", "comment": "Malware payload", "value": "2212b68ff28189b4e754390b271fc217c0ac2ffe6325260a4154a3204fb290f6810f46f5ef2ac1441781c0a97f68123c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998181, "uuid": "02b94c1d-4f83-491e-a8ae-37cc54e23868", "value": "9CF292CDB3C478C50B9207B7B91BF4D2F7966B8810584AABD640B8BF71A463DC9B4532", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998181, "uuid": "2fa8bba0-c066-46d0-9b2a-da3441f6e5aa", "value": "768:YTU7qh0/KrByy/URdYBJvwVG29uoeSPolX6dH7z8Wd8iizzo4i4GFMMnqwR413Cm:YTMM0YBTMsJeFMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998181, "uuid": "a412b7a9-6c1f-4cc5-8be9-7ae6bfa3b8fc", "value": 36838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998181, "uuid": "30452ee2-3a54-4874-8c2c-19cd61a64058", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998181, "uuid": "65bf70e1-87ce-4bd5-acae-37b5b8d31118", "value": "Text information.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5a2d01-d031-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624019516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019516, "uuid": "5a2c3fe1-3770-4873-9df9-22d8f6ee3497", "comment": "Malware payload (AgentTesla)", "value": "4302c78442173e446aeacbe190bad434", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019516, "uuid": "90b5528a-789a-451c-94ab-41168f0484db", "comment": "Malware payload (AgentTesla)", "value": "33c0bb5892946563ec82d3c92da0921f133c3f6c5c765beff3b517331599dc0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019516, "uuid": "f2297e59-dd3b-44af-acf4-409d8637eb7e", "comment": "Malware payload (AgentTesla)", "value": "a7a04215db2889ebbb9f6da4246f75d341836feb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019516, "uuid": "7b5b8954-e0b4-4d17-9698-5b100c589b00", "comment": "Malware payload (AgentTesla)", "value": "67259689af1eb97a32d8230cd9d252acdba9a1136a7fd08bd5a6df56c1dcd44e145030d51209e4a831c6f4c31ef31fe1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019516, "uuid": "ca438d71-a94f-4103-b340-ba192b43308c", "value": "F5257BDD721072EFC867D472DEA81C68EA506C7B931B4203942775ADAA7D897CF240F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019516, "uuid": "a9d9f1f4-0257-4dc3-8b1c-7955a2fcc29a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019516, "uuid": "c720ba55-824f-4a60-99b9-843c6556e301", "value": "12288:fg4YN3zbkKh0Qib2Wr4sR3mSwrd5jlhDKMK6KFppQU1rV4ZX2FMBwXgQ4gpTaUv+:INDY20QQ2c4MwrdTJLKbDQ8BDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624019516, "uuid": "06e8e842-5aa9-4bf5-a2a4-c280a81a2aba", "value": 989696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624019516, "uuid": "7d7a3214-0b6e-4b2f-bd4c-d546ae51487c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019516, "uuid": "979af3f8-5533-4487-87fb-1304b4107b5f", "value": "4302c78442173e446aeacbe190bad434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a758a2da-d007-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624001685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001685, "uuid": "96a00f27-b348-41c1-8a80-ad259f04934e", "comment": "Malware payload", "value": "5d71fde95148121ac57d25309640e137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001685, "uuid": "d2c145fe-373c-4e80-8654-34f6657e71f0", "comment": "Malware payload", "value": "33e0a7277f96cb5eb64106722f89c671db2ec40aa649ec2588f184901a46559d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001685, "uuid": "a10af501-f5af-459d-a943-4b280a6e2774", "comment": "Malware payload", "value": "23f189b938b6497c0ff0afd0d48b011b5f3dfa58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001685, "uuid": "0f509817-f556-4bd0-94ed-2f4495acd551", "comment": "Malware payload", "value": "3d951a78e62bda6b888621699628ab4575b3d4e5fbf5b35737745d095ac286dfc8a50cffc7c9782c845b7367087f41e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001685, "uuid": "47ba8ac0-5d78-489f-ad42-99f825832b33", "value": "5AB5331B21EAD262EA2DB4391CFE9F50076EC0501D51D7A1D16DBC201AC3BEE79ED42B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001685, "uuid": "4132f231-1716-425f-bbc5-f6469d1fce8b", "value": "49152:OQ4w+v9YEBYRXekMcmiE1ZJlJDdCY5PgcqUtn3hhRxR5Y18MRCm8erj:d1+Yu7dDBgc97xR2XRCmPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624001685, "uuid": "dfa81c3e-7bdd-405c-98b0-f6f86f9ad743", "value": 2353664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624001685, "uuid": "557de858-4f2d-4b5b-a1da-b4394ffbc898", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001685, "uuid": "f4cadac0-3cfa-439e-8c84-972021b9df48", "value": "5d71fde95148121ac57d25309640e137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d519ee97-d02b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624017224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017224, "uuid": "65ddb9cc-e4d7-48b8-84c1-9704beb4e630", "comment": "Malware payload", "value": "d031edf46f1632147f221e40c830ea3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017224, "uuid": "73158647-401d-4ebd-b2c6-f2052bbbfe8c", "comment": "Malware payload", "value": "359859070bef257fbebd56a372acefb760f30547f14457d7a353a6d599c42863", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017224, "uuid": "2fb28698-0e32-416d-9303-9ef6d0f26189", "comment": "Malware payload", "value": "2a5a442da76648f2fd00344f99932f4d5266dfab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017224, "uuid": "973e178c-023a-4fbb-a47a-45b55c5a7fed", "comment": "Malware payload", "value": "1a17559a6cbfbaac62f7b1591f3d99a0bd6f1b1d08a100599cf2c90513f92124fbb9216c1dfc2b491fe88a804824bdad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017224, "uuid": "47f01f64-da17-40c9-b0eb-b83a525e2373", "value": "8C92D036F25AEC7AC970053404BDCB89AF5237BAB0F63021039459B43B56219A6FC58F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017224, "uuid": "59f6c7ab-ae17-4904-8aa0-9e9d6645e6f9", "value": "384:A5IINjSev+gtztu00q8MghKeXaBR3F1ADQurdQkVB7JhymdGUop5haTB:A5IQ3v+WEh1oeiR3F1iekbs3Uoz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624017224, "uuid": "ed7daa39-d551-45e6-8b40-3c926febb14f", "value": 19628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624017224, "uuid": "1a3195b2-cfb6-494e-ae77-02a4c6a5fcd7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017224, "uuid": "0c54796f-ec87-4dda-8612-732c2e87a096", "value": "Samael.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4e1500-d026-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624015114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015114, "uuid": "8ccf50ab-282f-4e3f-98d2-2c2df8c9cfb6", "comment": "Malware payload (Mirai)", "value": "3d0ee6b3265e2ebe521f5d5e974b2baa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015114, "uuid": "55ee6e63-72a5-4407-a41d-279023b4462e", "comment": "Malware payload (Mirai)", "value": "35aff58a6aed952a91a99de508efea8ea896dee5d88d618ab70a811ec5b6e1a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015114, "uuid": "9cd73713-4624-4fe0-94be-ffd52a93141d", "comment": "Malware payload (Mirai)", "value": "4123c437d040bab96e7b673ac01d511288ff50c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015114, "uuid": "66ef7742-9bb3-4434-bc03-74359179308d", "comment": "Malware payload (Mirai)", "value": "fe53e8fd57704b1d02223c631f9729c36710f93fc787c2895c6db65edf2d794d37b9b4ff7738ebd35c82887b28f92f1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015114, "uuid": "c6f7169a-8585-43c5-b6d1-3f51cb29bbc8", "value": "09434B85B8829A22C5D112BBF66E558C372927E8E3DF32039D212F6177C681F0E77E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015114, "uuid": "3ec7f09f-286f-413a-97dc-2a24637c869b", "value": "768:owUwgv2VNPek2lrCKn+VO/VXQgbuBWpYPnSuT2D2ntuhJG8EranLQOxgR2yQAhVI:8w/NPL2lr9H/VAJWpw+z1nLIkaya10j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624015114, "uuid": "3c05be74-4e2d-4e2d-90bd-cbf00915e1ae", "value": 56820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624015114, "uuid": "c33d94c9-ac93-4949-80dc-574d305f871b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015114, "uuid": "2b7e26a8-fc5e-4a39-b018-c1509371f2c5", "value": "3d0ee6b3265e2ebe521f5d5e974b2baa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb3bb4a-d02c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624017668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017668, "uuid": "22b016d1-0253-4db6-96bd-671f4ae85f1c", "comment": "Malware payload", "value": "b960d9323cc3d493207a72d30eac9cdd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017668, "uuid": "fc951e30-22d8-4ad9-9ccb-2c7a52290cbd", "comment": "Malware payload", "value": "367da1b23182e4b68ac4e223154d9f81804f3936942df19a37cb391a0fb691f6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017668, "uuid": "7618b37d-56fd-4cc7-8685-1ad6b0bac209", "comment": "Malware payload", "value": "1a436062084300a41bbb7ee9ea37326a6dc24330", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017668, "uuid": "4f5146ad-e3a5-46dc-b639-c0a742d8cd97", "comment": "Malware payload", "value": "ea7b6b608fc62f20f23f4f9d30d8751f8d4751b086fd3a4f71e3bc6fc04a17ca872cc4434039a089eea7671d63278cfe", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017668, "uuid": "554d73e9-d396-40ca-b4da-8f735aa38da6", "value": "4C6412ABD9767DCBFE1B4FF021970E4E5EFDD2CAD2C668905215048025FD346A250BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017668, "uuid": "bd0e895b-e600-41d5-a97f-baa1e9af0d7a", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co:7O/QJHZweEL/NOjCHm7FZZnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624017668, "uuid": "f75cfea9-9009-49be-ace9-026f8621228f", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624017668, "uuid": "8be50000-8ce3-41ef-9c29-d96f3d6e99c4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017668, "uuid": "ee4e4c3f-c2ce-4f4f-bd0f-88eb542dd408", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8877d5b6-d025-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624014518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014518, "uuid": "e45265ed-502d-4df3-b8d4-36be103db600", "comment": "Malware payload (Mirai)", "value": "6fb1efe06e21168e1d95bf75cfe2c1f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014518, "uuid": "311f65d9-7342-4e1b-af4c-4a1d28ed76a0", "comment": "Malware payload (Mirai)", "value": "36bda2ada72a1c5277d1d1e5636e651343e9e99299924401ace45c4fb82398e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014518, "uuid": "a80f9e7c-05be-417b-83af-6c923e9deafc", "comment": "Malware payload (Mirai)", "value": "3a0e22dfd91e1fcc716f62c121e2e1e4391913c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014518, "uuid": "41e4052a-5e21-416e-bb03-fb6e54282b4e", "comment": "Malware payload (Mirai)", "value": "0ced62b34c7c08a09224bbc57a3ba96b876d2b2c2e0b348d23bb088b0535b029b91d08b360ef943aa98a0ee369f1c2e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014518, "uuid": "841074b5-be0d-428f-8a27-855c51e7642e", "value": "CC631A45BCD28A2AC6D023BABB6E11DD3321B3E8D2DE3107CD105B2477C661E5E77A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014518, "uuid": "e761e346-3992-4c79-b889-4a9da4260865", "value": "1536:IBnrw/MRgUYcCfzrT7V9T6j5+HwUxLzkYL5PykrZpEgBcq:IBrw/MkHf7E6LztNacZpdB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624014518, "uuid": "98dc1473-5920-4c37-861c-00148caa14b7", "value": 72048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624014518, "uuid": "d5897b76-828e-4dcb-8f5a-a68f9c34f541", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014518, "uuid": "537edb15-3119-4f37-aa0b-2ca19217fdee", "value": "6fb1efe06e21168e1d95bf75cfe2c1f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3e9bcd-d001-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623998898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998898, "uuid": "b01ea096-c02f-4268-ae04-e7e48ec7da51", "comment": "Malware payload (DanaBot)", "value": "d002fd64bfdd7944bfedf5f0bad651bd", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998898, "uuid": "102afe6e-6a27-40a4-87e7-4ae89b195f80", "comment": "Malware payload (DanaBot)", "value": "36dbcbd2fd7ca9dce07e4fb345b4e2f08bc514a8ecd776a2212a3897e9e6ef55", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998898, "uuid": "e478534d-44e5-455c-a077-4501d71122ca", "comment": "Malware payload (DanaBot)", "value": "712d4e8b9a0eb6fa53ce554077880bdb479ddd87", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998898, "uuid": "284df18a-a24a-46d1-8567-cd2f421fa4ca", "comment": "Malware payload (DanaBot)", "value": "ba6f1dd4ad958601d3eb15b12b32b8f5f09ac581836ae8d525cbb5aad41e015d89ed0510a0498bce77935f65d51cd6f7", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998898, "uuid": "f8d30dac-e0ce-4168-8fac-ed392aaf2170", "value": "F6351210FAA1C035F1FB21F415B99768AA2D3EB1577424CB22D51AEE9734AE0ED32707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998898, "uuid": "f8f6d4b9-5250-412e-b4a9-9f243fd80da8", "value": "9b93f51dff18f665803be156c5e038b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998898, "uuid": "228683d8-2158-436a-9520-7ba2a765d009", "value": "24576:aozyr1VQiWBYgqYENf5dLyjvRt3R0FjVFf8755tNAxW:RiWBYcENfevb3R0Fjjfm5tNA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998898, "uuid": "310c08bb-2844-4dc8-9e40-92c8db4fce14", "value": 1145856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998898, "uuid": "1c34dfba-5dbd-443e-9eb6-fbb3c9ed0bf6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998898, "uuid": "f8a0fc21-af46-41ca-93ac-a14ce3f96eb7", "value": "d002fd64bfdd7944bfedf5f0bad651bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882db9f9-d057-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624035993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624035993, "uuid": "674e8adf-3f9c-4e7e-a69e-eb5c57e38978", "comment": "Malware payload (AsyncRAT)", "value": "21126c492fd40e074f872b892cde33e8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624035993, "uuid": "9e405ad6-52f9-4d89-ab84-cb80f49f631a", "comment": "Malware payload (AsyncRAT)", "value": "3732541c9f88d61c5ce08ededc15cc5b8bfee0321abedb0437c30d45dcf5ff93", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624035993, "uuid": "d841537e-2e99-45e5-afc0-0182a44f5671", "comment": "Malware payload (AsyncRAT)", "value": "c7734cb4894c3e584c1ceb2db37f1a8433857da9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624035993, "uuid": "0cb294a2-4991-4c95-88ac-6fefaa04adce", "comment": "Malware payload (AsyncRAT)", "value": "2a130c8466e360a7f37b9336c512b8d942e249b77e65055a72b6d48a36a723eaf62d8b612cf3f8ac44129bcb60531500", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624035993, "uuid": "2664543d-bc9a-448c-a5c2-efe04023a5c0", "value": "4AF3C59D765072DFC86BC876CAA81CB4EA6074BB530B9243A41716ED9E0D8DBCF150F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624035993, "uuid": "ba537e9f-5a40-4781-99a6-a464887b3eb3", "value": "3072:58j5vxlJL3LDdb4sC3Je7cWwn9AHBOOyHOPPDi+H0yGPMdVe8gOPeyR4Hzt:8txlZ3aPc7cnmOOyuhQGVe8gOPey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624035993, "uuid": "f96e2d87-f56a-4db8-bddd-8015ec870352", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624035993, "uuid": "14521aa4-c0db-4934-90db-93eb0772d295", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624035993, "uuid": "00cafa67-c38d-4da6-a3f7-f7c3fcba727a", "value": "21126c492fd40e074f872b892cde33e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c35e2b8-cffe-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623997774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997774, "uuid": "4a98a5ff-6613-4db7-a12f-0b0e0a8d6b7e", "comment": "Malware payload", "value": "3dadb3063092805a1db5b12b1320fd3c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997774, "uuid": "a4bb0147-dddd-4e0f-92d8-5b8081c7c270", "comment": "Malware payload", "value": "37f5220625a8ef38fd980432cf2f03d9c055e767a5a419c5b20d4fda78ef3c93", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997774, "uuid": "ae00d633-ab29-4b13-bdd4-e32a7ce28fc5", "comment": "Malware payload", "value": "b13eca827c7fbe3ecb92d529e4b47788f49c1f2a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997774, "uuid": "013675cc-2ca9-4185-878e-daf3362e25c0", "comment": "Malware payload", "value": "e95249c8cf7ff08ea26c99c669c97e11b760ba4a276284a96afa6f82edd97d32534af44bd5aedea9650b39d07c1cc423", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997774, "uuid": "08b88b41-11f6-4eb1-938d-2228436f68fa", "value": "88D41257B1F5CE87EEE26136265B8A689725FC87CA18C11F7001F72DAD35630AB01D2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997774, "uuid": "cd667a48-a2aa-410b-8295-6a080e5db0e2", "value": "12288:Edp3t5UgRxjvS6WBF03qbu51xR2p7FgO7W3iEH:OqG6tDy5B6hV7GH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997774, "uuid": "70cb0cf9-79db-4ff9-92cd-45880e23165d", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997774, "uuid": "90b9114a-d5a8-4925-95f8-bf686bab0f6c", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997774, "uuid": "8938de6c-6b98-4d67-ba23-48242df19ad9", "value": "fnb-Payment-Proof02231.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66f4bfd-cffe-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623997925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997925, "uuid": "87278874-0170-41f6-b93d-ec938f4fbbe5", "comment": "Malware payload", "value": "0892a61225e5b9f14bb4d57e44e2310b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997925, "uuid": "f671af58-0176-4702-a494-a18f00a4d837", "comment": "Malware payload", "value": "386f124b4c4b5113bdc29884de09c7f4bc4af0a523d735915cf5047a068905f7", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997925, "uuid": "324163ad-d157-41d3-91d0-ede838009d7d", "comment": "Malware payload", "value": "9ffc32a78d28f81800e72d33c968f52abccdc33c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997925, "uuid": "22ebb01c-8746-479f-bc97-5e6c1ed5d65a", "comment": "Malware payload", "value": "03830a1ee1531e0ab56ca970bbb3676afdcfd14bd03d56227f2d69ed644d58d403a2228635cfe447d8613fa816f99d30", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997925, "uuid": "15b0dc00-4587-4237-9f05-e8d54d00fe4b", "value": "A71149044FE20320E6B69739AC7AB311C9767C52EE624FCD024051486821611F8B4F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997925, "uuid": "525ecf8a-b315-49f1-9afa-d0d28d4a27fc", "value": "12:80m/++VSXvk44X3ojsqzKtnWNN5UcCsvXFQL6H/sfUpHdiN33YqlPcr+9m:8JpHYVKVWB/CWS+nqH/dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997925, "uuid": "77f27583-0b1e-4d2e-a85e-a5f401039527", "value": 1110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997925, "uuid": "c0d2139d-849c-46e0-b274-38dd42c51fab", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997925, "uuid": "cf15124e-06a0-47e8-94c8-7ad16f6a9214", "value": "PurchaseOrderJune1.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3b40c1-d01d-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011251, "uuid": "c9685785-d6bd-4367-94c6-652e55a8e375", "comment": "Malware payload (Mirai)", "value": "a089384d6fa79cb90fc76e8a6d1349ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011251, "uuid": "993ea743-779d-4d06-84a7-490759678b30", "comment": "Malware payload (Mirai)", "value": "39f2866df262238307fe30eb9270c74e3624fdf0e1d1b00905fcf70fa616a83b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011251, "uuid": "0ea5434c-5112-4f6e-9690-d92c5badcf2c", "comment": "Malware payload (Mirai)", "value": "ef3fa825d029f9ca7bda731fd209c45a73c9ef46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011251, "uuid": "6960734a-b159-4f4f-905a-2507d048428d", "comment": "Malware payload (Mirai)", "value": "3c1bcae9bcd7b158ad6bdf596fff353d6e1dd0295fa87aefba641bfc7ef5dde125183822b34a5eafee75f3525627ca9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011251, "uuid": "5f1cc976-edb4-4bf1-be44-890ab9b9d06f", "value": "977319DAA0014E6CFC9BE9FD92214F09F920221155830B17B2A7FED77F721A99C53D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011251, "uuid": "8de6b1ab-45c3-4cf6-8958-0e37f44e163e", "value": "1536:oPA+ugXKCPn34N6UmBRTTf57kk1g1pJoZXcHEvqwL5dmTTb82:oxno7mBIkkpwaABm3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011251, "uuid": "5c835254-3fe7-4dd1-b2b8-57b8af3fa1f7", "value": 76712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011251, "uuid": "201ef356-b574-4e88-a9a9-7a18b4605815", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011251, "uuid": "878051d8-8c96-48e1-84cd-38cceb4bd7ab", "value": "a089384d6fa79cb90fc76e8a6d1349ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb929cc6-d002-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623999572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999572, "uuid": "fb023746-acdf-436f-ad22-7084ad5da9ed", "comment": "Malware payload (RedLineStealer)", "value": "957ebf3c8b97a1da54fb2bbae54b2aa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999572, "uuid": "91a297c2-e8e4-40ae-9efd-bc3a54581edb", "comment": "Malware payload (RedLineStealer)", "value": "3b665dd37348b149aa2ed6ff52705d4b06386e8d4c5d69c2a3a6b3283807756b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999572, "uuid": "513b59a8-a3cc-4d59-a6eb-3d124ca191ee", "comment": "Malware payload (RedLineStealer)", "value": "145844aa2b801a9a64e8dad33b9eefb41666c796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999572, "uuid": "ade07f53-1c81-407c-8a1e-2f94b70f86e9", "comment": "Malware payload (RedLineStealer)", "value": "3dacff6cd38cb63228b0854bfdf0d3d50bce3f171825b9d0b3e8fa3ec117149c6298849eb362c333b4f54670e6ede269", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999572, "uuid": "d15c35cb-fa4e-44db-9ed2-8d400a4dbae4", "value": "7C84BF10FB90C034F4F612F85AB693B8A52D7AB15B2491CF62D52BEA57346E0ED32317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999572, "uuid": "9f3f2bee-ac83-4fea-a963-c6c0ff40f6d3", "value": "5bc76f4349f7f0afe0c88e229f50d37f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999572, "uuid": "b0ebd86f-bf78-44af-8f5c-30a7f20aaf02", "value": "6144:qa9oTKR/EGfK/WHN5uL0+WNeCoLrbrhVB2yr2NAb5OqISojxts:9oWR/EGi/WA0+WNeCkrbr3Fr+AJIfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623999572, "uuid": "8d5671a2-97e5-4f9e-a82e-728a8218c11f", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623999572, "uuid": "7addd415-b0ee-4f60-8395-ed6bbf57c6ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999572, "uuid": "836146b6-a20d-4970-8f02-7a8460621e27", "value": "957ebf3c8b97a1da54fb2bbae54b2aa3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0113e38-d071-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624047253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047253, "uuid": "2f0c6795-5b1a-4fda-9f16-e955723e2159", "comment": "Malware payload (Mirai)", "value": "43f02b1b209dc37e6177591448c1fba6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047253, "uuid": "aa4a7d2a-7637-4776-9188-bcbda1a58655", "comment": "Malware payload (Mirai)", "value": "3d85b06e36a07ee5a848428e7701c26409d9c0b025763211d176fbffe7090842", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047253, "uuid": "7917b80b-ffb0-43de-94e9-a608814521fc", "comment": "Malware payload (Mirai)", "value": "b2448f83975796c5430d175ca20706277b6a96bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047253, "uuid": "83cd6633-94ba-4157-adca-e3b02c433138", "comment": "Malware payload (Mirai)", "value": "4c22c2608d021dcab4f798a1387155072e9316bf40c22e3b17fd458c825a03fa92ec54a83ba6a9389d547e98066b3465", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047253, "uuid": "e53b1948-06f8-409f-8933-3bf853cc04da", "value": "92C34C46EB408A13C4D51775BADF424A3323E755E3DB33068918AFB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047253, "uuid": "349c4d93-67d2-4be4-b225-a82b558611ca", "value": "3072:+KhtPUfCBPF49iuFcpQe8ZVu6W+amQxVTGyz:+KgfqPFSiuFcpQTVa+amQxVVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624047253, "uuid": "664501d1-4730-48d7-87ab-f60b2ef5391f", "value": 125754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624047253, "uuid": "eab809c2-2444-4534-919f-fa1507e0a819", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047253, "uuid": "bdc739ea-08d8-425f-92ef-68a6dd4c9abf", "value": "43f02b1b209dc37e6177591448c1fba6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaeede48-d04a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624030575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624030575, "uuid": "22296150-d945-419a-9379-bef21471ea72", "comment": "Malware payload (Loki)", "value": "32da26fcfe5bc84fd3cb8f4fe253d1bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624030575, "uuid": "c18be2e7-06a2-4515-9eed-b46e543d90c3", "comment": "Malware payload (Loki)", "value": "3e56d9df1d14f5758330600d1d2fd098a173842fae0447bdf8e6d97a4d2c7162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624030575, "uuid": "c0e971ac-f371-4a31-9e26-2bd754e30179", "comment": "Malware payload (Loki)", "value": "fe115845cbf59d00d4152016b1544f6cff21fb05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624030575, "uuid": "483e9946-8ff4-4e45-ab75-ed4224b0757c", "comment": "Malware payload (Loki)", "value": "c2e9b3a513f3133b905d7b7799232cf9e48b2c03bfb260204d0900a1f9cb6e21fb41ee33c66035c55aa616f904390ea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624030575, "uuid": "a73e7fc4-0356-4893-b67d-f8a3639b1862", "value": "AAF4C0213AE95119F077EF785FD075959BAEFF237A02E44E189133870A33A81CD9163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624030575, "uuid": "9b344c62-00ec-4556-ab2a-e7174ffbae1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624030575, "uuid": "0f2ceb25-45b3-4a5e-bb10-f7f68e1a22b6", "value": "12288:7inavhlm4S4F3M9yga/vmhLsGbLfZsMZj5p4471ps+CnYWlo/396fUZPzpo:7sIW3Evc/LfaQD7JAYWloF6fUZPz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624030575, "uuid": "50a50e86-c5fd-4741-b455-f69911782e10", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624030575, "uuid": "baf2a8b7-0630-4408-8d1f-fe3df7b024b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624030575, "uuid": "4115c0ee-ffa6-4475-87f6-9c6907dca42c", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285de6ca-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1623976991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976991, "uuid": "0372b8db-68b5-43dc-b0bb-2985e0718266", "comment": "Malware payload (ArkeiStealer)", "value": "84320ddbbc8937bda5b17c8f20bada02", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976991, "uuid": "518a0213-bf69-407d-9c1b-87a8909c3110", "comment": "Malware payload (ArkeiStealer)", "value": "3e5b7cb8978e88eb98d9079326d7c929eb12701f0040e6e2ec29fb5470022cf0", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976991, "uuid": "63de236e-a3a4-4e7a-a4e9-ccfdbace6227", "comment": "Malware payload (ArkeiStealer)", "value": "df265685dfae28f149c48ac7c6a27ebb98d948a9", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976991, "uuid": "031e6e66-1e56-40c0-820b-d269d6e9e7d5", "comment": "Malware payload (ArkeiStealer)", "value": "111dfce0ae130b12fb1ddf4e3e2298b334d33973c8bcc39d3eec334424d9d0c926e08f905a6ce7361c8970794d7a16e8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976991, "uuid": "a1254d67-8fee-4651-9f04-0db929c58568", "value": "48851203F293D5B2D9A600B501259BB21F3ABC319774C4E7AFD47A6D9D313E0A73225A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976991, "uuid": "09b44984-fc16-4a4c-b890-389e71f87714", "value": "0047ffc8d91ee9a957961742504880d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976991, "uuid": "e972a0ec-5683-42f4-8a6a-23328bbb9427", "value": "24576:siBs1yrkEFAraq4PaMBm3mFFLo/0fZsi378kv8MKeXqEgqHPoUsp7mBk+6IsZUsU:LBsrE2gc3mDnYkQuPEN4g/erj8E0je", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976991, "uuid": "ba70d2a6-b2e4-4daf-823c-72fabab84741", "value": 1851936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976991, "uuid": "b9a34445-f87a-41b1-8998-5940f4314c13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976991, "uuid": "987b8d1a-02d7-4792-91b7-09eb21315c04", "value": "84320DDBBC8937BDA5B17C8F20BADA02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80510b2a-d031-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624019658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019658, "uuid": "ad3e9330-2212-4d7f-81c3-ad2f2792d4e0", "comment": "Malware payload (SnakeKeylogger)", "value": "81f4acb8219aaf639b5702977a623c52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019658, "uuid": "1c850f7e-f71b-4479-bed3-3f39a54e47be", "comment": "Malware payload (SnakeKeylogger)", "value": "3ea4f66033e4bd2c1c4770d790cbbe912c2a59ab53a8f42276bc296f7c6c6f8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019658, "uuid": "648c96d1-9bd6-4b15-bb47-7ca0fdad666d", "comment": "Malware payload (SnakeKeylogger)", "value": "32367a658be7d2c6f0d2ba437cce6e12f26e3c80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019658, "uuid": "989ca414-f445-426a-9020-896906608f04", "comment": "Malware payload (SnakeKeylogger)", "value": "732eb2ca21ce218b15dac616e72f95b00f4555bc5b632fe0ea36e16d02ea277d1d89acd6aa3b18ae499481f36e1fca82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019658, "uuid": "4533a5cd-9308-4a50-8866-a121f6b242b5", "value": "E7940129260FE442F9D46CB8A4DE8171DDA14F843C2FB52964D8BE59F963F6812C0BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019658, "uuid": "58b5b79a-529b-4f70-a370-cbffb61b36a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019658, "uuid": "0715c4ca-0d69-457b-828f-49b247c5e9e0", "value": "6144:5LRWrqGYktLdzPU8dJZVjFa6dfcuGoDnmCT+X+4iurgz4OWHCU1:0pYkdJ88X5aifc7oDnmCSX+t4BCU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624019658, "uuid": "190f68c0-25f5-493b-9aa8-00607306104d", "value": 413168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624019658, "uuid": "3e0431d3-a353-48a6-86b9-e5ab1f000f3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019658, "uuid": "0d21cafe-0ad5-4001-8fc4-509f960a555c", "value": "81f4acb8219aaf639b5702977a623c52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e5789d-d08a-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624057885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624057885, "uuid": "2fe5935f-6354-493a-8b4b-e1767f276c22", "comment": "Malware payload (NanoCore)", "value": "8f3be4bee6fbecee660643b4358754c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624057885, "uuid": "f8cb5a6f-03a1-4a43-a50d-82e5948984df", "comment": "Malware payload (NanoCore)", "value": "3fa773f2dbad5ebc97c26b9dc3421ea161784c6b4913e4978bb2a48be2a852cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624057885, "uuid": "771b1f2b-a22b-4ec5-b975-ff1eb5a2b44c", "comment": "Malware payload (NanoCore)", "value": "efd4e03c92656e18fd62614b875b4283246edd9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624057885, "uuid": "275195f2-68eb-4af4-803d-d0b7eb5a92e8", "comment": "Malware payload (NanoCore)", "value": "a6abbd7f3c40e9a89b08014e4178bfea0df9d98e87fb79f6fa7a79dc34917968a278253821aff10a0d7be2c1b3f234e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624057885, "uuid": "f1df4285-258d-4e44-bc5b-eb26ce746fd5", "value": "6C15E12523D8CB86E57E47349165418093F2FD1BD729EBCDBD9910DC0BA0F818762BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624057885, "uuid": "1dad31f1-fba8-445a-9560-ca7703ff3d7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624057885, "uuid": "013a92f7-ffc9-48be-989b-0a6899d240c7", "value": "12288:mueLoaTLMESeptyFuHB3NaSjoBDy56ba16WquWGb2mO9VCZ6v:4L1TLMEhyFuHB8lUl63uWX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624057885, "uuid": "b0b445a1-80f2-4875-9791-19e72e4836c5", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624057885, "uuid": "846d4ca8-e8e9-49f0-a874-7c918c92d102", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624057885, "uuid": "187bbc9f-f17b-4086-8862-c5222783557b", "value": "8f3be4bee6fbecee660643b4358754c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b34ef18-d05a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624037152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037152, "uuid": "bb077a67-6e72-4246-9786-aaf47e42c6d5", "comment": "Malware payload (RedLineStealer)", "value": "6b3323dc6ea21c82ae8004328d2fe6ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037152, "uuid": "90c1a088-f619-44d8-ab6a-902e9aa06b99", "comment": "Malware payload (RedLineStealer)", "value": "3fdc14510fef144f1d36b6673558d2d75e4c326524e1310b9742d2f00cc2c100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037152, "uuid": "b93c2a6b-0ed6-4e19-9a26-b572b493d48f", "comment": "Malware payload (RedLineStealer)", "value": "bd68557ee586fbe44b23618e6e9cf94b699c97dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037152, "uuid": "de9d189b-9772-4d3c-8839-bf6e983fe045", "comment": "Malware payload (RedLineStealer)", "value": "c4191b4163fd6ff8c30c1d3625efeb82abd15351c090b71496ab06c55e7385175e9fcfbe78ba1dbf46802c2c0987ab89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037152, "uuid": "9bc551a2-8521-45c7-a84c-e40bb4119011", "value": "8984BE10FB90C035F5F612F85AB6D3B9A52D7AB19B2490CF52E51AEE16346E0EC32707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037152, "uuid": "734c8dc9-5ff6-4941-bd61-f6e15543c86d", "value": "705a372c868b933d973ca642948b7012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037152, "uuid": "4c327d69-24f0-44ff-b63d-c2294b73d360", "value": "6144:6GS69nqskPwGTMCRZe2aH/WcLIO+VU2m2OEVGiNfGhLoCy6SGSGI7uj6ex:c69qsk4GTMeZEWcMV5PN6LoCy69nj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624037152, "uuid": "b3ad6dbd-5c67-4a71-8f87-9d626a27430d", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624037152, "uuid": "964f218d-e769-4cbb-8b78-fc66d2b8fba3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037152, "uuid": "fb33748a-58e6-4079-9cf1-c8db3048df02", "value": "6b3323dc6ea21c82ae8004328d2fe6ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a1c8ef-d078-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624050298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050298, "uuid": "81e21ea9-43df-4a02-aa36-64c41121b1e5", "comment": "Malware payload (Formbook)", "value": "297da67da164905878c696be732c835f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050298, "uuid": "5ad251fb-f249-445f-ac6c-c50ffa4c894e", "comment": "Malware payload (Formbook)", "value": "3fde800099900011f3f8cdda19331944e52ad1c36e430bbc661cd2433ac12c51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050298, "uuid": "70458856-3de0-426c-8386-9b5595a34e0d", "comment": "Malware payload (Formbook)", "value": "58db843047d510637039caafff573b1908bd0cd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050298, "uuid": "7f193015-8626-4ced-a947-d632a8ea36ad", "comment": "Malware payload (Formbook)", "value": "b94e07387c3db1bb79470c8812e4ea50810898f6120a84b87066b229b91d4e3948276271040398fe468b7f8c37fc608d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050298, "uuid": "4eb98060-b07d-4dd5-9e2a-df9a18cd7a73", "value": "56A4120133FD4B32E8BC4BFAA561A19127B1A11B9155EB0E5EC631D64C67F884B23F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050298, "uuid": "f10d4eeb-080c-426a-94e6-1b014dac5750", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050298, "uuid": "a07c5ce4-0ea8-4d40-b819-0e47c3fad818", "value": "12288:nAhcWUDdy8wuo1nI3LiqC82TyXG9ADs4Pb:nAhcWUDdXwuleqCrO2x4Pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624050298, "uuid": "02dc1bef-66fd-43c3-8cfc-d379bd785a78", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624050298, "uuid": "13f561c2-2ef6-47e3-a639-40852758f91d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050298, "uuid": "304dd390-0017-4274-be65-ac12844d4244", "value": "Bank Slip and our New P.O copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2676a8c-d061-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624040466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624040466, "uuid": "3ba9e2aa-08eb-49d2-b305-c1f97ef0eb61", "comment": "Malware payload (RedLineStealer)", "value": "019006cf7147712b8afbc7f031f347a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624040466, "uuid": "ef5e458f-cf16-4364-a0dc-205f80ca90b0", "comment": "Malware payload (RedLineStealer)", "value": "40efd41d17fb832b13911977e0931d1e556aad35a78d1c40101932f9d5fb0eac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624040466, "uuid": "bd18abb8-444c-4bc1-898c-ad4fecb45cb8", "comment": "Malware payload (RedLineStealer)", "value": "d9b80b5092d447d611c35d0879940bb45e1fb323", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624040466, "uuid": "daa384db-ab1a-4182-8621-414e0267f4dd", "comment": "Malware payload (RedLineStealer)", "value": "00eb31be15b14822cdf3235f0723384f0ec9a41dced53aa46046adee5343cc4acb528587f1dce8fb0d8d48fa68a9c609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624040466, "uuid": "cf379720-f665-48d4-a510-07f1de4ee081", "value": "C0E40252FAD045B1D472187459F8D630693CBC202B398ADFA3A8762D5F304D26B37BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624040466, "uuid": "ff88a32d-315c-453f-9ca6-e080b0802a85", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624040466, "uuid": "78c66a49-6edb-4c48-90b1-939f90df4ad4", "value": "12288:VOOfN590uu6opX+t4sP+Zx4e2ym7dWqzERnVqWSU15lMf4+HhGw3cW0zFg:YOfNkuu6oLsixr2ymhWS0DScPMfN3cNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624040466, "uuid": "7454d8ab-397f-4e30-af2d-24d879e655df", "value": 702142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624040466, "uuid": "10685184-c684-4976-b4fd-ddf9651b144c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624040466, "uuid": "df786bd1-7fdb-419d-9740-820993f48c87", "value": "019006CF7147712B8AFBC7F031F347A2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ec63ee1-d007-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624001429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001429, "uuid": "92aad56b-8430-419a-8c09-53517b044f83", "comment": "Malware payload (SnakeKeylogger)", "value": "20ceb0cdf1f078b28671054c2863052c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001429, "uuid": "7d41e72d-72ed-4b8c-83d9-ff07d4d851f0", "comment": "Malware payload (SnakeKeylogger)", "value": "4223fc55e6b0fc32d0f55607395055db9023a5d6980dccad59f11aadf0179b86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001429, "uuid": "9f1d75f9-fd1d-4ef3-b726-27897cf2a62d", "comment": "Malware payload (SnakeKeylogger)", "value": "fc335d40a3fe8aceb4fbfd89c279b9b56a142556", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001429, "uuid": "779f7436-123f-4a5f-8485-eb8ab89c2e2d", "comment": "Malware payload (SnakeKeylogger)", "value": "5229cb13e6d7f3d55da4d20d334a9fd50f112fca66c2830a2077c5454e14123a3a5bf9f914128d71c0561ed8b965300a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001429, "uuid": "a9e87e34-1e6d-4317-b4fe-4da85796bf5f", "value": "63E48E3439E9C114F176AF75DAD071F657BABE63EB02D40F24A03F473632640D992A2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001429, "uuid": "ae12d9c3-a88c-4a0a-acf4-9c029297cfb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001429, "uuid": "3b7b76a6-5304-4456-b123-417727531e0b", "value": "12288:dt8hlm4S4F3M9ywkNnPtEISUX7NAEFQPiHPN4x2Qf/ylLgFMuMnXjk:daW/+tEIPX7NAELHPuxxN8Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624001429, "uuid": "85c3ad6f-5295-4415-9542-1c9d34c67838", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624001429, "uuid": "4b8f1d60-9ce2-4bbb-99aa-12713b92a0a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001429, "uuid": "2cc12466-ad87-40e7-9b3f-027c75a06a64", "value": "RFQ-YEKHA-20-0151.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7643bc31-cff8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623995160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995160, "uuid": "85177e89-13ee-4583-b1ba-5b56c9e0bb22", "comment": "Malware payload (AgentTesla)", "value": "29a52156c919b67286cf26a6e3be6da8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995160, "uuid": "69ef8d7d-43bf-4fff-b052-29905a5eca57", "comment": "Malware payload (AgentTesla)", "value": "432cbd06688167972b7ac8187acb05c6a7922f378813145ccc449f32e00a7833", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995160, "uuid": "29df3708-9955-48d9-b9ae-415f7db1d3fb", "comment": "Malware payload (AgentTesla)", "value": "39c4319d3de76b99c0fe34f2b16a6849c5e64b7b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995160, "uuid": "6e1f8d9f-74f6-429f-a699-e62fa6af9f2f", "comment": "Malware payload (AgentTesla)", "value": "0201667b68c513afe0790f653f37659fa88154272244ca62a7fb4b93777c8712141a887f588c74d5fc4fa377be9a3c0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995160, "uuid": "1ab978e7-1ba3-4f4a-ad59-650f6853b8e2", "value": "3BD4AE343AEA5129F173EF795AD475969BEEF6633703E44D389003460613E81CEE263A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995160, "uuid": "e885324e-3ad2-4138-8388-f5f9970f7ad9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995160, "uuid": "69477bf3-9b76-40fc-a87b-d5b6d0febfd9", "value": "12288:osm1hlm4S4F3M9yU1O/kqTRWW4JdFOfeuwx3/tl6+rGU1U:oxWT4WOGdZ1lPzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623995160, "uuid": "37957b3a-d3c0-48f2-ad57-26bcd7e9e6d9", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623995160, "uuid": "0e9feb87-6ddc-4b90-859f-7cfb39c1750a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995160, "uuid": "6c6a9740-dc86-4d5b-9b12-63f3974ada8d", "value": "MX-2310U_20210616_225343.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21e00e6-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623976846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976846, "uuid": "c3aec10a-c0ee-48e6-b0a2-d28e01fabd03", "comment": "Malware payload (NanoCore)", "value": "8e55463c9380c7a2c428d4b59f24dd37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976846, "uuid": "bbd14455-cff2-4615-9dee-0a89f9964ec8", "comment": "Malware payload (NanoCore)", "value": "43938328bec5e5c1f4ab723dbfc6926ca0005972a9628485c7360d9e7628c05b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976846, "uuid": "880be3ca-b365-4443-82e5-7d07334bc807", "comment": "Malware payload (NanoCore)", "value": "2cfb993ba4399298227900f96bb33142dfcca3cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976846, "uuid": "bc16b8d8-4e1f-4377-b410-1d0b134f8dc1", "comment": "Malware payload (NanoCore)", "value": "07c1da942df81658c876760c481e59f5a5bf27753e9f0c92a6efd420ce0937f00f69ef6020ab7e8539f8d8810e161c69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976846, "uuid": "9716fd08-757d-4d25-b436-fb7797c0e748", "value": "AF64CF51F2C4D896F10309F1D17E9AF18327AD7EC4B50A8F115C7E38B5B628B00AAE79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976846, "uuid": "77a16610-f604-4012-a5c5-31e7212d482d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976846, "uuid": "1feb75e4-d30e-496b-878c-a60482c27868", "value": "6144:cQqOn7MUoSk8z1I49s/4DlmPdMLnsUs9f1Ns5U2oWeNAWVt:78Sfz1I49s/qLr01Ns5WWeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976846, "uuid": "fa623346-1e7b-455b-8cb7-748321845f40", "value": 332597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976846, "uuid": "5ef45fec-3232-40ff-89ef-eab744fb20f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976846, "uuid": "e399a941-6521-4934-a2f5-6adb7369476b", "value": "42123100987629pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be3566e-d002-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623999411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999411, "uuid": "018fb29a-5e64-4b6e-b0fb-a19843bdcbfd", "comment": "Malware payload (CryptBot)", "value": "789b81d955e5b417920260d90b4e26bc", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999411, "uuid": "12f8c493-2b7c-4c62-af8f-09e2f0ac3373", "comment": "Malware payload (CryptBot)", "value": "43cd545a28d3ee84be489c2dff90f9487b90e0b1014c354d05b366fee7357ade", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999411, "uuid": "d480bfc0-7373-4f81-84b3-08ed55f267c3", "comment": "Malware payload (CryptBot)", "value": "8bcc8c7ce14d66f85ae12957bbc939d8e21d1b03", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999411, "uuid": "5637b12c-5c1c-49e3-badb-84a037ad099d", "comment": "Malware payload (CryptBot)", "value": "0c3b330ae5f0b378d9826dd36c6c42c45480b603d3efa2d7a0a81fc9ceb437fb304b1ed1283ae06ab311565105e8f66c", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999411, "uuid": "50e837c8-e850-45fa-9c27-8899350f8ab0", "value": "E2F4F110BA50C035F0B351F85A6A9379B93C7AB15B6850CB92D61BFE5774AE0EC31B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999411, "uuid": "23e0b743-df21-4cac-aaec-e0b4328e2b66", "value": "0e61e5ee811a73c290e64659dd192375", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999411, "uuid": "c4947b59-5b71-45aa-8634-49e95192ca80", "value": "12288:HYoa8oq38P5o8mfGywLJrbIaaoJTNoLnZJB7BC2VphjCoRxklI85ey8KFCvcGDWH:28oqqqG4ToJTNYJB9C2VpHRxke8HckGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623999411, "uuid": "d5a53e3c-d9b8-4729-9178-1900b9edc1fd", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623999411, "uuid": "b0f9dab9-4a30-4341-bbc2-70af97c70445", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999411, "uuid": "7ea43aaa-0d4f-4b0a-9eb4-2ad24e774bfe", "value": "789b81d955e5b417920260d90b4e26bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902638be-d006-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1624001217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001217, "uuid": "ca47f727-a19d-43c2-81cc-40d068658324", "comment": "Malware payload (Glupteba)", "value": "8d44ccac6b5512a416339984ad664d79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "Klingon RAT", "colour": "#B848F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001217, "uuid": "c0842941-182c-4df2-81b0-fae55b1fccc7", "comment": "Malware payload (Glupteba)", "value": "44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "Klingon RAT", "colour": "#B848F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001217, "uuid": "0b107e62-c7a3-4bcb-963f-1804f4cd8a0a", "comment": "Malware payload (Glupteba)", "value": "6152e1a374fd572d25fab8baae9d1b12116a7c35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "Klingon RAT", "colour": "#B848F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001217, "uuid": "7ca2549e-4a9a-4e8d-82b3-1e4e94daf235", "comment": "Malware payload (Glupteba)", "value": "daac5c3c5c4182d99f447a729c55b9be335f1cacd56b80b656722c7b1ff1a7bb4b20e5aede98246032e02ad8b1548f7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "Klingon RAT", "colour": "#B848F8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001217, "uuid": "438ea7a7-9951-4dbf-bdd0-20036a03d706", "value": "52869E43FCA914B9C7FDF13086659222BA7138694732BBC31F9495662A56FE0BB3D340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001217, "uuid": "5aefd1f8-1c06-4cdc-bbda-c4d43dfb1559", "value": "91802a615b3a5c4bcc05bc5f66a5b219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001217, "uuid": "5e3126de-9b43-48ac-b677-35306b29c28b", "value": "98304:AlI7YUgGQGyRka2oWFITnKW+W4DN5/q6D3n4U9/ooMR7ecmm2WpIII:AS7YUgGQpRkajWOngDN5rnxPM2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624001217, "uuid": "3fc1f1cc-6fb9-43a9-ba74-353d7c57da37", "value": 8128512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624001217, "uuid": "f4213b6a-04d3-4016-a65d-411e5e16ec78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001217, "uuid": "07847a4b-7ec6-4eeb-b9d6-f4b55705a595", "value": "44237e2de44a533751c0baace09cf83293572ae7c51cb4575e7267be289c6611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e816a37a-d024-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624014249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014249, "uuid": "72d2e445-c9af-4746-abaf-524e7a616031", "comment": "Malware payload (Mirai)", "value": "5144c5fc939319574d4f07af171f8f8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014249, "uuid": "536c25b6-b52f-4e70-afe6-d84a740c5903", "comment": "Malware payload (Mirai)", "value": "44da80a32958b42b88a6ccba9413d036405c1c44a56a9c34a85da29d2d3969e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014249, "uuid": "bbe9c0e9-0dfd-42d7-ad14-efc29d6738f2", "comment": "Malware payload (Mirai)", "value": "a511a6a46872803941e26d0830f6394b8251d2f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014249, "uuid": "c9446465-d328-4230-94eb-619255edf364", "comment": "Malware payload (Mirai)", "value": "554c5b563affb2033398038090ebe42dda8a0e31dfbc2c1d80ea3fb2055404ea1dd4b9f8f36ed27968f11b8b5c365b36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014249, "uuid": "b30370fd-8aac-4127-b924-174b7bd95a06", "value": "AE831846BCD2CA12C6D423BBFA2E518D332563A8E1DE3207DD106F6437CA92E0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014249, "uuid": "07de47c6-ccec-4c38-b8ea-014ce91a974c", "value": "1536:Sy4zxWvHqr4tw1wRCd5hTZlPE+5FV8wUfyooDykqsiptHhS4kq:Sy4lWvHqr430KwxPmdzptHA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624014249, "uuid": "d2560560-4810-4abf-ad80-5c9de89e8b02", "value": 82984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624014249, "uuid": "76af140f-42e9-4413-974e-3d4348a202b1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014249, "uuid": "f55e0b23-25df-48b3-9913-a7bc7bcfd966", "value": "5144c5fc939319574d4f07af171f8f8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b288971-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623976969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976969, "uuid": "959fea71-666b-4783-9b80-706cc936482a", "comment": "Malware payload (RedLineStealer)", "value": "2f363b6927853e541434c5e410151285", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976969, "uuid": "a7122c23-393b-40a2-b1b7-23bf3ea3b3a3", "comment": "Malware payload (RedLineStealer)", "value": "454d8405649738b61e7abfa78e18ef8493975ab74d2bb1e35bf263f1a90c3027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976969, "uuid": "ad97bfc1-bb07-4c2f-ab3f-14e4c898daba", "comment": "Malware payload (RedLineStealer)", "value": "15f3f936b4ec09d574770f720371e5918e21ef15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976969, "uuid": "384ce1ec-ea54-468b-8efc-c5e7d509657c", "comment": "Malware payload (RedLineStealer)", "value": "24998535878987d9ba4e7b4beb157c1431ea25cb722324466b744318804bec9b8748caa5ba18b3415527ee4235ebbb52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976969, "uuid": "b9966e15-f6cd-48ec-9732-a9e0ac414961", "value": "26458C0937D5C2C2F3161031F064671F0E763D7A39B5F39A3AE8305E1B79A1069AA69F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976969, "uuid": "c857d0b4-b96e-459c-a7a8-a5e7e1f003a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976969, "uuid": "4afabe5c-692b-493d-ab6b-2566e74a98e7", "value": "12288:P3lQuolAF2GhM4ARL4t2QhPXngx4wbuQJKrbD6m4cDM3DynGoDPJipfQ0mr8RbeH:RcP4A6AQhPw9bYKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976969, "uuid": "34d45522-53a7-4008-b08f-2783f5da0b80", "value": 1247120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976969, "uuid": "e6fbb066-4200-47fd-8f07-97e9d38520ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976969, "uuid": "4e2998cf-cc67-453c-af75-3090d51b3525", "value": "2F363B6927853E541434C5E410151285.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfb5e0e-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (BlackNET)", "timestamp": 1623976863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976863, "uuid": "f69f9283-d0d5-4991-8134-ac092fdd61c6", "comment": "Malware payload (BlackNET)", "value": "beeeee649dd7df213b7465f6360f10c5", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976863, "uuid": "8916419f-ca59-47c7-b439-7bd9168e4d0e", "comment": "Malware payload (BlackNET)", "value": "46260342b0d0d438ec2959fd18ded527516d8f21e1f5fb8be168f06dbe62144e", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976863, "uuid": "e6ca2c56-7e70-401a-b001-d4cb04d314a6", "comment": "Malware payload (BlackNET)", "value": "d33e2621c3a16b68e0e6d6e157e74664a73e3408", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976863, "uuid": "85044767-8501-4e60-acc8-37c3e9087d58", "comment": "Malware payload (BlackNET)", "value": "a9bc957c848c7b19ea9bfcc79bc976b95e60ded50413be754d708ea1125d2824baa693425413bff1328b80eb2e374507", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976863, "uuid": "e5d7c528-b7bf-4665-83e8-5ac20247c35a", "value": "810402093B9C5936C7EE0A3DC06146A04735E312B026DF9E3ED432EB6CAFB558646763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976863, "uuid": "bef10c0f-e884-434d-82e3-5886fe17ef4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976863, "uuid": "e5210f89-9f7f-44e5-81bd-61d6f0af9caf", "value": "3072:M8lGQeiL3r9jX6DcyUcTQw8UA2v+qSaOp/8SrBSKZZleZOMQrX:qz83r9zjHw7A2Gcg/8SrHOcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976863, "uuid": "bf0ea55c-0ba0-4827-b654-3daee0e0d22c", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976863, "uuid": "83d30b66-824c-4e21-b8be-48bf584a0aaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976863, "uuid": "120b8e37-b959-49ab-b450-836ef2abae2f", "value": "46260342B0D0D438EC2959FD18DED527516D8F21E1F5F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173bdfed-d008-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624001873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001873, "uuid": "225c1284-7629-4e44-b6a6-dbeb522066dd", "comment": "Malware payload (AgentTesla)", "value": "d7d506963935658eb91a7981caaad687", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001873, "uuid": "9f752fbc-2ff1-40ac-80e5-0a17b2e9af02", "comment": "Malware payload (AgentTesla)", "value": "46b1aab4be9437c4bc6328f946e19c0138863280bf727f31cbce5f4fa6adb0e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001873, "uuid": "32ef4f03-47ce-4889-8371-4674f6245e15", "comment": "Malware payload (AgentTesla)", "value": "7f83f38c5c4ffd80f583a22a140d33d6e75f43db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001873, "uuid": "39b60c58-2435-4a14-9119-08518f634346", "comment": "Malware payload (AgentTesla)", "value": "7c25c00d50d92cef4ef7139d9c1e19d4c3cabe07cb4388164756d5925c354511b0b8f35ae181174950394322b90639bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001873, "uuid": "1fcdf58f-7116-444b-be98-9cc3fef95f97", "value": "90E4BE343AEA5119F177EF791AE075969BFEF7237703D84D2854038A0622E41CEE163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001873, "uuid": "7982395b-2da5-46be-9d22-ebd8182696af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001873, "uuid": "4de74d74-77b3-44dc-be4d-5daa7a06d576", "value": "12288:Tsmpshlm4S4F3M9yZLGEgUu4sDnk9dJqmUEYMycsRc+b3Jk2UW8E/++GR/M5WAC9:TTeWCJmd4T9YAmGHTXR/M5M9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624001873, "uuid": "ed45c070-cca0-4864-a238-014a39d0166a", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624001873, "uuid": "527599dd-f3f2-479d-9392-c2a02905b516", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001873, "uuid": "568d5ab0-54db-451e-b19b-dc09d355dde3", "value": "Swift Bildirimi27062021,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83993897-cffa-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623996042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996042, "uuid": "84db249b-9d48-4172-aee5-9b674af644b2", "comment": "Malware payload (NanoCore)", "value": "588efab1ef2fe1a2d2d832002f9f2d01", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996042, "uuid": "1c061034-68a3-4482-84c0-dcde18568ea3", "comment": "Malware payload (NanoCore)", "value": "46f0bdf29f5e98be379bc1fea1b44306c14f58305fd237f45039e625e3741cc4", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996042, "uuid": "cd80e52a-692a-4dd9-8df6-8d82f8f30dc0", "comment": "Malware payload (NanoCore)", "value": "cb5b06fb8caf354b969f551523b200f9c686e8fe", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996042, "uuid": "71bee1bf-b893-4df1-bdd4-d425b6325e28", "comment": "Malware payload (NanoCore)", "value": "80908131fee6ed32436c7ca19204be920ac2d7ac2d4b883cb2d32219a473221bf4a2fdc8355c505c4ffb3f3c3489e56e", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996042, "uuid": "3bca51aa-b597-4a96-91e8-c1894a32bbc4", "value": "C665C0102AEA5115F173AF745FD079929BBEFE237702E45E2895338B0733A81CD9163A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996042, "uuid": "5a63da77-c070-42a1-bdbf-dd26a38ec1f4", "value": "12288:grnhlm4S4F3M9yx/vmhLsSbLfZs7CQnwQ8b7y8obb8ewdPqNSQmSOlhMWTrozIyx:gdWuvc3Lfa+2F8eCSHodjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623996042, "uuid": "6790292d-a54b-4b11-aaae-bc89f2393c5a", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623996042, "uuid": "69d08390-106a-4ec6-8d34-e6ee52c5269f", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996042, "uuid": "c4f3c091-694c-4c61-9d69-3302ac5e16aa", "value": "Remittance Form-Payu.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9efae61-cfee-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623991033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623991033, "uuid": "95273c16-1107-442c-ad27-c7c0d4360679", "comment": "Malware payload (RedLineStealer)", "value": "a91682ad98788c45e3ba35f7ad89b196", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623991033, "uuid": "cfce02c3-293f-43df-b30a-a806d6e6f0d8", "comment": "Malware payload (RedLineStealer)", "value": "471a2830fb34fd1bfa68bfc8c3db3eee642982abd4a0be4e1ac3ebc2a96954cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623991033, "uuid": "afd0c46a-c282-46d0-8dc8-799de2b87534", "comment": "Malware payload (RedLineStealer)", "value": "0cd693e64145a607ef4f90811245a27a0f3c59b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623991033, "uuid": "d1effac8-b3a7-4b2b-8b5a-1cd9abba4d19", "comment": "Malware payload (RedLineStealer)", "value": "eaf9ec02bbcd10b62f586f1caff99ef30b45c5abbd3f71a9e48b6cf81f968a893cbb2bdc54b40079f83a0ccd5112481b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623991033, "uuid": "66771fc6-b487-496d-a7a2-2b9a584557ae", "value": "D5934D6BA3ACCB15E7FD4974B670112947F1E6CF6402EF8B8DC1A89B1E627C11A045F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623991033, "uuid": "c2605c0d-dee2-48d4-94d6-d75e569f4c69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623991033, "uuid": "0229b5d0-137a-42b4-8640-2d7979fb9620", "value": "1536:GO/xzztoCuZKfM7xAjlMYIVNEI+++++++++++++++++++++G7M9/aQ5b9VQ3UHj7:GO/JzRuZKfmAjlMYW6I++++++++++++q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623991033, "uuid": "186048fb-ce09-407f-9bb2-b028177fe63b", "value": 97280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623991033, "uuid": "526a4177-99a1-4541-b8a8-63047af6d591", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623991033, "uuid": "32a0d236-0a2a-429f-9928-f3b3b7c22817", "value": "a91682ad98788c45e3ba35f7ad89b196.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcee9966-d071-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624047248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047248, "uuid": "2080d3ef-bdc6-4f73-b2ab-a766a5be97c3", "comment": "Malware payload (Mirai)", "value": "f40ba3464f49093f77e62c367b9e20e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047248, "uuid": "54464df9-b326-48ee-a85b-aaff3a4b2078", "comment": "Malware payload (Mirai)", "value": "47a8ead17b440e668be6678cb8c4d6f3c685499c199f1e2f5b9b0ddd4076dfab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047248, "uuid": "6d912841-e935-4f49-b733-51c678ec814d", "comment": "Malware payload (Mirai)", "value": "f434c389c6909e4fa76635db547633d92b654162", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047248, "uuid": "a09124d0-6c87-4607-ac73-d92171de161e", "comment": "Malware payload (Mirai)", "value": "e988d00e81e40ddc25ebda0bb9cdd073febd310a6c10882d970b8b1048a097a1b6a3fbc09ef1f0dcf1800c5b7e6405ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047248, "uuid": "0c752f5d-29cf-46ec-b2a0-a424f492eb97", "value": "4D332981BC919A02C9D423B7FA2E01CD372563A9E2DF72079E216F1177CAC2F0E67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047248, "uuid": "4a809274-d485-4811-b778-f31c6630558c", "value": "768:aw8hF5yjQQsLC3TfWvHbXFspnpeyrNSwrfqUoOqbmBNOS9iVjySfR2Md:GhF5yjQ7LC3TWvHbXCGYSkfqu91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624047248, "uuid": "f5f62112-86c4-4a86-8906-e607ae4ccdc5", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624047248, "uuid": "44a47e49-df00-4b74-9bec-68983e350eab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047248, "uuid": "1354f7fc-69c8-44d3-b2d1-af0fa9000d2c", "value": "f40ba3464f49093f77e62c367b9e20e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d987c955-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1623976858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976858, "uuid": "01d7a6ac-949f-4950-a1f0-523ce7b86731", "comment": "Malware payload (LimeRAT)", "value": "be989fe7c9ad1c2969ade36beefe518b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976858, "uuid": "0c532520-9e2d-4dba-af60-7621258a62ca", "comment": "Malware payload (LimeRAT)", "value": "47c4950796f20f14dbd5869bef46ed230f98a36fe8c26301ed9199bc3ef83adc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976858, "uuid": "a6c51709-a852-40b6-a65d-e7de0bc45bb6", "comment": "Malware payload (LimeRAT)", "value": "1b41c0d5e4a6b3917fa015bb42f000c1f85728c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976858, "uuid": "45d0aeb6-d59f-4925-a464-ceb4727e12d3", "comment": "Malware payload (LimeRAT)", "value": "3511a8b0eaaf14cd44aa9ac5963b3f639bae420abf225747c67a84b4dc1cceeeeac41c278e819474e64de78c56d5b426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976858, "uuid": "5ec36e19-db8e-4f38-9719-829db6742df3", "value": "B0B57DD34CC826D691CC47379263F12AA35B19A76B2746470BA04FAE7BC77409B16F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976858, "uuid": "3e3dbaca-2378-4f01-afed-371f410926c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976858, "uuid": "3f56bfb2-4309-427f-915a-054462caf062", "value": "24576:mkWB+qNfp7ZPUGY/kJTTw/P7Qlz0aNwR5Xuw/7s5512h1pdbxBOu0pHTPXBs76NI:mb/f7hBBSzvbxBwwU5/yht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976858, "uuid": "effe03f5-2ebc-4205-a382-c899ec2e47db", "value": 2352640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976858, "uuid": "adeec31c-d746-4aa7-a28f-1c5ebbd505e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976858, "uuid": "3379561a-34d8-4416-85e1-204902ad7dd4", "value": "BE989FE7C9AD1C2969ADE36BEEFE518B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb037c4e-d022-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624013395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624013395, "uuid": "c92044c7-4d8c-4726-9327-46fa949e31f4", "comment": "Malware payload", "value": "688cba9c88f928b0cf854b43e97bec75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624013395, "uuid": "393feaa8-ce20-42cf-8bc6-27dca0e25e6d", "comment": "Malware payload", "value": "481509a67f836e3826fd7835cded0619a1491ed914152d893c6d8ac950445f4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624013395, "uuid": "2545533f-c47f-43ae-ac25-022040db56b2", "comment": "Malware payload", "value": "45a2b7e6c358018467e480e7b6324d1a305e0d24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624013395, "uuid": "0b19d28e-fc2d-4117-9e56-27e1dd7c0162", "comment": "Malware payload", "value": "c665ed61198765641ba7f52f9c0069409ab0d0c3b6eed1e1d1324e5897888c812f04be88208c508f2c4fc149df087c93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624013395, "uuid": "d9353d40-ae12-46b2-b389-81d511caef04", "value": "10F4BF21F9C68036D2B323B19E7EF76A963D66760326D2D727C82D315EB04416B29733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624013395, "uuid": "1b7bde3d-8390-4f00-8e6b-efcff685004d", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624013395, "uuid": "c0289fcf-5298-4101-9c3f-0cac5518de68", "value": "12288:0hkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aZ+u4L7v8MRv:MRmJkcoQricOIQxiZY1iaZB43LF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624013395, "uuid": "921a76f3-a952-439a-a624-ff69b4d4bb38", "value": 781376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624013395, "uuid": "8ccd35fc-f1b6-4137-86f0-7e6740d2d240", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624013395, "uuid": "cf3214d0-f188-4691-86ef-3e35843e280a", "value": "KarLocker_exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bda520-d02b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624017277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017277, "uuid": "ebab3395-a783-413c-ad41-68950bffe3ec", "comment": "Malware payload", "value": "17e775ff6009198ebf15f09307052d2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017277, "uuid": "bcc2c85f-2f64-4939-9fd1-ebd5773006b3", "comment": "Malware payload", "value": "48d959ee5bd2b6a1073f775a0cc6a7bca98bd433925e19bb25f997ed6d8eb288", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017277, "uuid": "40bc52c2-9545-4918-b6c3-0eab8b0bd6af", "comment": "Malware payload", "value": "9da0c3c5c06ac5a4870731f5c6831a165f0e8b02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017277, "uuid": "4208e69c-0f5d-467b-a4ad-2fb81bcebfe7", "comment": "Malware payload", "value": "aba055e5fde2e956106c656b16fc233f08ed2fb6c49bc19fa34d41011923966363c19148277e0304ded233179fbe57c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017277, "uuid": "76806a9f-e366-491c-b907-a847be9cba3e", "value": "3072D025A0E2936BF6A8C3799E682E931C71F73105A6D0063B0E5D174FC34382678FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017277, "uuid": "89bb3b4a-2bcb-460d-9f71-a91fcf77a5fc", "value": "384:MeqzoiAZtvz5dLeZE0utOLelelCVeeuduwRxZSMv1RT:ppZgZE0uR1vMZXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624017277, "uuid": "758519a8-a6ab-4f0c-9d23-bf7bb3e18b52", "value": 17280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624017277, "uuid": "d30df2bd-7214-4cb1-8c26-4b0c5d1ca62a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017277, "uuid": "b06317ad-9fa1-44e4-b14e-d9223801ca4b", "value": "Samael.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1edfd1e3-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623976975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976975, "uuid": "a946255d-ea6a-4f08-813f-e2d638bbb6d4", "comment": "Malware payload (NanoCore)", "value": "1b6e0098f67d09fdece599b84b7ccb25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976975, "uuid": "41f9da1c-8dc6-4e6a-993f-23b24cccdad1", "comment": "Malware payload (NanoCore)", "value": "49abcf0d1c7d7e842a7ef63b1be4173d37b24414ada511e21cf5643ca539d093", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976975, "uuid": "e74129d1-c829-498c-84ae-0071404787ee", "comment": "Malware payload (NanoCore)", "value": "11b88c89e5ba056e9df2c1147dd61ee4022f3f8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976975, "uuid": "74253d10-4878-4f85-95eb-6c011d80647c", "comment": "Malware payload (NanoCore)", "value": "6d6fece30ca7c8bf4941ca4120fd9641270d1d1710b1aaf166a6d0cb696dd0d623a27bb3e7b30d94c5f4451dba18aa2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976975, "uuid": "9924c4da-0f91-4a94-beb4-0d176ed68a22", "value": "B724CF167BE94A2FE2CE857E711112528378C2E399C3F3DF68D425B64B663E40A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976975, "uuid": "684c5336-a48e-457a-878a-6e630bb6431c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976975, "uuid": "88f775fa-b463-4b07-ab0f-843f53b0def6", "value": "3072:mzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIlPzQjSyYoPlnuAXUaZ5hqtlgx:mLV6Bta6dtJmakIM5Eotk4hqax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976975, "uuid": "6a8378e3-c111-4ec0-b67c-38f2f927a9c9", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976975, "uuid": "41fc45cf-7f57-47ac-9584-8e6613c4ee35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976975, "uuid": "75793d42-0c67-4b3a-9132-2af8b9ed9699", "value": "1B6E0098F67D09FDECE599B84B7CCB25.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e43648f-d026-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624014769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014769, "uuid": "6b42f73e-f1a8-4405-a8e0-e307fef42cc9", "comment": "Malware payload (Mirai)", "value": "0fde8061fc38d125985ea6939954d6ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014769, "uuid": "ea78fbd6-5e44-4a39-924b-cb8e8a4fe256", "comment": "Malware payload (Mirai)", "value": "4a4b8fdbe2cff3547e6d808226d34cf6059d9160326326d3b90d851e602035d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014769, "uuid": "b5864e03-84e9-4d27-9b94-9fc4d01b812b", "comment": "Malware payload (Mirai)", "value": "d63a8e55934effb65716268386c55c9f812bb33c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014769, "uuid": "6e39b4a9-1201-432a-87b5-59f40c47a06c", "comment": "Malware payload (Mirai)", "value": "03247ec2247c003761837727795df84892d31624aac98f65d0f92384a96ae7c9c8c93d7a2373344cd36378cf2268ed4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014769, "uuid": "e2b8d176-7a9c-4b3c-944f-5a93f2ff7d9e", "value": "4D434B5172280B17D0932A70353F4FD09BBEEAC025D4F686B99F9B968935D330546E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014769, "uuid": "f98b02a6-2b18-4b81-b90a-7dd75d9c4afa", "value": "768:zaVVRLWYgnvRYDCi1jAZZkXWob6quPdQ+NpiT+eN4j9qKnZY10USv:EVUv8CiN/WeTH4xVna10fv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624014769, "uuid": "e7a169c0-7d2f-42c8-a51c-c1e2acff1c64", "value": 55908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624014769, "uuid": "d2b45350-4134-4c80-b86c-09d0e2161b37", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014769, "uuid": "75e05538-db22-4c55-9990-1484b4f02385", "value": "0fde8061fc38d125985ea6939954d6ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d66b0d4-d077-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624049638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049638, "uuid": "27f7cda4-0c74-47a4-b31a-0e5ef7f205d1", "comment": "Malware payload", "value": "be07b6a30ace102214c8f7d8742cfcd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049638, "uuid": "4acb8bfc-b846-49d2-813e-0d77047cadaf", "comment": "Malware payload", "value": "4ba9d847f598add124d3b14f48d847665891fd6ec817e8f09bdf87dbb83acb0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049638, "uuid": "5a802e2a-c39c-4fab-a0c8-df83e29b585e", "comment": "Malware payload", "value": "137249e7b99db0208ba3777c053b810ef949c096", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049638, "uuid": "1a7ea232-7934-429e-82ca-5032f3dc08df", "comment": "Malware payload", "value": "6758a1fc4b8a0b54db21b2a9298452f9ed9c4ab2aa067a0387ec77c18f652b924226f04c8919fff292f55983d2246b44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049638, "uuid": "ddf326ad-7f4c-445a-bb8b-6fad4d848dd7", "value": "32E4CF243AEEA129F177EF795AE074D69BEFB6233702D45D289003870613E41DED163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049638, "uuid": "cd1e18c9-6910-4cf1-a3f0-9a0048b52b53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049638, "uuid": "4e2d9cc2-ac59-4e81-a45a-c214926da51e", "value": "12288:08Shlm4S4F3M9yGm2iNPWy6CLCcaCTJQbc+uwCIFw6wlaFGqQc1:0XWO19YMzabuwddP8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624049638, "uuid": "b2df6481-2f7d-4ac0-acbc-989d99f7f0f3", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624049638, "uuid": "96999110-0c6b-4080-8449-caa84e0d4f2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049638, "uuid": "600d42f5-6229-4af5-87fc-ffee34131e39", "value": "INQUIRY pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed4df33f-d026-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624015117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015117, "uuid": "8c02df59-204c-4d6a-82af-3e38fc66d117", "comment": "Malware payload (Mirai)", "value": "ee460d4e2b1469c0c8377d27035c347c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015117, "uuid": "05455bd7-0833-4540-9c93-9b433d29e396", "comment": "Malware payload (Mirai)", "value": "4bbf2dab9cce066bab887e0058150157f0417d6dceca64025ce2127a8eb584b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015117, "uuid": "40f4c72b-4f43-4d70-a64f-8d658423bd9c", "comment": "Malware payload (Mirai)", "value": "84058100f272e56a45a565ca785efbed4db080ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015117, "uuid": "4af65394-e47e-47c1-bb73-ef1b7b880ad6", "comment": "Malware payload (Mirai)", "value": "6f23cde08bdc24b4968bc3ff7c1de5c6f2336d47671027f2da6470611114ade6c136b959fdd311e3e46b8e8e6cb1706a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015117, "uuid": "af33b6a8-4379-4b01-b7f3-740775bcc373", "value": "B173D815FF651FB7D89BCC3309A81B0628CC665A22F93B267E34C918B54B15F19E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015117, "uuid": "3f38c08c-c695-462b-befa-6ef458dcdc84", "value": "768:lqwATxpQ5e+y4rGy5Y+ZDS/K9uee2etJeGK7d/kWzrXilvo2KXZY10Ut3:lCTxq55u0DS/K9f74JVCd/XJ26a10+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624015117, "uuid": "606b0749-1c39-4b0d-90b4-183cfe05fbb9", "value": 73596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624015117, "uuid": "e861d129-793b-493e-9c7d-73ce3f6e3e76", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015117, "uuid": "2525a9cb-fd7b-4e19-a711-b08988519d8d", "value": "ee460d4e2b1469c0c8377d27035c347c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7b30cd-d00f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624004942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004942, "uuid": "d986a850-570d-4767-98e9-9845e8f2c86b", "comment": "Malware payload (RedLineStealer)", "value": "0db483b7dcecb0c1e919849e83bbe6c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004942, "uuid": "06a3491e-a663-4814-bc8f-12cb98694623", "comment": "Malware payload (RedLineStealer)", "value": "4c75a3d53a3cf2389708c869393e8edb34a817be9505b6feaac2e8f495d1c7f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004942, "uuid": "cf7b51b4-37db-447d-a432-da361c928d2a", "comment": "Malware payload (RedLineStealer)", "value": "3619dc78eccf8c4576a1bdc89c13c8614c393ee7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004942, "uuid": "9ca7a8f3-abff-4dd5-ab8b-dd3114b9e6a8", "comment": "Malware payload (RedLineStealer)", "value": "600bad9105b4fe2c342839bde9c10825bff83d0eb28b915416a0be9de2304404d77a1ea773408430698802486c868cf4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004942, "uuid": "c5c05208-8397-40ed-b286-e0d748721750", "value": "63849D11A7B0C034E6F213B49A7982F9952E7DA07BE490CF72D527EA6674AE0DD30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004942, "uuid": "a04b7af9-8379-453d-b45d-401a2482fdf1", "value": "8b2fca54d55baca0ec5c91e48a9328a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004942, "uuid": "e5c4fc55-50b8-40b0-8c09-27d7d6e9148c", "value": "6144:O8K4jPZPQSOyOekI7VZUD/k+KxIapXidiZSftRfgp/xDcOhdE2piR:O8K4jPZ4SOyO2VgExLIicvgBRXYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624004942, "uuid": "f6dbea97-33fc-464e-8bfa-cfa4d368b2e5", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624004942, "uuid": "e2a7de17-39e9-4250-b47d-2d7051466186", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004942, "uuid": "5518de82-093f-424b-af7c-30d05b0a71e3", "value": "0db483b7dcecb0c1e919849e83bbe6c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15a4752-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623976898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976898, "uuid": "6e12106a-9875-4c36-aa0d-18cf7248ab0c", "comment": "Malware payload (RemcosRAT)", "value": "e10e97b2bed5c11cf9b2bdd523f88855", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976898, "uuid": "3b02bc15-6071-43e2-9a74-66803a1f8bdb", "comment": "Malware payload (RemcosRAT)", "value": "4cff4b2d2ec7a93a5bc6e3a6e1f82524ea97a0f910099013b68d0561ba3ba9e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976898, "uuid": "ec9a2f89-64c9-4932-bc54-15049bdfc7ba", "comment": "Malware payload (RemcosRAT)", "value": "44c6b9609ee29134c566b93bfd121fd7de4af6c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976898, "uuid": "43c3b486-9607-471d-b17f-61ce46b18efa", "comment": "Malware payload (RemcosRAT)", "value": "c51934864e95cb73939e659afb5738baee87232837ead3d0fd23d0ad89b7e0b77ac31a72524ac030e5c91e4e0f99a917", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976898, "uuid": "1bb9d94f-107f-46e1-8319-0ee4103b3872", "value": "5D941246F7871861E8960A3125BBCD004B30BF19AB53D17B76A871274FB338F62E8659", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976898, "uuid": "35ab762a-ee92-45af-b3cd-f76002efcb09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976898, "uuid": "3b0c9711-9b3e-46ae-a3c4-56f905dc5ac8", "value": "12288:ZWzmsLUqR0w/6yFXCWZAv88fWOQeYnghAH:XqeYfCdWrebU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976898, "uuid": "1ed51499-7ced-44f2-a9d2-314126d8cd47", "value": 411472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976898, "uuid": "c94fc274-7932-4acf-9b37-8cda782c15cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976898, "uuid": "03faff2c-be8e-4c14-8db2-b20d0bfca9c8", "value": "doc2198754329.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67ac12d-d006-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624001281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001281, "uuid": "f3b71e5a-fc1e-4686-8adf-7d7fb5913d0f", "comment": "Malware payload (Formbook)", "value": "d5c827c1ba5352ecbb2f58dd7a2e75b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001281, "uuid": "c4e04628-749f-49ce-95b9-58cd7ca04bc9", "comment": "Malware payload (Formbook)", "value": "4d2ca668cdde851a6389ee4d0fb089d3e125e2d951dbd7201767174ecafa66ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001281, "uuid": "d0e859b0-e47b-4e2d-bd37-e87bdae6918d", "comment": "Malware payload (Formbook)", "value": "84d008063ec1540bdb1193fa23a7fb2850fb5087", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001281, "uuid": "8dbe9a56-d490-456d-a240-5bd8f840640b", "comment": "Malware payload (Formbook)", "value": "fc00d95f4821551251601905660fb7788635ca7974b1aa2a18972ba46136f322c343031b3534dfe2a81e94c5a3d41f3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001281, "uuid": "44e0f4c2-4c72-43b0-b431-93606c79e3f0", "value": "CB34126162C41897E9A8423218B7C975C3B2AE113B245A4B634BFF177B373C3864F596", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001281, "uuid": "7bbb881f-da00-4c6c-9736-02bbed10f2f9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001281, "uuid": "6cf1bd7e-22ce-45a4-ad70-030571a5b4a0", "value": "6144:eQqent4tsIdkxgO2WMXqdlv4nqCaKUEBqYet:lnODkVMYwxUMqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624001281, "uuid": "4459d731-3f59-42dd-b7ad-e3a0ede48e75", "value": 252045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624001281, "uuid": "d6c78af2-1c79-489f-b5f7-3c931adb63b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001281, "uuid": "b604c930-3dc3-4656-aaca-d36c08751670", "value": "20210617_0001inquiryNew.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fd68d7-cffe-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623997608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997608, "uuid": "83940d71-07f7-4ae3-b6de-1296946143ff", "comment": "Malware payload (GuLoader)", "value": "db3df8b62eb38c897519e028ae913766", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997608, "uuid": "810c3518-4078-4876-8fb1-3a51a2d97d8e", "comment": "Malware payload (GuLoader)", "value": "4d606e6794245736c4d48f1e7faf4aa3fa9bc5325174d3108ba9995a3fc76ca2", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997608, "uuid": "a0872c91-02b1-4701-8942-0e3e27c1c30f", "comment": "Malware payload (GuLoader)", "value": "c68b369981ec4ef973805178f0ad931be5d67fcb", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997608, "uuid": "03b225d3-907f-4238-ad18-bc7ca81ca3d2", "comment": "Malware payload (GuLoader)", "value": "59e0d244a482d42a24606e990eba9bfb250821f8812ba3f90b1e12a1781043830ca27bb042c41947b2376f528ffa24b5", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997608, "uuid": "0e9cd15a-ba4f-4572-812b-9f7c9edcb488", "value": "2A652326BEA31F26C94BF174885BF4A4013C6C067648D94B3E6A778670B58F213E3B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997608, "uuid": "e9e7d6bc-a075-4eb2-add7-473cbcda1648", "value": "24576:vPYsxxCgBN8KoddkvcSzXszlN86/yyDnDdbRPnBFmdBaaT+RMKO1E2:vPYwxqKoddGXTszv8oDDXBkdAS+6pK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997608, "uuid": "41f9a5c0-7d56-4dc2-88ae-532bcb622122", "value": 1472000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997608, "uuid": "bfc12316-dcb3-4d73-bba2-db0725816f52", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997608, "uuid": "21304e73-be26-4d4c-8caa-d5702d871540", "value": "Masterfoods Offer Pricelist.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fb39fa9-d008-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624001941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001941, "uuid": "36a0e022-0da9-4ccb-80c8-75488fa06c16", "comment": "Malware payload (AgentTesla)", "value": "7a4bc39ba2e82f3bc8b8775d11113cf0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001941, "uuid": "aa2b021f-51f9-458f-9760-30fe91d9ed25", "comment": "Malware payload (AgentTesla)", "value": "4de5177f7651864b9d1c8c58e68a7c1204cbeea314d951f45876edaabfdff114", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001941, "uuid": "e25d9c9d-78c1-4cea-ac3f-be87a934a091", "comment": "Malware payload (AgentTesla)", "value": "d08afc7d7c978ab6569dc0b163e1e28d9a496445", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001941, "uuid": "6893386f-1639-4b78-a780-6854833f7024", "comment": "Malware payload (AgentTesla)", "value": "1198bf325c350ae7f7ad35abec19f4117926970870c9bbe6ae3b6321ffaf72d2ed0fd09b1597dc9c787138dddeca75a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001941, "uuid": "b8af8774-a2fa-427b-aca0-db0e004fffc6", "value": "57E4CF343AEE6129F177EF795AE47486AAEFF7233703D45D289103870612A81CDD163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001941, "uuid": "735cf014-00f3-497b-9ffd-654fb0624e83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001941, "uuid": "f646c52e-daef-4b11-ab4c-e41a92d1041f", "value": "12288:cIOhlm4S4F3M9yOm2iNNsAFDO+UwKYyDRTHS1w8EHhlXCtcRMRI2KQc1:c/Wu1/sARLKY0lSi8ulStZRI2KQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624001941, "uuid": "195ce3fc-cf13-498d-ba35-fdfb45986373", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624001941, "uuid": "05d2b03a-323b-4776-a664-18b9363ac550", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001941, "uuid": "bfc23e36-fd27-424a-83ef-be03a0c1cbe1", "value": "7a4bc39ba2e82f3bc8b8775d11113cf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f631f350-d034-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624021145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021145, "uuid": "7edfea73-cf8a-48a3-9bde-ebf87b04d704", "comment": "Malware payload (AgentTesla)", "value": "d52eb45bf3b2fa72269638a47a5a9a3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021145, "uuid": "9edc204d-6aef-40fd-8b92-ee94f6b129da", "comment": "Malware payload (AgentTesla)", "value": "4e3336ac65338e996108c4baad206618fc9b506f80c07bbfb85df2d65b9e811f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021145, "uuid": "d77b5ed6-cf23-4c9a-8ba2-2a5c839d826e", "comment": "Malware payload (AgentTesla)", "value": "0aa5c6c85c8dbc674337b15f2b18acf36340ff3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021145, "uuid": "48bcb2ef-0bd6-41d8-8f5f-96a7b21e4509", "comment": "Malware payload (AgentTesla)", "value": "d27c2781bf7e3e5b68ef237e9e84b9445885a8417ee213ae33571ee1ed114245ee8a1adc4148c70e6222bff343c9aded", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021145, "uuid": "ad08bf20-8b5f-4a85-9c73-31740b3b4418", "value": "B0258B9D761072EFC857D4729EA82C68EA507C7B931F5203902335ADAA7D887DF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021145, "uuid": "081af305-deef-412c-83f1-0a961abc1c6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021145, "uuid": "81511376-49a2-4695-a5b1-e19434f4beb8", "value": "12288:h0jAQV5RRSvzMUWUe5VAiS7p2Q8Ixnglr8CZjkhUM6SD/yPq91b6+FvOVQhGkvCg:ajA4GdWUuXz8U7W6SD/yPqDMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624021145, "uuid": "12e7cf8c-41db-4a41-8068-6d0d445a773f", "value": 984064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624021145, "uuid": "21db955e-ac18-40a3-9823-3e571fd9fd61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021145, "uuid": "ec58ff52-de86-43a6-b8dd-bf812562a0a6", "value": "SecuriteInfo.com.generic.ml.8805.18863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da40e9f4-cffd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623997476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997476, "uuid": "a9e1d7df-5f09-4915-aba4-c5800a936d5c", "comment": "Malware payload (AgentTesla)", "value": "a38b8b30a316940018fe1d0277beaa7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997476, "uuid": "cfb3bb11-9781-42e3-a33a-8d28a22b806a", "comment": "Malware payload (AgentTesla)", "value": "4e4e2bfa30b8d08348828325b4b5d75615cbcac258ce8bd65227ff94a31b22dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997476, "uuid": "2e26b0b3-6a0d-4800-b84b-c25e9e35d032", "comment": "Malware payload (AgentTesla)", "value": "970fdcf8fb5df41ce74e18c1c38d3b8e0b31de39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997476, "uuid": "0c9d498f-4d13-4999-a7ad-79e62c410629", "comment": "Malware payload (AgentTesla)", "value": "b2797770837454936d487c60eefd9017931bfa9fddc7828dae6c075ec7ed1c92153a6ddb6c02f464f8369532db15b774", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997476, "uuid": "a566638a-3f8e-412a-bbc5-b5acecb457f1", "value": "BB26BFB876047DE6266F576BDA96ACDD03B617239ACBA4CC80647BC305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997476, "uuid": "77048e76-3735-42e4-9e3f-b298666364ea", "value": "24576:KPWUE+GdtNFCF0ESaWFwqMCziCV4gOKMYfzLxI1zTZpAt3EyO3n3vvZozVwPhGgZ:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997476, "uuid": "e650f89e-0d01-4b20-bd80-430d5696494b", "value": 4745119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997476, "uuid": "d71c2b8d-f0d6-4341-9408-43ee249549ae", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997476, "uuid": "d35da814-15bf-4c65-b30d-3ee28ca2e0d5", "value": "IMG-21U776777.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bea105-cffc-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623996981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996981, "uuid": "637c0bfb-9c8f-4249-b287-1abcdb486bbf", "comment": "Malware payload (RedLineStealer)", "value": "168c4531cbf3080d1d8345a7da003a5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996981, "uuid": "ed7f3263-39c3-400a-b71d-8c15dace2c12", "comment": "Malware payload (RedLineStealer)", "value": "4e531a590ed1caba1a30b5f7affa7d23a12766a251774b412a91295a8367aff2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996981, "uuid": "7be9b4e2-6ab1-4b41-94db-01b19768c13c", "comment": "Malware payload (RedLineStealer)", "value": "7703cdd20377847e2135abda03f3d7dca78d4ff8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996981, "uuid": "ee2c71d3-c093-4483-9f29-2604678b3bcf", "comment": "Malware payload (RedLineStealer)", "value": "a33b4d35bfef6d4ead9bdacd006cb20a3865d5dc6790b66aa0109a85cca07993e201e5c1f8d32314170c83652306f86a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996981, "uuid": "2cecb0c8-92fa-45c5-8e3c-afa479caf6e1", "value": "A055CF2E5ECF8A99C2650875DF36AC0682725D992515E3133ED831ADDD333EEE8AF101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996981, "uuid": "052687f9-b68f-4216-ae5a-dcfb7fa6e98a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996981, "uuid": "190b25b4-4a10-4b52-8369-ecf389f10393", "value": "12288:KsZZDDoanlXAwOvcksDK/qwUi6vSMPQipP53w9OCOE+G7ejsMVX2esYbTNj2bBpT:xDDoan9HduCByipZW6jYvqx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623996981, "uuid": "c81ccc82-115f-4642-b5d3-a54e9e93861c", "value": 1293824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623996981, "uuid": "8d16511a-1bb8-4fe9-91bf-1152e95a78ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996981, "uuid": "12106194-9401-467a-8739-287ad127c5f4", "value": "168c4531cbf3080d1d8345a7da003a5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302919f9-d035-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624021242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021242, "uuid": "35fb7e59-4b0a-4d74-80a2-0338d3612c86", "comment": "Malware payload (Formbook)", "value": "bba5925c15ca893b2da71d36bf5f15aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021242, "uuid": "a55243fa-94aa-4332-a984-364c57e4a1fb", "comment": "Malware payload (Formbook)", "value": "52208fdea02024ab93aebbc72f62d3b105644d5afcb4d8de494f001f87a03a9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021242, "uuid": "23210c81-cc64-4738-b951-9b11da0b818c", "comment": "Malware payload (Formbook)", "value": "8157438b8b78c7158986731cd85c141d7ac93628", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021242, "uuid": "213c6b39-848d-4e3d-83fe-1e8754103a52", "comment": "Malware payload (Formbook)", "value": "335af33ba56cc54eeaccf2a19f3b8e8ee6350404944df6f2860178a64462bebdbda098dec88d7965acd1d0dcac774f67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021242, "uuid": "2692f869-42c7-4369-b4df-feac64d3f80c", "value": "AF84E561657195C1DADD08F30E0CF71CDD53B62A1C8F3682E2BF1B19F2221B1A72D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021242, "uuid": "d6219f7d-654b-4522-beeb-a4b55330c5de", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021242, "uuid": "4dee823e-9d25-41ae-a6b2-71b9fc9859d2", "value": "6144:jBlL/Cd41e69DouJD1p3j3YDI1aU8MV37SDS3dhV/qwX:1kxu/p3j3YEIU8o3viA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624021242, "uuid": "5a068dba-bcec-439d-9917-1e1ce0993796", "value": 400250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624021242, "uuid": "2a0eab69-352b-4c36-b051-95d91f8a49c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021242, "uuid": "08124d76-4bfd-428e-a0bb-ed32371875a9", "value": "Img-347654566091235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac39f423-d031-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624019732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019732, "uuid": "9fdb94e0-f878-4cd4-a4c5-af371211729b", "comment": "Malware payload (SnakeKeylogger)", "value": "df6e05150232b27c424b0e7813487491", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019732, "uuid": "7869707b-cdbc-4efa-8282-859ec494b855", "comment": "Malware payload (SnakeKeylogger)", "value": "52309c4bfd0f4a78a05edff800c412760c488ef60f6709f6f9038dc1f315f17a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019732, "uuid": "6faef8b1-ca94-407c-868b-4682fe973b5c", "comment": "Malware payload (SnakeKeylogger)", "value": "345a18019391a7d530628a55c2f1bd8379ef0ad5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019732, "uuid": "6f3fcde4-a7c8-4768-8ddb-28209b3bf8b3", "comment": "Malware payload (SnakeKeylogger)", "value": "7563dde7d6feeea7b40d8ee86ce11da590c6aa400f0572d0684bff194d4988a15211ef54dbd1cab077536f146f6ec908", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019732, "uuid": "a0e501ba-3fa1-419d-afe0-949a556210a1", "value": "AD740125721FA091E5C16A76E5E54130CAB3DF007C0FB51A14C9BE24FAB3B991B84BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019732, "uuid": "f42a6d19-6598-4e91-a15f-bb737cd00a86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019732, "uuid": "1cc5003a-47cc-46c6-beb0-034946cec561", "value": "6144:2ZSlFDj0k3aL0kMaHF8tg5U+PX+aXTaUlAx7KSPMvJJ5UPU1:5lFcvM8yS5U2Bjq0vJUU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624019732, "uuid": "49ab33d8-62c3-4e70-83f8-ecebcb8687b4", "value": 366576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624019732, "uuid": "500cf964-9018-4164-84db-66246e1b33e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019732, "uuid": "bba51be2-00af-437f-95e2-dcd4e0914396", "value": "df6e05150232b27c424b0e7813487491.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2465559a-cffe-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623997600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997600, "uuid": "720eef64-887d-40a8-a6bf-861e9861a09a", "comment": "Malware payload", "value": "ca7fcfefb7df4968331cfc4f47702851", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997600, "uuid": "0314e6f4-13b1-4303-95a5-044db91cc8cb", "comment": "Malware payload", "value": "53cb7a3ffb08c981ec11ea164f6cb47daf3c7e1ee2616f1f57d01c95d64e24b9", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997600, "uuid": "cc139dbf-ad36-449c-84ba-93c623d6b29a", "comment": "Malware payload", "value": "10b920058589bac4f8d97453128c0b11c992c7fb", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997600, "uuid": "78d61fa3-9fb2-4e5d-b587-59364b98b163", "comment": "Malware payload", "value": "5d6d77e07b3ba592c242856966521c0b8ee43454953e3bc930b45710481ee697cdd1d94f795e566f9d05c0220818d722", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997600, "uuid": "926cfe1f-dbdd-44a4-8ec0-59541b39afbe", "value": "FD652341B8E64F23F20ED97E0775C1B96070BD45B52D872A22FA3A04F1325F2B6962DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997600, "uuid": "bc600836-f70e-40b8-8912-f4f804d1fd36", "value": "24576:mXcdSx+TRaQulQcJOIBnH3362uOxoFW25lrEuSTQD44Fk0QccsVTxKypkllwGRKj:mFxERaxhOIBHn62uQMB5VEuS+pk0HVT9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997600, "uuid": "f88eeb32-362a-42e2-9f3e-6890ec08a7c9", "value": 1414656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997600, "uuid": "88e49236-227d-4b60-93d6-9c26d5899052", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997600, "uuid": "93625416-bda8-464b-8aa8-53b4f9a12297", "value": "Compliance Information.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310365d4-d00f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624004923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004923, "uuid": "abc317f7-dc2a-44b9-859e-56bbd52e5ee5", "comment": "Malware payload (RedLineStealer)", "value": "b645a39ae4733e5f078b84291876fc2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004923, "uuid": "09b22704-b85d-4ae5-9b4c-39a42c76eb34", "comment": "Malware payload (RedLineStealer)", "value": "554280d027e0ca9fac59307569a6352f04371cb55b35301b0a9432069ffc82c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004923, "uuid": "d2deb9a0-beb7-414c-8b18-93c5b777426f", "comment": "Malware payload (RedLineStealer)", "value": "964d5aeaedff24570208f779de91c974965a8c9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004923, "uuid": "64142391-636f-49a0-b4ab-986232751da2", "comment": "Malware payload (RedLineStealer)", "value": "10c3fc78fcdedc0d3fb72e0b4b4f8dcc4e16484ae3a7f20882bba168d181552093ca281ffd02ee7b2a43274900aa3513", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004923, "uuid": "d0589fd3-9265-4d9a-994b-d3404da79f7e", "value": "9DC53311F65B1FE6EA270834E1DBC57144304E3BBA96005B3C2DBE473AB176360ADB99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004923, "uuid": "62784f18-67b0-4d43-b201-a0729c15433e", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004923, "uuid": "45c4e079-9cf8-45e2-bfa5-a59bc2093190", "value": "49152:RPkLkKpmd9zUHA9W8/rU/oqUtjocBgWaS2kjM+IWEJt9gXWGGQ5:RGkqmdNUHA95/rU/oZJoci36VITJbG35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624004923, "uuid": "9a4adf8d-42a6-4d64-bea9-5e3acdcf4d06", "value": 2631047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624004923, "uuid": "dcd73372-a842-4f7d-855c-eed85bfd854f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004923, "uuid": "4d4f3447-45da-4b65-8eb6-e62b4b3220bd", "value": "b645a39ae4733e5f078b84291876fc2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105e3d2c-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623976950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976950, "uuid": "49d01872-9f41-475c-ab87-852720f721c1", "comment": "Malware payload (RedLineStealer)", "value": "53a3b795288f93eb3bf0a1b6be6f0e30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976950, "uuid": "2cfa2895-2b2f-43ca-bf16-d5c64bfefb4e", "comment": "Malware payload (RedLineStealer)", "value": "583d46b7751755744e80dd76654a05d021a187d7f9da495b4a75529d9e03f3c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976950, "uuid": "dc96e65f-7763-447d-913d-346e7ba5377e", "comment": "Malware payload (RedLineStealer)", "value": "13a5518527002498c953ab1006ecf0f5df941bf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976950, "uuid": "315e313e-174c-4553-ae90-2d5dd92191df", "comment": "Malware payload (RedLineStealer)", "value": "cf9547c99795848f050fec92ff42487d7d9b762b7fe8dd0e25126ad5b4e2909d04bd03049b51ade4027ec15a82da5dc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976950, "uuid": "400e3ab6-bac1-4c2e-a9d9-8fc686a80db4", "value": "33651201FEC199B2D6612D3524696B256539BC300F24DFEFA3E05A1EEA711D0EB30B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976950, "uuid": "936e66d2-86e5-4f2e-9dc6-c027686bb5ea", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976950, "uuid": "532b5329-8a3b-43b4-99cb-6378647b29be", "value": "24576:yhvJVJdMf0xFKAyiPUcFxR47kJ7ZpC2zM3EUyj3SxxMnS4sDG7p:C3dVK1iPZ87kJ7Zs2Y3RK3wMnS437p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976950, "uuid": "2e9a34a4-982f-4cde-99db-1b007692b943", "value": 1486751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976950, "uuid": "6a8ea0a2-2699-4e9c-8268-41a3a84659a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976950, "uuid": "2068832a-81bb-42a5-9304-febc17bbf7f0", "value": "53A3B795288F93EB3BF0A1B6BE6F0E30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3a50cd-d077-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624049820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049820, "uuid": "c1c012b0-f79f-473c-8b21-20077f37b6ff", "comment": "Malware payload (Mirai)", "value": "5ecb0b070719fc4df478c837c11651bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049820, "uuid": "25c29a70-dc0e-4d97-a44c-c85b328c6892", "comment": "Malware payload (Mirai)", "value": "58a5bba86e3dbd0ee2214c5ccebcec6db260d63fd5a839f538ff0a2eb9611aa9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049820, "uuid": "4955369b-eb5a-4939-a323-28e7cd9a4c6f", "comment": "Malware payload (Mirai)", "value": "e63eacd78e5139f3491b09424c8ab5ef2e057e67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049820, "uuid": "71540e66-5b5d-489b-b7cc-00e4b19070ff", "comment": "Malware payload (Mirai)", "value": "c28c1b4ecb3be61233e0d7331f5ed3a4bd24e00c7068bfa666c90e9795e92c9f393677c761fa5e26a29dea6443318243", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049820, "uuid": "0808c856-847f-4d28-b1c4-1f173e19e0cf", "value": "88E3E6057B140EF7EC9BCC7B45E52B09189D282A61DAAF36F934D954B40B21B3AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049820, "uuid": "d00a921b-64ab-4184-8b1f-fa72d3323546", "value": "3072:xU8Fu4JMOU0zignkDtDC/NESyQyiMEqmAj2:xU8Fu0MOU0zignkDtDC/NESyQyiMEqJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624049820, "uuid": "b36c74a2-a43b-4915-a8ef-15ac0b59f25c", "value": 152568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624049820, "uuid": "6b082c57-0311-4c6b-abcf-ab24f3220ed1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049820, "uuid": "2bddb8cc-6076-4e2a-8eef-eed6972b3814", "value": "5ecb0b070719fc4df478c837c11651bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789a3689-d001-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1623999030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999030, "uuid": "6059040f-ddb0-4249-9b3d-b9be2bda447c", "comment": "Malware payload (CobaltStrike)", "value": "117da57c303d0d162128edf0be7f16f4", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999030, "uuid": "a358d013-7af3-44b8-834a-d52fc984ff90", "comment": "Malware payload (CobaltStrike)", "value": "5989662a18dd6cb3f32ec2882e9318d7cb7f8d0a800d441ee6bd94004b7a3182", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999030, "uuid": "50780692-5bff-4522-8bb7-366660550a24", "comment": "Malware payload (CobaltStrike)", "value": "936f44bd9b1e50ff733dfb68aab80a9cb4968987", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999030, "uuid": "400261be-81ff-416f-8381-3c7e1abedd33", "comment": "Malware payload (CobaltStrike)", "value": "032b781747bae142f829efe054937d1fc28f6eb74767f8e9341887c5e3c83ddf8a3f7501e53bcc91296f654eba7bae3a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999030, "uuid": "ae516762-7865-4f8d-97db-af4361b1dbe1", "value": "C234AEA13584D037D0570479524BC77E5EB9FDF417B19483BF841AA6AE713A3EB2A203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999030, "uuid": "d9091876-ff0c-4f68-a779-6c3c288f87c5", "value": "f2e0b7b9a08bd8dcaf133d9278ecdb47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999030, "uuid": "160bb85c-0c9b-455c-b9e4-ac7c25fc4898", "value": "3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15ad+8gY9UU:PjdFKdoSxvixTxUAz/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623999030, "uuid": "b525dff1-b920-42d0-8375-130085b6bfde", "value": 238485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623999030, "uuid": "20bf58fd-17e0-40f6-8d7c-181089cebfc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999030, "uuid": "d182999c-cbc8-452a-b465-fc5bb1acf68c", "value": "5e58cee0-a705-4df0-a11d-330db841aac8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc03f290-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623976916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976916, "uuid": "7ded7111-ca41-4418-b9cd-67ffff19bdc1", "comment": "Malware payload (DCRat)", "value": "fb6b0209b4bec3f5b2c3b14cae550fc7", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976916, "uuid": "0c09d281-f604-4fe5-9f75-43ac203b3884", "comment": "Malware payload (DCRat)", "value": "5ad94a2ffa3e6b23061e726ce0c09648811c4294f048d2cddc65ecbdf29c743b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976916, "uuid": "d64d64cc-6c3f-4e4b-a48f-86e546c450f7", "comment": "Malware payload (DCRat)", "value": "04f43de1a7f64c1a58b4ac8655145395025962e6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976916, "uuid": "971349f0-9a49-4499-a9ac-31361beccadb", "comment": "Malware payload (DCRat)", "value": "af0c5e94264d8cbb9715faba9d4357f025bfc1c919b82eccd04d0c722e20e3a85dc5d8ca3609d32ef0c6727e3be50182", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976916, "uuid": "4fe8c1b7-14b2-4fc8-ad4d-027065ae6a90", "value": "10257D127A8ACD11C479563ADBEF852447BCFD207B26C71B7E9B726CA8113924D0D3CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976916, "uuid": "d6d0430d-d8c8-4c07-bc5f-bcc107e0fe9d", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976916, "uuid": "418a50ba-7b0a-459e-b59a-59f5c1bb4c01", "value": "12288:aRZ+IoG/n9IQxW3OBsee2X+t4RbPJFO8El3YtO/JFm+WCq1QwH0Z4qnD:U2G/nvxW3Ww0txFilIERF32q4+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976916, "uuid": "ce449de2-8783-472b-a50a-f0dc6a92a8d5", "value": 965288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976916, "uuid": "d7233ff1-3f7f-4fcb-a4b2-418617cf3e20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976916, "uuid": "f6326601-8783-439a-a66d-0f3965c9c5e3", "value": "5AD94A2FFA3E6B23061E726CE0C09648811C4294F048D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "041a1ac4-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623976930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976930, "uuid": "d390dcad-63b6-4291-ae92-a9cd6952ce06", "comment": "Malware payload (RedLineStealer)", "value": "6d9644109985f4af2829a72e4cdc06c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976930, "uuid": "cb1acc3f-84bc-442b-ba61-96073c2d8b25", "comment": "Malware payload (RedLineStealer)", "value": "5b16a59067fef18b059fb3319a18b9073082746ba65946d4b66a527ccea9437c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976930, "uuid": "42e51bbe-c9ce-406c-b7b2-998744ad96ec", "comment": "Malware payload (RedLineStealer)", "value": "e6d9f694f1ee1f90a407a51d9df903c6528bd411", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976930, "uuid": "6a0081f1-3dfc-4a2d-a781-f1202b193360", "comment": "Malware payload (RedLineStealer)", "value": "0c4bc8b01f3a157bdb12fde32f3f80c3c658c8ae34f144470c6a9ab62e518ea02bf0174274145e5bf3eec998b4413371", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976930, "uuid": "348714af-79ea-4bfa-b2b2-664d70ce812e", "value": "1955504663815F40C8CD45BEEAA39F240E92EF37BD22C5D72D81FD89367221D78161AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976930, "uuid": "a6166fba-a02b-48af-b16b-fd291efa6ee6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976930, "uuid": "1b4b5de7-530a-42c0-8797-bc3d416c9636", "value": "12288:cTyS6RPS+gkQexbNIoUVl281T12+FMy2R9So:FS6To+bizTFTc+U9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976930, "uuid": "2dc035b1-9827-47a4-8148-a2b3a0c12c93", "value": 1283303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976930, "uuid": "c32cbc7e-78d9-4913-b356-9c2cab3c246e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976930, "uuid": "70bf8d4f-e389-420d-aedd-3f6c2055cc6e", "value": "6d9644109985f4af2829a72e4cdc06c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a474f2-cffc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623997037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997037, "uuid": "612148bf-f967-47ba-8be8-c070820de187", "comment": "Malware payload", "value": "4096b21706943c1161be6e3c62b3f71f", "object_relation": "md5", "Tag": [ { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997037, "uuid": "4743e812-d661-4abd-b041-104229725ce0", "comment": "Malware payload", "value": "5b346a7d5fff43f0ba8b75967b189d8b73275ff901a31d65c3c57f5ea4d8627a", "object_relation": "sha256", "Tag": [ { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997037, "uuid": "3fca45ca-16da-4b3f-9b25-8e8b1ef4bfb7", "comment": "Malware payload", "value": "45507374bd3abe198017d4707e4ef1881a8998fd", "object_relation": "sha1", "Tag": [ { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997037, "uuid": "483d0f9f-f0c6-4c89-aa87-610eaba4443e", "comment": "Malware payload", "value": "74e983c72e494e024382ee4d4de205868f0c90ffc5847e0c366255bfaf5adbfd80ab4f0bc23da9411c8b8ea2318ea9bb", "object_relation": "sha3-384", "Tag": [ { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997037, "uuid": "dd2a6333-7768-4d19-ac2d-b74bce001b78", "value": "BFC53303F3D792BD4F146E25574B0FB85A44EAF90601742E254ECBD0EB29ACA5A3B50B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997037, "uuid": "dd653fa5-0c43-42f8-9e58-a61bb934c528", "value": "49152:0wbaYTIbWvYT7mk/KmQ8H0IJCF6yTZS/sM6B0tTmJjmQK5Uwm4:TbJGWv2yiKmQ8HjZyTM/YUmJyn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997037, "uuid": "e2df6912-dafa-481b-8aa0-0e611e566ec2", "value": 2722340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997037, "uuid": "0f6c6be3-5699-4f1a-b411-5eb99c127142", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997037, "uuid": "7e7a6eb5-35b6-4761-aa5d-02696936e7a4", "value": "Debito pp4sfuzzh oj9y40u7i2 .zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84b3b8d-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1623976883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976883, "uuid": "142bfb6c-874a-4c3c-9b9e-44e285475a21", "comment": "Malware payload (BitRAT)", "value": "f842edf85d93b1ff71eaf89a1e8bbbe5", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976883, "uuid": "453c3c4a-01e5-4bf0-abae-20c44d0e8202", "comment": "Malware payload (BitRAT)", "value": "5c62d8294633b621c71139a132c45cf2d8293ae8012cbb6b20fddc9c3b10860e", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976883, "uuid": "b50f1fb3-2fea-477f-8795-6c0b105b7178", "comment": "Malware payload (BitRAT)", "value": "31efaa60b97b557f97dc0b964f47fb83bb06ab91", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976883, "uuid": "0b868e19-8918-4e40-8f60-d55b4ce84179", "comment": "Malware payload (BitRAT)", "value": "47597103517b35823516064a007a910e8d4aec09e81fc4ab0def9cf0b1f6866bb46cb1a2306fe244857b2aca586180fe", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976883, "uuid": "7cdeaf9c-21c2-4789-a1f8-46cd00975600", "value": "FEE533AB054AE272DEEB993CE14BDBDFC247E60822444B08A77473E4FF65198C1DB464", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976883, "uuid": "ee719291-28bc-4540-a852-f1305c97506b", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976883, "uuid": "8288845c-6682-4295-9c91-b32ef500adc5", "value": "49152:ToKD70qvoJZ7MOcmZ+kBrMXKTEoTxm3Owhastf04nL5boo5diRm4mNj0QMjdW:TVALdZ7BgXKTt7kVVL5xZ4d5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976883, "uuid": "f7233bb0-69f5-4142-9d6a-649bd116c27e", "value": 3061423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976883, "uuid": "deb887d2-4c2a-4483-b4db-4728b6daafaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976883, "uuid": "9d5ffcaa-3e84-4576-8581-42ed8d6e1da5", "value": "F842EDF85D93B1FF71EAF89A1E8BBBE5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9d6ce50-d05a-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624037472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037472, "uuid": "8d145d7d-5156-435a-8427-d7068d8e9317", "comment": "Malware payload (AsyncRAT)", "value": "05633f6a8c4a6d559ccb685defee2536", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037472, "uuid": "ec9537c1-6599-403d-80e5-1a7b090b994b", "comment": "Malware payload (AsyncRAT)", "value": "5daa9778dfb519ba90dad3efee459411b7c7c1abbd7f9c4b4f2eff69e1099e85", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037472, "uuid": "41a0b8c8-0b6b-416a-b5b8-6471ad13069a", "comment": "Malware payload (AsyncRAT)", "value": "48b22524d4fd5a6b6a68fef86a88d24dec56e6e2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037472, "uuid": "bb988e88-0e2e-4bb8-8172-880bf9e51e9d", "comment": "Malware payload (AsyncRAT)", "value": "4d0f00ddbbc5f0a622e160209485b73ae37697f603758a2cdd170c7f14eae8e71cd2011239a1cf35d23b08f790a0f14b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037472, "uuid": "7af50f34-f8e7-42bc-9f3f-c437adad0707", "value": "31233B0037D9912BE2BE5B789CF26141867BF2633607D94E3C8811DB5B13BC69A426FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037472, "uuid": "350f7edc-ffb2-48d9-9048-0d8097e0156e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037472, "uuid": "d5a05122-587d-40f5-af1d-72507fb3870a", "value": "768:Jx7QMF2O2dqc5rZavOr3ZpwGuuPykCdyjbkgr3iAJcT58+hClZW2tYcFmVc6K:Jx7QMFTwrwVuPyhebrrSAJ658+MrWKme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624037472, "uuid": "f00b0e25-119a-4304-944a-02cacc639040", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624037472, "uuid": "5b36691f-beb7-4c28-b279-96214df1fcb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037472, "uuid": "213fcd56-60f8-48d6-b570-615d32a54720", "value": "05633f6a8c4a6d559ccb685defee2536.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53479d5c-d072-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624047500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047500, "uuid": "0cb3f1d7-c773-4536-be78-f190b274790c", "comment": "Malware payload (Mirai)", "value": "ccc9ba971e1301c8acc6fba73dea7ca1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047500, "uuid": "9f627fd2-cc31-4a01-84da-50a6281022ea", "comment": "Malware payload (Mirai)", "value": "5e55ca7fcc4e8f16b56b059a686a86814c5ee7020f1283251ca8a81fe2ddada9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047500, "uuid": "c38f684d-6f1b-44f3-bef0-3e0e92007770", "comment": "Malware payload (Mirai)", "value": "65914cc86413b8ce9aaa942c96cb94db0fed0b81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047500, "uuid": "9a0489b7-8db4-4e57-9032-a83c5ad36021", "comment": "Malware payload (Mirai)", "value": "289802243cdfbe97895bf6f548082599cb49d7f757d7b0038355e19443c0ffd3d8690903324a4507e91a438ffa17fe13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047500, "uuid": "ae596e85-01d6-40d6-b57b-c6f9eed185f1", "value": "E7B39D9BB74B5251C86187F40BCB4BED3A2323119F27C9E7AD0E263D49391CE4A0A791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047500, "uuid": "30d9b8b4-0de1-4d23-96ff-33bb7f39dd50", "value": "1536:MInUHea+kzK6+iqvrdwZ3CqnT+4s6cWiaRgL/LW+:MInIea+kzGiyuZCqVs6cWiaRgLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624047500, "uuid": "cc31e0b8-b0a0-44a8-a514-b19415e2c489", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624047500, "uuid": "a6588181-7ea0-44fc-8cb3-c617ec3c84a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047500, "uuid": "a8839f06-5054-4285-8f9d-fcd05f4d39c8", "value": "ccc9ba971e1301c8acc6fba73dea7ca1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12bd732a-cfe0-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623984685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623984685, "uuid": "b5fa1e7f-ce9b-4e6b-be48-ea65a05fbdd8", "comment": "Malware payload (Loki)", "value": "2f66d8b59c4796d6c27da884fdceacf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623984685, "uuid": "1a3fb82d-5635-450c-9a0b-96d97ec45de5", "comment": "Malware payload (Loki)", "value": "5f01ed3d8a634dbabb0d691cae1a2458324f50c16a7a2aedc5b234657a15291d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623984685, "uuid": "30c78ab2-cae4-4e9f-9762-941101050bb9", "comment": "Malware payload (Loki)", "value": "227de0c113b618dd3fd9effc9a7dba4cc7e656c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623984685, "uuid": "e7be69b5-fc22-45ae-ad37-c4c7342cea4f", "comment": "Malware payload (Loki)", "value": "c0a69d91b0bcdab4cc8ae437e76efbbb8f8361f683f495181c60ce79a464f037958be52813a408073564ffa88ec69d4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623984685, "uuid": "1e924d3f-ea23-4cd0-81a1-64e3bdb440ed", "value": "E315599D765072DEC867C971DE982C64EA507C7A970BA203901736AEAE3D897CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623984685, "uuid": "aab1bb89-3b11-4a1b-9df2-5d7726559192", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623984685, "uuid": "fcd01b83-2f3a-42e8-913f-abc733f091ed", "value": "12288:6LUrbGnzsLqXNs/vmhLsGbLfZsAMNUQCG/vetEmPtgPx5R9004FK+/JVvKC7EVd8:6L4mzF0vc/LfaFCkmWbPx4K+TvKXP/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623984685, "uuid": "ac3f6220-3c59-416f-a07f-629bc975bfb3", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623984685, "uuid": "35c9b2c7-99fa-49d9-8bcc-ae059e5ee5d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623984685, "uuid": "99df44a4-8575-4b23-b384-9f3c6bc19814", "value": "?????BK210617.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3cffb7a-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623976903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976903, "uuid": "2accecb8-0058-46bd-b106-18de6b72d152", "comment": "Malware payload (DCRat)", "value": "f258c3d8bd93d4f7fbfcdadd83e22207", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976903, "uuid": "bcd46688-65db-4c32-a04b-823360437605", "comment": "Malware payload (DCRat)", "value": "5f3d5f1a734020dabc57565c29f60194eb2a0fd1eba8fd7a041c6329d5803f78", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976903, "uuid": "6d3faefe-0d6f-42ed-9472-c31d3b82582b", "comment": "Malware payload (DCRat)", "value": "29c2657971a98fb0d18d2546f77d105dc440ba5a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976903, "uuid": "9388a18b-112d-4af9-b319-e409ed45af9f", "comment": "Malware payload (DCRat)", "value": "733112e6e5f1cc4e0b028b513f2d21592c4b7520cf057217229341634c6305441da8185e7b4407b74fc732cbd3b18988", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976903, "uuid": "2ed4187d-1917-4200-ad8f-48debe3c023a", "value": "4365339406D7CDCEF48C29FB71AD4A00600D60BD3A45E9B7D137AF96AC43569F06A33A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976903, "uuid": "efb9fafc-57e9-4512-a860-d3fb2d4269ea", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976903, "uuid": "f0ff0f53-b837-4232-8b9e-2a3c6395dae9", "value": "24576:z7D3vZ6g9gW5oLDyohSir0S1UYKnpaTbt5o0j4xm0QIhXYSnGltvBcN9ye3+hdMW:XDfZ6g9d5iDyuwS1UYKopj4sb/yuwNAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976903, "uuid": "bdd52ef5-bd87-4416-9871-3430d892471e", "value": 1481216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976903, "uuid": "957c58cd-8ee6-4695-b156-ca352590f5f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976903, "uuid": "d2474acd-568e-4664-9798-6f56bd3a5304", "value": "F258C3D8BD93D4F7FBFCDADD83E22207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342590be-d031-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624019531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019531, "uuid": "81ef6c1f-3972-4416-8fd6-0a9dee5733ed", "comment": "Malware payload (RedLineStealer)", "value": "fb661ad93e9b12c43ebe863617427687", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019531, "uuid": "926292e4-62e9-40ee-b11b-de6c94b77f63", "comment": "Malware payload (RedLineStealer)", "value": "60310a142d94c557ebe7b5325138db0c2906ed91f4706234cebde8a3d5815789", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019531, "uuid": "1a8a2db4-9241-4db1-a8c4-fda0131b1bfc", "comment": "Malware payload (RedLineStealer)", "value": "a11b0037039674b9a80d94f1c819bd454f5516e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019531, "uuid": "58a05fad-97ef-4abb-8d75-ada9ade732dd", "comment": "Malware payload (RedLineStealer)", "value": "4ebc533903ce61d1b963721ab9305f8030879d53c59c3ed40a52d22320e187f57d834345e020e652e7eb74059109bddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019531, "uuid": "a83c5bdd-5cda-47fb-a216-1cfb258a4411", "value": "A7C53352732F5C9AF5498470E086E66A8105793E8294F27B3F81390A3DD538325AEFDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019531, "uuid": "dcd91991-c118-4498-ba8d-c48bcc40f824", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019531, "uuid": "9156610c-f0bf-4f56-bfae-9edafb17fd66", "value": "49152:gOsUMNSKUIy6N6SHR+0I1CCvmxGUG1yxualRKQwwTvcqKLV1xyG:uJNrBygR61Bv2G112uOKeMD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624019531, "uuid": "b748fcf2-4188-42fd-9cfc-8e60667a5f36", "value": 2648697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624019531, "uuid": "1c64fb0f-1eb4-4de0-8b2c-03ef1ed67be2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019531, "uuid": "aed0da90-70cd-4368-833a-02afd575a931", "value": "fb661ad93e9b12c43ebe863617427687.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebef80b-d00b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624003228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624003228, "uuid": "92dca489-85c9-4aa6-94b2-5a33daf84a01", "comment": "Malware payload (Mirai)", "value": "242b2099ce6162b72013e76c6a459ea0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624003228, "uuid": "82e3be71-5a53-46e8-80e0-ea7d779ab8ff", "comment": "Malware payload (Mirai)", "value": "61566b7a6e0f4ce9ba064b0de1dd3cd99edc5819125c28314b33fe19af79be35", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624003228, "uuid": "04ce611d-9579-41ce-83e3-82ececda5361", "comment": "Malware payload (Mirai)", "value": "98fd0db9036ae84cec3eb8081f8e4fb8e9910675", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624003228, "uuid": "dbd4bdd2-ed6a-4f33-8702-c3b7405ebeaa", "comment": "Malware payload (Mirai)", "value": "2866fa8edf12e0f613feb1d640c4e9da975e934263b82c03f3e2de3b5677782e017b5bf925b75acfeeca792a09390ae0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624003228, "uuid": "25e39d71-da87-4865-9bad-487d4cd5b30e", "value": "0C64E1CAED01AE75F9C506B9FA1F074973B38BE8D3C7B110E624C6143ADE6468B39584", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624003228, "uuid": "d2af9252-d377-49dc-85a3-f850cd4724dc", "value": "6144:7O/QJHZweEL/NOjCHm7FZZncI77oNsKqqfPqOJ:78QpZsKCaiI/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624003228, "uuid": "25955069-ac3a-45ea-9672-5537be95dc25", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624003228, "uuid": "3e94fe1c-1895-4ca1-a341-7c5364dea515", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624003228, "uuid": "69884513-8339-475d-aab8-2062bf4b4a81", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9ec49e-cfdd-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623983496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623983496, "uuid": "0beea673-83bc-4a12-ae41-491b504794cb", "comment": "Malware payload (Loki)", "value": "2252c10dac018b75c4d7aa12b96d178c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623983496, "uuid": "0a96c3eb-47ab-4388-902a-1e89ec8a16d6", "comment": "Malware payload (Loki)", "value": "628dfd34daff8a0bf381c3bdf5a106ed0de213d6aabfd68e3f3b2276afb0e58b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623983496, "uuid": "eb05ad35-6095-471c-9b0c-c6aa8ef10680", "comment": "Malware payload (Loki)", "value": "1beb14d8e884c0b18682bed85b908aa6935474dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623983496, "uuid": "667f259a-7be1-44c4-9311-40713caefec5", "comment": "Malware payload (Loki)", "value": "4928acb70ff84c377bf0cb93ad36d9e2265008e543241a63ab9f8ed372be92c8874fac7b38ae7ec4a223b9d5e7a6bf8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623983496, "uuid": "6ae42707-9614-43fb-b191-a4bc9842d431", "value": "20E39E61F2EC6C11E2928730E575C63E9B967C715A02CF076358B70F2E347C692BA52B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623983496, "uuid": "1d38fd92-ee9f-474b-9fa4-06b58aa79147", "value": "be40f0cd8fddbab623f92878bcc02d13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623983496, "uuid": "21770700-522e-4f7e-b64d-dd2c41197f17", "value": "1536:HuvUyiDZY2DE12V6Rkne0BXuD2TU5sml8zCXoH+i:2UyiDTDnIOne0Bm2br+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623983496, "uuid": "0c5d2e10-6773-4132-ba77-ea9ac406caf3", "value": 144552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623983496, "uuid": "f3a3a34f-b6ed-4a11-8957-0ab15c2189ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623983496, "uuid": "f0a33c99-80c3-4bcd-a474-06173373faa0", "value": "RFQ T2021-000615 18-06-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d80ec7c-d06f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624046336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624046336, "uuid": "7347d1c1-dcac-4353-b161-702e926be268", "comment": "Malware payload", "value": "0bd3b9f55a2d3a13f506d9d8b970e0de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624046336, "uuid": "ce31e68b-0d2f-4afc-9188-bc699d8bf87c", "comment": "Malware payload", "value": "63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624046336, "uuid": "2946a5eb-1134-4938-9af5-758604affc86", "comment": "Malware payload", "value": "f023177aca17f6dc90fdd9588240cb16c70a9fe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624046336, "uuid": "0c719f2a-65ea-4434-90dd-c237be797142", "comment": "Malware payload", "value": "6a5bbc90a38b3bf2552a7f721e8a8d83954903a9bc05f8eb80afa1ee4477cbae65b9f9f15524f5411ee52b47fd34b3b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624046336, "uuid": "98320e74-416e-469a-992f-feea5a83fcf4", "value": "8B438E95A2A814D4CA67D5B8C1629A1BEFF17462232187CF03B1C5950F733E0EF3A795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624046336, "uuid": "b7f0bd7e-c9e4-4404-b70e-7e0e3cbba26f", "value": "d252001e327cf09463aba69fb4de2125", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624046336, "uuid": "79109eb3-0292-4288-8c44-84867f9bb833", "value": "768:o1ZqCQKy8IYdfWiUelR36ihR6nmRYsOSHjS/OPNi7HbB:oNyq+4lRX6IHOSyOVi77", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624046336, "uuid": "546bd8ec-3b20-4018-b3e6-c4edcdedccf4", "value": 57248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624046336, "uuid": "79acf3a6-ff0a-4709-8351-1649d7fa97ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624046336, "uuid": "9be2abd6-f29b-41e5-98c1-97e6f34fcb1f", "value": "63d61549030fcf46ff1dc138122580b4364f0fe99e6b068bc6a3d6903656aff0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cead1cab-d033-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624020649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624020649, "uuid": "8d1e84af-b1c7-49db-8ae1-09eb4d795d01", "comment": "Malware payload (CryptBot)", "value": "e8dea23ae7ad4a458af6b36a0fa5d77f", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624020649, "uuid": "b66e6178-fd26-4059-987d-b088e74f7ee0", "comment": "Malware payload (CryptBot)", "value": "63d9527d69c228772ebadb63c1e74d7d0702acac52357fcea08ec5a408ca0453", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624020649, "uuid": "8461b5b4-61dd-4ed9-b12a-b4406755599b", "comment": "Malware payload (CryptBot)", "value": "7520881fb2f612379efa29f2a062e43c184944dd", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624020649, "uuid": "e4944079-8b84-4044-bac1-8a90b764648a", "comment": "Malware payload (CryptBot)", "value": "1797721c440da480e406085f38fa456ace7bd436b2a0c77f1caece2629fcd8e69eb9cb152d04b9346cdd0dad1efc990c", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624020649, "uuid": "0436a5b9-ed2d-421f-8ebc-66134a0a6e5b", "value": "6584AF10E7A0C0B4F1F712B84ABA9FB995ED79A1672490CF53D52AEA57342E0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624020649, "uuid": "9f32236e-8d01-4d27-ab2a-a3ffdf1b8998", "value": "a98ef36ca5b4cb4252d443cc4e9bbbbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624020649, "uuid": "5a20558f-1378-43bf-af55-99027370c6d3", "value": "6144:zYJVHSd9LiK2KWz6OjhGsYDz2HQruFlwe7FEiGveq/kzC/:zYJVyDLiK2UOjpYc6uFlw8OZv5kz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624020649, "uuid": "1e639d1a-4f11-4f76-8153-1027b10b9430", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624020649, "uuid": "b16fc090-148d-48c2-b8a6-02d3ffdd5483", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624020649, "uuid": "7c75e17e-7667-4b67-808e-bfcee15b525f", "value": "E8DEA23AE7AD4A458AF6B36A0FA5D77F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae2d225-d02b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624017287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017287, "uuid": "46470634-a9a2-40ef-a10e-3c27b1da8bd5", "comment": "Malware payload", "value": "6ada6c97ce2ede5052408e0e5a38a4bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017287, "uuid": "8b402221-6493-4596-bb4b-6938f179f290", "comment": "Malware payload", "value": "64a2f3a689659f07dd1e62f7f08bbfcd174dad8eba3f84f7bbc1a1c3388c6dcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017287, "uuid": "8ea9c9ce-606a-4ff0-a3b6-ba7d6b408818", "comment": "Malware payload", "value": "1119aa325a48af94a7c43312723d30c81d8a7b98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017287, "uuid": "fcea6a0e-3085-47df-a4b5-98d0806fe288", "comment": "Malware payload", "value": "132e5646bfbbe4c65ea892cd993eee59156f071dc7dde279e52703f7c081fac967b8a48b1994171ff5db46ff95899dc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017287, "uuid": "9b20035f-abff-4859-b6a4-bd05d4b4d679", "value": "D372D0B222A10A43ED0941FA471BE8035CF05AD03E15B6D83759BDA1F76743C527AEEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017287, "uuid": "ea9d7b37-eb85-406f-b752-eee1ba80982d", "value": "384:M2CIKV0anq07z2T92VUytUH8N+vnYxgkanpexQWLv1R3:m+anZq8UyN+vY+kcpexQi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624017287, "uuid": "430a373f-f88a-4cce-b408-357d7bb60a59", "value": 17448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624017287, "uuid": "638e33e6-e23f-4a2a-95d5-12f136164231", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017287, "uuid": "be7d0aef-02c4-4bbf-9cca-b082e6f103f6", "value": "Samael.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b78402-d048-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624029672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029672, "uuid": "7fccb768-c8ee-4701-99e7-23e988df1ed0", "comment": "Malware payload (RedLineStealer)", "value": "f2378790e00ec499c0d0def611d45271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029672, "uuid": "f8f1c9c8-e75f-4b5f-a79f-61af66f4ba67", "comment": "Malware payload (RedLineStealer)", "value": "64b8fd872c6b703447916b99d3bbdb045222b25a0ce41eb6fe5145b6ff9a469f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029672, "uuid": "24d53f89-a726-4839-a6ac-23d5d7a32660", "comment": "Malware payload (RedLineStealer)", "value": "dca991c6736c3b8a11f97700908ad08a5003d772", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029672, "uuid": "a458d4c5-8afe-49fd-b2fd-9ee02ea0d283", "comment": "Malware payload (RedLineStealer)", "value": "6daa6ca5c0cbc08c3fe3d593b7dfc20385ed2a512df8fa43f08906e931490daf4f7d9acbee9c0987a6c670ba48a600a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029672, "uuid": "f95e82a9-3aef-46e0-89c7-5e10e8bee8d3", "value": "2B84BF10FB90C035F5F612F85AB6C3B9A52D7AB1972090CF62E51AEE5634AE0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029672, "uuid": "90ef7c69-3186-4489-acfa-72b207059cfd", "value": "705a372c868b933d973ca642948b7012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029672, "uuid": "dfd78789-e891-4b4c-a2a1-9e80532558b1", "value": "6144:QG86cnIsrPwGGMCRZf2aH/F/4kv+V45Y68GXMzG/duCpLqsSl+Koa:86cIsr4GGMeZNFgkAzgRv292", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624029672, "uuid": "6161c879-74a4-4cf6-b711-eb2af7348c35", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624029672, "uuid": "6dc0a76a-7c58-42d6-b71c-1d5ae399cef2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029672, "uuid": "40deca15-d66e-4eaf-a51e-9c2357a33df8", "value": "f2378790e00ec499c0d0def611d45271.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e56c94-d000-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1623998597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998597, "uuid": "6481fb82-9b0a-47b7-b0a0-25a7c33b784b", "comment": "Malware payload (Smoke Loader)", "value": "594372006ab7dae5cb292b0768d424ed", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998597, "uuid": "52f88e69-4ae8-4723-af99-ea793c37bb30", "comment": "Malware payload (Smoke Loader)", "value": "653d4491de7461361a379e7ed09e172c06d669d25fed55f134a1b278827f2efe", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998597, "uuid": "2ad83b9f-d2b4-4daf-9b16-c23305da2a89", "comment": "Malware payload (Smoke Loader)", "value": "a6108c2205f17925471d7bbfac9dbb3558b6e7e2", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998597, "uuid": "63bd5c0b-f825-4a70-aa90-418cf7e89800", "comment": "Malware payload (Smoke Loader)", "value": "af4f1e86577f3a8ecbd70469cdd13ac39387e46b7fb9eeb4a482c842a3df9f8d255d874d13f771a2e3396a5d63f48876", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998597, "uuid": "a2ae3c3a-03eb-405a-b32b-3a7a98fce29a", "value": "06548D10B7A0C035F6F721F8497A937DA52D7EB05B2451CBA6E52AEE56346E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998597, "uuid": "0b09c604-1d02-42dc-9d73-fb3313f3ea28", "value": "0e61e5ee811a73c290e64659dd192375", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998597, "uuid": "bfe32d02-4f9e-4125-b284-0bbf56795aeb", "value": "6144:UCdudDP6fNANSwqelTe4UsrClhFOhmlj2TtnNt:nudL6fNANSwqe92lhFOhsjYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998597, "uuid": "2b76df65-4ea9-4b10-b89f-e15008c226aa", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998597, "uuid": "d4d85d54-6710-44cf-b28d-094bec18ef40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998597, "uuid": "6a5188e5-2c25-4b01-827a-57b1710817bf", "value": "594372006ab7dae5cb292b0768d424ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab301103-d07a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624051084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051084, "uuid": "d951b6b3-d9cb-4a9a-ac39-d57540493138", "comment": "Malware payload", "value": "83720e64aa1388d55324a22536bd39cd", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051084, "uuid": "fc24015e-8b19-4f72-b9e4-d3b06126598a", "comment": "Malware payload", "value": "659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051084, "uuid": "28fe3887-fd5a-412d-89c5-35ef910ca523", "comment": "Malware payload", "value": "8fa3636a7697f953d7daa02a313981b9e3bc98e4", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051084, "uuid": "ff90702d-92b7-4490-9341-aaff9a728beb", "comment": "Malware payload", "value": "d5fa2c660a79a374c75210169180d5f7b5f87156249bbbe2da60ec20b8b6327bc7f9d588ff316e90d2aef36c8ad2778d", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051084, "uuid": "ce52bda0-77e4-4d58-8fb1-3fabaf8ec5ac", "value": "F5124E67AE83CA2AC52E0631A2B2C262757593706706AD86E3440DB4FDF7DDE621C30D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051084, "uuid": "60d66e23-6c5c-4672-8188-6d6771b71341", "value": "7e3bbc4aa48a3d61a7b995aba939311c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051084, "uuid": "a899f5fb-3492-4f0b-9e12-b1c6933ce61e", "value": "192:V06wXINaG3GO/p/gqEQ3UCp3syXOYWmvmKI7H:VnNt/1gG3Hp3ToUjI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624051084, "uuid": "03532fb4-d876-40fb-ae42-b2300cde932d", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624051084, "uuid": "88f2ee56-419b-4815-ba15-0428629967c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051084, "uuid": "be87682d-58e1-49ad-9de3-5c16c93361e0", "value": "659e0d1b2405cadfa560fe648cbf6866720dd40bb6f4081d3dce2dffe20595d9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c203e1-d047-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624029226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029226, "uuid": "f51b16b8-9ec0-482f-9d56-4884b0f6f440", "comment": "Malware payload (Loki)", "value": "a52f459bce6f362d4c604e40db21d6e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029226, "uuid": "d3e20df3-a195-4592-8541-593a57e6a9d9", "comment": "Malware payload (Loki)", "value": "65ea9d7333689abcd69eb67ac4d1c317734364ebb0f8a90ce79c8ebdc6e60e42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029226, "uuid": "51f11b94-0757-4db6-a728-c44aa8cd5dba", "comment": "Malware payload (Loki)", "value": "ce8ded740bae30af3f9788c6c313798af568aacc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029226, "uuid": "87f8cea8-dfde-44c6-9388-9bc7f6fa67e6", "comment": "Malware payload (Loki)", "value": "a4c43909035e9f3ddd68103d6cbae9a9d3030e296fcf3f163ca66763d85118ead25f7513ba10e3fa2d3e8757427c399e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029226, "uuid": "10a23683-30ad-47a5-9ca3-7fb093cf3cad", "value": "49F3022265E084B7E0D663B29E79D334D33AD9581430994B03E49FBA7D343D6CE3B186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029226, "uuid": "ffd51070-e60e-424c-a5d6-625d07ed46cf", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029226, "uuid": "4273022f-96c8-4879-be8e-bcf678da2953", "value": "3072:ABynOpL12riocoM1SijftmvzBPe6b5uJA4Ciw9Pcu9kBqfdR4WE:ABlL/J15DWY6b5ue4Cj90ukBW4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624029226, "uuid": "061e2ec8-a6e3-43a8-92ad-f08a1a039c07", "value": 161200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624029226, "uuid": "21aa54da-0c81-4fa5-a575-a9d9e33bb5bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029226, "uuid": "169a1906-970c-456c-aecc-c4dfc5b2417e", "value": "http___103.125.191.125_www_vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e3054c-d01f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011917, "uuid": "279ecd44-89d9-40f1-8951-dccc32297448", "comment": "Malware payload (Mirai)", "value": "e62fbc00f3fabfcacce663b1460d88b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011917, "uuid": "c3325379-0828-4972-8114-c8dedaff9404", "comment": "Malware payload (Mirai)", "value": "662cca814f8d50bf4feb49dc4134dabb6e5d29d6e69b43c323f8cce7acbe7d43", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011917, "uuid": "35705df8-e160-49db-89ad-d3f30722138e", "comment": "Malware payload (Mirai)", "value": "d1b5256de9848bca878e6669b66c1ad2100324f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011917, "uuid": "e3eaaadb-ffa3-4fbf-bc75-ae7276861f7c", "comment": "Malware payload (Mirai)", "value": "ec16090132734af2f6740abad08236a53bba28bd86cddd1e3628ce71b9453099b31e7abd360b5ea0bccbc157b46c84b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011917, "uuid": "bbf32e8b-25d3-46be-a508-f11652f783c0", "value": "17536DE5B8029E3CF98BE67980230E09F521725546930F27B7A6FCD37D731A4D946E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011917, "uuid": "9757c8bf-2e44-4897-91ac-c9b739d3a5e7", "value": "768:mewC7tPUFA5Cn0tfBEOm6dneNemWA7PNuYeehwxSikSfrP8uUsNfyoT8lp/0:me7CFXn0vANPn8YRZ4P8ubNfN8rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011917, "uuid": "d220cd25-92ac-4be4-922f-92202be6dede", "value": 64932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011917, "uuid": "93918380-f583-4088-a9ad-a67edfd2c8bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011917, "uuid": "6ab591d8-b012-4052-a1d0-1bceef697033", "value": "e62fbc00f3fabfcacce663b1460d88b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de00dba-d01d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624011118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011118, "uuid": "b372ba1e-0907-46d5-b628-5325ad149482", "comment": "Malware payload (Loki)", "value": "5ed4dc1656bfd81abfcb4a67b57c4ce2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011118, "uuid": "d373a15d-fb3e-480b-9209-df1da866953e", "comment": "Malware payload (Loki)", "value": "675fc0bef23b8e411557f8b5e4eb7c7f39c528c3d12bedb33ba6c89873f83242", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011118, "uuid": "71509327-5f94-4f9a-944c-6df8157024ad", "comment": "Malware payload (Loki)", "value": "84dd1ab8310dbbf31d564be75b1c167c211808d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011118, "uuid": "b253f543-86a4-495c-8bb8-81f77706ed67", "comment": "Malware payload (Loki)", "value": "8dbd6bccd6ce906aaf6932ce9ca223af3ace8a8e6119173e4a05612dc3fa9d51e2c74395366c2f1780a80bea30123ee4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011118, "uuid": "b8faf222-2ae4-4ebf-9b16-bc3400c895ac", "value": "1925398C7655EF9EF4778A3185549C10E513ACAF461B920BA313B67F6A3F7C3CA081A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011118, "uuid": "27df0723-e06f-4b80-93b8-d0a965517a8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011118, "uuid": "afcdf20b-c22b-4369-8880-ec88304fe880", "value": "12288:5lgu3bv3Jm89VCZ6vpO3weUB029pm28Up5DExMazVHEDYLNh4flhgU6AbpwnxCda:Yudo7k59wmhEOaJaYpi/zIFW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011118, "uuid": "0b29d067-84d8-4095-bf9a-22613f32ead9", "value": 980992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011118, "uuid": "94720115-b47c-48cb-8f2e-6ea41dea7c6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011118, "uuid": "26d69950-36b7-4a0d-9996-5abd968a8b6d", "value": "SCAN_files-17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f621691-d00e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624004651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004651, "uuid": "c9bc1e72-2fd9-4a7c-b826-3b74e9d40372", "comment": "Malware payload (RedLineStealer)", "value": "65de61f2796210a71e6530d47d0aff7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004651, "uuid": "2707af6c-13d8-4b32-a037-e99e2ef6bb4e", "comment": "Malware payload (RedLineStealer)", "value": "67cf35705b2345c19d916d3065de54de7896406554c21c1d56b79bb8186f4865", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004651, "uuid": "3537eec7-bb2a-496d-b5a9-4cefe3250a3d", "comment": "Malware payload (RedLineStealer)", "value": "c817338b62eed9d6db1da8d8486744cca9b4685f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004651, "uuid": "543dfe56-3c20-4ad2-92aa-35c25b06e03c", "comment": "Malware payload (RedLineStealer)", "value": "ad6aab1f619cf358bc1582fe170db8ba5104d8c0245c3a1649ed3d36a06621726aa7def8fdaf3357c1903641f8f9a399", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004651, "uuid": "7345a3ca-3c05-4ca1-8bb1-59bcab87e0cd", "value": "31C53351B30EDF92EA672179E468B0354C84DABD8A9F960B39063B4937D130311EBED9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004651, "uuid": "c6f96abb-8931-4d27-a505-4af501aca35e", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004651, "uuid": "c66fbc51-94f0-4e68-8b0b-46a9cdac880e", "value": "49152:gtCyAl4tQiaMRxv8G9HO9KNXIkZRew88/D33TdMTgavdfdm875Oy9Y:gQ3rMRxEXKNXIkZUlY33Tx8dg81jY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624004651, "uuid": "1d27b5f7-0bf9-45d5-86af-39387c030b6a", "value": 2635413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624004651, "uuid": "422903d7-3295-42c0-9e2e-7b345a5fc797", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004651, "uuid": "37efe374-396d-41f0-9e7f-5f6489a77f95", "value": "65de61f2796210a71e6530d47d0aff7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e17d70-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1623976987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976987, "uuid": "398b30d0-ac7a-4c85-a53f-bff000ce36ce", "comment": "Malware payload (ArkeiStealer)", "value": "5de3b23701724feeb15c9c1b07e05e6d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976987, "uuid": "2ae6ddd4-0b70-4fa0-a56a-053657e050eb", "comment": "Malware payload (ArkeiStealer)", "value": "688c8e2f502706a4fac243fd9372c904238bd7733186d8c255f84b7700852ca5", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976987, "uuid": "c844ee55-9400-4c38-b382-9adecb33d262", "comment": "Malware payload (ArkeiStealer)", "value": "7bb0f0c708d8d07fe592f24256430b6d1e434b33", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976987, "uuid": "006d5d0f-f895-47a8-b216-fc055935ee00", "comment": "Malware payload (ArkeiStealer)", "value": "8d84e7465fdc88673da2a200068e11c36b61d0a724fcffa349a4c48d0592b04251b455b549c74c275206b82bfed2f71e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976987, "uuid": "217b7548-1d0d-4b72-a739-0cf6c3b638d0", "value": "E8059D75F592D072F88201BA93BE6F7758386612532694C7F3D00E996FA01D27A3E21F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976987, "uuid": "8a74917d-0b5f-44d4-acdf-599b62aea548", "value": "38ea6f39f66a13952d0df81911d291fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976987, "uuid": "22e6aae2-59e5-4757-895c-1a7dc6486439", "value": "24576:090ArGKlAbM+7tsBdP6BumiLWG+n3MQIayV88M8Mh9Ct:FgeB3ER888hUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976987, "uuid": "fcc5b8d4-867c-40ff-9e94-bafc265a73af", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976987, "uuid": "10b18386-9ce1-4ce1-bc67-ef6b2a945a5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976987, "uuid": "91d1e747-67c1-4905-a414-61f45b50aaca", "value": "5DE3B23701724FEEB15C9C1B07E05E6D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75721bab-d02a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624016634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624016634, "uuid": "a8fd5b3d-c1ab-40dc-95ae-b4a89d28dc1f", "comment": "Malware payload (Formbook)", "value": "b8f1be71d0a2a3aec6cb7a09d29430b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624016634, "uuid": "3700d97e-c51f-47c4-8529-e6580ed06c90", "comment": "Malware payload (Formbook)", "value": "6bb51f60644e3c9ffe0cf3bbc14d1c2bce55963640ee72631479485d6d0f7fc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624016634, "uuid": "abaa9dfe-ece8-46db-938c-443c14296dba", "comment": "Malware payload (Formbook)", "value": "1196162f5d895a11b2c1092339fa3b124489a36c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624016634, "uuid": "66b090ca-b8d8-4377-a936-3f81517f7841", "comment": "Malware payload (Formbook)", "value": "cfc75e1d9397aa3ba43e14af6cc104ca55f1b89b660563fb983932c149dd276bc4acc7f06f813bbe96f3186c196ca38d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624016634, "uuid": "4ff548e0-75fa-481c-91bc-37baebf9beae", "value": "7A258D2DF2521936D93337BDDC5B9688682EBE41793CEC4A27B439157E34390392D0AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624016634, "uuid": "99cead20-3c87-4182-aace-6eb087b1e55e", "value": "2f23599b8bdd1ddfb668f4b1b06d241f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624016634, "uuid": "d31b84e5-f6f9-4c9a-8f3e-920e59d9ad28", "value": "12288:XDz2Q7Q291DyIe5y+SKera8JzsP0XmoX/7TCOcbbkXbweFTqX0uNb+T0HXX+jBnD:XDyQ7h2y+SKS2Vy3Ibk8eZq/XQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624016634, "uuid": "d2b6af85-2106-4bbc-9338-5528f9d2e024", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624016634, "uuid": "8defd77e-3f5c-45b8-ad39-d1e777caa038", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624016634, "uuid": "58d7b0e3-f1d5-4b01-8f00-b58a972b9f1e", "value": "Remittance_Form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f6701f1-d079-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624050527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050527, "uuid": "c2faec8d-e2fa-4e65-acf1-97f5246209b4", "comment": "Malware payload", "value": "16757dfa478e253d8d7251c64fda7e5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050527, "uuid": "d8b92b44-ca9d-45fa-9d3f-40f28c53f8ad", "comment": "Malware payload", "value": "6bb719834486c1edde90d47c165b4e24bcaeb4f0e9ac7468ad95b1d62e918a70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050527, "uuid": "00ec23a9-d04a-4c13-841f-448beba84760", "comment": "Malware payload", "value": "6aa4c49fd9d37416164da901e1116defc567320d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050527, "uuid": "b57f7ba0-6fcd-4f67-a94b-cc44e84a9956", "comment": "Malware payload", "value": "ac69bb617c7292cc1af807a1ef3a4e5d3624b24930f9b2fa388fd5c606fd02189e6182137a43658d6ec1c88f0e26db39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050527, "uuid": "f56b9fff-4370-498e-a303-48f34dad5532", "value": "47257CDD722072EEC867D4729EA81C64EA507C7B931B4203942735ADEA7D897CF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050527, "uuid": "87d0076b-c03c-49a8-aacf-cf3ac27a7e32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050527, "uuid": "bfa67449-1072-410d-b10b-5f0697a06272", "value": "24576:+UWYpJkS0BDL0x+Hfd8CPIMzqAoOiB9G:+U3b0BDI4/qCH33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624050527, "uuid": "c754f8a5-08c6-456f-adc2-4f99960ce647", "value": 976384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624050527, "uuid": "69f4e63f-5188-47fc-a4fe-cbd12252f7c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050527, "uuid": "16cbd61e-b5cd-4a92-ae1f-504d4ed570dc", "value": "Orden de Compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84e874a-d04e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624032208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624032208, "uuid": "6e3402dd-b8d9-460d-9201-cbdd33401a14", "comment": "Malware payload", "value": "ac61f35e43f5ecdf660477ac30a900a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624032208, "uuid": "9d8ce84b-05cf-4fef-b3b8-672ec3065600", "comment": "Malware payload", "value": "6bbbe63faf9184516d51c5855240541037a3c5e8b3365e1cc7890e19fd3651c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624032208, "uuid": "14a70a27-28ca-426f-958a-4002c1d6d133", "comment": "Malware payload", "value": "70904808fd08b61ac18af229fcf4e1a485e2c885", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624032208, "uuid": "8874fc8a-1398-4f57-9bb1-2bcb20a6376c", "comment": "Malware payload", "value": "72f962a962878dcce01571aeaf2bfc1e2c3dbda94b13c3fc6d3231e1d9f2d337ad39f3a10e87fc232e46dafdf930543b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624032208, "uuid": "c97e952e-5c63-48fa-b7ff-94292150ceff", "value": "AF528542B7E80225F1F79B797ABA1209CE37BE1F9952CD5D344C510D6F32A4089A3B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624032208, "uuid": "b1627c83-9245-4bb1-b6d5-5f426134a808", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624032208, "uuid": "c1e88974-ebac-41a0-b77c-6d790f5891c3", "value": "384:O2i4ULC+Sd73W3Tt5KmbZSouRGkoptYcFSVc03K:hULC+Sd73W3x5Rbhrk8tYcFSVc6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624032208, "uuid": "51e8a622-3602-42ea-b97d-677058d798c3", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624032208, "uuid": "59aff289-b42e-41c2-950d-6ec82967391a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624032208, "uuid": "145a4aa8-c946-4260-b494-0a06a31b7dec", "value": "ac61f35e43f5ecdf660477ac30a900a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6523536e-d01c-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1624010593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010593, "uuid": "05099890-3871-41da-92fb-d9098ebe06cb", "comment": "Malware payload (TrickBot)", "value": "c018d5256df5bafb1e3dc7b6ce8baf7a", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010593, "uuid": "9014775a-bfa7-4379-a1e6-7d981636b82c", "comment": "Malware payload (TrickBot)", "value": "6c8c096650de2a436770ce00e63ec380aef9f64b787d8aecb3e5b96cafad6fb1", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010593, "uuid": "4a192aa4-ed7d-4ae0-b3ba-17ef36d73185", "comment": "Malware payload (TrickBot)", "value": "cd698f29ed290dc0be17fdd3be97bbd6388fb6ea", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010593, "uuid": "5c1de41a-701a-4f07-9f72-0d5caf52f913", "comment": "Malware payload (TrickBot)", "value": "5dc148a82d607aee7b029410e2e56719ffd8511d98c3d330a373c6e8a8a2093dfe1a4c26125db3058b1044ae1d0ab0ce", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010593, "uuid": "15ba0471-23ed-42ed-98af-ce496ea0603f", "value": "07F31205A212F0DFC2602039D793A450AD35B29EDD43FD5E1A71FF466B121FA278E68E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010593, "uuid": "9d92f09b-0225-44c1-88bb-d0490c35ea34", "value": "3072:HzTkdm3bGeAxidxVymd1xXPMU9VlUBWA6CFvA7bRCxAVIKKU0:TTkeGKdxVyWxfMU3liWA6FsYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624010593, "uuid": "459c3a6c-34f9-4e01-aeb5-ee81e4c77a27", "value": 162061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624010593, "uuid": "fff83973-8540-4905-bf33-cd50b329c871", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010593, "uuid": "ad134254-8d29-42c2-8042-ff84dd9d6fba", "value": "idea-1132671574.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31227591-cfff-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623998051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998051, "uuid": "d05de52a-d2ce-4e5b-ae74-c92ce56e43df", "comment": "Malware payload (AgentTesla)", "value": "b088df911b2f4cc94e917f686405250c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998051, "uuid": "cb326ea0-da3c-4005-a603-9d6ad104690a", "comment": "Malware payload (AgentTesla)", "value": "6d7bddf5ab2bf5c9e3230ec77e24d414ea707c7202656d926a47a3e4aeb7894f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998051, "uuid": "dfede877-ce9c-4715-a396-14e1c56bd797", "comment": "Malware payload (AgentTesla)", "value": "3714f66c3c5caec6ecbf27b5834e920de1945a46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998051, "uuid": "19bbf097-5e49-41e8-b8d4-305d4f2f53c1", "comment": "Malware payload (AgentTesla)", "value": "ce7c5f982d70006e81c4e37f0ed00dd35e63be8c7e721e88a9bc0fdb6f06ee227b073f94c7241dab98f351473b0b1758", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998051, "uuid": "803b70e3-f928-4c1f-af02-7741113fb223", "value": "8905BF212AE95215F177EF785FD075959BAEFF237B02E48E189133870633A81CD9063A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998051, "uuid": "86b84fee-db22-43a8-9499-746d76c24eb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998051, "uuid": "f41d8677-d286-412c-b538-8a343deefa3f", "value": "24576:t2W5Evc/Lfa3CYiAMkCGr36r2/3lX5BuDM3a/s4R:kmfa3viAMkCGr36rOJBuDMq/sO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998051, "uuid": "a1c5007d-a09e-42dd-85e4-d773772cef36", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998051, "uuid": "31fa286e-daa4-43b1-b400-16820ff1b823", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998051, "uuid": "87f7097a-c2dc-4e9e-8f14-05d4a2d30fcc", "value": "ORDER TSA-A090621B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3810920d-d04c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624031134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624031134, "uuid": "edc07793-8d40-4540-b07a-c12ce41384b6", "comment": "Malware payload", "value": "12d768f485cf5d740878d4e89b8972ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624031134, "uuid": "289913b5-e79e-48cd-ae1d-a5c701f738d8", "comment": "Malware payload", "value": "6f85fc488165a8b67610368f77db1d12de9f4ecd21585d8844aa517b94e9911e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624031134, "uuid": "aa612302-8869-4fdd-b8c0-7f75b48c61c7", "comment": "Malware payload", "value": "67661954ec981d47d4f6c454daacc3e85ac8fa0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624031134, "uuid": "9250fc54-28b3-4679-bfd4-32ac78deb820", "comment": "Malware payload", "value": "7bd1df31820a31f6db7e3d594683c9c8a19d89973d9b32e84ade743d67466f2cc200b1c1e5cd360b60e0670cd6d6790b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624031134, "uuid": "8fc2733c-7e0b-430c-9559-b0cd20bd82ed", "value": "8745AE2027D45659F1BB9F3A5590E9304BFABD62A325C4593CD43ECF2AB2F81CA50327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624031134, "uuid": "7229deb8-47f5-46aa-82d6-180d0e3cb93e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624031134, "uuid": "c062259a-a9fc-4508-80bc-8cc17d274c4e", "value": "24576:6Nsq/wW5R2X2X2X2n2X2X21zdyXGq09qCYLZsfoz0ts52MMMMMMMMMMMuMMMMMM4:6Cc4mmm2mmJdpZ9qCYLZSntdMMMMMMMp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624031134, "uuid": "1f10bb5c-32c7-4eb2-b3d2-e49da4a09053", "value": 1189376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624031134, "uuid": "5fce4099-785d-4892-b27a-e54fac237632", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624031134, "uuid": "00e4fc18-6466-4b8b-97d8-d577d6f1d8c0", "value": "SecuriteInfo.com.Artemis12D768F485CF.19165.29609", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92564a18-d00e-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1624004656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004656, "uuid": "05d5b124-bfb3-42e7-9d6f-ee3d51cb9408", "comment": "Malware payload (Stop)", "value": "5986e0b21fb07b57e8841601154e5110", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004656, "uuid": "fede9e23-293a-41da-ac81-9cae7a78e42a", "comment": "Malware payload (Stop)", "value": "700bfd0ce8bb2efa95071c49ee6f2a468f12eec77fcdf000f3e454f5d2b97261", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004656, "uuid": "9ad4f072-d56a-45d3-83b1-5b51e90867e1", "comment": "Malware payload (Stop)", "value": "0ebc58e9c5980c72c687b793d2d4ef6c98d603d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004656, "uuid": "6667be78-2ac6-48eb-b996-2fdb6e56bcce", "comment": "Malware payload (Stop)", "value": "d5e93621d44734016e35816d97cdb1bf7efe9ad9ca062ade55cbe6f16290b2a72a15c957b8563a4b59b067b5924c03ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004656, "uuid": "b1492a13-71ce-4b58-9e99-481368672ac4", "value": "31050200AA90D039F0B711F46976E369E63D3D725B6060CB62E966EE67386F0EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004656, "uuid": "9903209d-9888-4e5d-8691-6384103c3bac", "value": "0e61e5ee811a73c290e64659dd192375", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004656, "uuid": "a79dbc1d-e4d5-4c2e-b64a-09379273ec78", "value": "24576:+4XSj8l0y5+NAghcwOW0+3iYTpTeQ5fQthp:nTx5+NrhcwOWcsMQ5f2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624004656, "uuid": "1b23e1f7-492a-4754-bac5-33b2b52509d4", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624004656, "uuid": "38db77e8-9b5c-4a6e-8811-ccb2f27fbe7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004656, "uuid": "353e5d36-dd33-4b60-a9a7-686dbce4d0cc", "value": "5986e0b21fb07b57e8841601154e5110", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a57033eb-d085-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624055798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624055798, "uuid": "78e1b305-8096-4845-9a53-61a6aacbcebb", "comment": "Malware payload", "value": "5af71e2a08eed74f115e2b5d3ef4e570", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624055798, "uuid": "8d2d8176-c485-4c3e-8650-9fc22bf1300b", "comment": "Malware payload", "value": "71bef343c030a099a182448091052c9788988251e1e9e3236cb27b53a5bd318f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624055798, "uuid": "6c74e7bd-1305-408f-8316-fd2410a1df7d", "comment": "Malware payload", "value": "a12ace9e7d0c1e38be738583ea5d548a7d325a11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624055798, "uuid": "a853d09e-953c-4d46-b7d5-528dec115ef7", "comment": "Malware payload", "value": "d3feda0a844e068aadf2bce9becd8f3b51d63e18f6ea35a755ce1a5561d8f8e59f23f4829359af7f18fef29ee5580551", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624055798, "uuid": "a51c0c98-f6d4-4fb7-bde4-182aacccb27b", "value": "E8351200A6A1C036E4F702F8A87987B96B2D7EB0976415CBA2D556FE55387F0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624055798, "uuid": "5cd0b282-3c46-4efa-9841-a4b9fdf49989", "value": "f38124646e535204cd12e80d37ffde43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624055798, "uuid": "ec1e7313-caa2-44d1-a7b0-d63aad48a323", "value": "24576:OXmQ62WSDVkgL0/vAF1LvXBRCwU6QQBtmsU7p1yOGJ2D:bA0nG1LpRCEQQqsU1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624055798, "uuid": "bc466528-7a0d-4c48-97c7-8bd2fdeae4d8", "value": 1136640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624055798, "uuid": "62750750-f7c8-4cb9-bb15-09d97d25874a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624055798, "uuid": "bd3350d6-3a58-40d7-8dce-f1478c92b25b", "value": "5af71e2a08eed74f115e2b5d3ef4e570", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ca68af-cffa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623995933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995933, "uuid": "12330d42-19bd-4422-839b-9dc2ecf86382", "comment": "Malware payload (AgentTesla)", "value": "347477d85a0dfdf382bc8a7895cdb1f3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995933, "uuid": "6435530e-3885-4f16-9752-6e1ec7ea42c4", "comment": "Malware payload (AgentTesla)", "value": "71c2043b9fea6c7af5cb3ebb0a6399f02c592144fc9242760ce8ced5b20d6b71", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995933, "uuid": "37835db1-1b53-4d6e-8423-cf1a09781217", "comment": "Malware payload (AgentTesla)", "value": "eea88c91066c14b1ff434afffba627811d738795", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995933, "uuid": "2e3b9301-b093-40a6-8ba6-33ba8b32d523", "comment": "Malware payload (AgentTesla)", "value": "1d4b434d91f7bac1a758e6e048ed6990fa7074957d5b1990c52db14b4e25c03164893f0b400f61cab09ee807eda22415", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995933, "uuid": "5347976b-7ecb-4ed1-8231-19526b182e07", "value": "CE0533954374128FBBFE8CDCE0C61C3B034FE715D25F48E56A88B2509F64C6A86A67D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995933, "uuid": "7b77a8cc-0d99-41db-8372-135910a854cf", "value": "24576:i527oFNIFMCM/51Bs/RnFnLhLlmJhnC75:w27DoEbLh5mJhna5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623995933, "uuid": "22fd9155-1c3c-43bf-8ea2-e26fe0b57940", "value": 805346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623995933, "uuid": "c7658d47-a3ac-4a4e-b2b4-115383ddf9f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995933, "uuid": "02b7a0da-16da-4c7e-b272-43effe5b6e31", "value": "scan11062020.doc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef32d4fb-d02c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624017697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017697, "uuid": "23e5b60c-d3ba-49e5-8db2-9713a87ba539", "comment": "Malware payload (Mirai)", "value": "b550baedb80274cb1d005598bf916bce", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017697, "uuid": "d0d7d7d2-bdaf-49bc-9c54-983e24fd435f", "comment": "Malware payload (Mirai)", "value": "71f603ce532b4499c959391e30be42093f903ec19e64fcf361c6744a21c7bd0c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017697, "uuid": "457fc083-19db-4951-abca-576fab522eff", "comment": "Malware payload (Mirai)", "value": "77cf0c033b4742cee0b37d185efcbbb6586bf166", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017697, "uuid": "8f23b38a-394c-4d33-9843-e13a27a8c74a", "comment": "Malware payload (Mirai)", "value": "896fb83023b45bb535fcc9a038d7d9bc06a21c5026cede0f8e00287df13811757c160520a827506f25eb5d56a1c1923d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017697, "uuid": "6b95864b-9af4-428b-b987-b1b85ef08955", "value": "3564E18AEE01AE35E9C0167ABA5F034D73778BADD3C7B111F610C72936DA54A8F76084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017697, "uuid": "881743d6-0d7d-4e99-9a61-69f8073286ec", "value": "6144:p3lOYoaja8xzx/0wsxzSima77oNsKqqfPqOJ:p1CG/jsxzXma/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624017697, "uuid": "5186118c-b5aa-44d5-a6ca-20c9fcc1e57f", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624017697, "uuid": "af4b3c51-f98c-454c-bab6-7e018f2309a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017697, "uuid": "fedd10f2-89a4-479e-82b3-cb2f216dd943", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55db85a1-d072-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624047505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047505, "uuid": "49c47622-6eb6-4947-86a0-b72d43a011cd", "comment": "Malware payload (Mirai)", "value": "3151552955a7c8b08199454f58d1d19e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047505, "uuid": "cea507b9-42a7-4c11-9e9c-cc21dc640320", "comment": "Malware payload (Mirai)", "value": "7344ceb86e5217d93710b2364815c5034819307812b3990e88f75ecce2b92ded", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047505, "uuid": "5987a31c-fcda-4d3b-8f3e-b57ce7ac8c0e", "comment": "Malware payload (Mirai)", "value": "48a1f456373d763d3e54243a7513e97a326b5204", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047505, "uuid": "97880094-83f3-4d16-97b7-66946b72ca8d", "comment": "Malware payload (Mirai)", "value": "9282903b2bfba005c5962dca0576b0cd4b65503cea15f271660ba313e6bb925e43f2d172658167f33641423c2535ee16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047505, "uuid": "7665a927-1b27-48c6-80ff-368c3cded1be", "value": "05638209BF610FF7ECAFDD374AE9174620CD641A21987B397A34D818B20B64B05E3879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047505, "uuid": "1f2902f9-b21e-4c94-9e6a-7ff2bdae5cb2", "value": "1536:T7tJSi5Z9q8NPx+WJUFAAdsWWjoJaLZLdqs:TpJSi5Z9dx+uoJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624047505, "uuid": "fa4d9acc-c45b-4e65-87d2-0317cce45da3", "value": 69132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624047505, "uuid": "f08bcf5e-57ae-4327-9d12-05ebe8aea223", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047505, "uuid": "21fb8c96-531d-4fba-9138-b09a25a9b295", "value": "3151552955a7c8b08199454f58d1d19e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceee5954-d07a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624051144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051144, "uuid": "9bbafb20-446d-48a6-93be-7b301b125a69", "comment": "Malware payload", "value": "872b5ffe1f7389e9a2fd48cc23db8b3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051144, "uuid": "58ea4d95-346c-4833-a9cc-10f5d12dbbae", "comment": "Malware payload", "value": "73ce09a268db7b8572770afa3e80cef768f6c2588f32d6dba7575afb506f8932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051144, "uuid": "08e82815-4356-4cc1-908f-671662dbd003", "comment": "Malware payload", "value": "3258b5dedd4f17d6109941a638f86ae119f097af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051144, "uuid": "09afa405-476c-436a-ac41-b911c0231c92", "comment": "Malware payload", "value": "0d8c91f6df681f9a4ab980a0a4256adcfeb91bea32df6f206002d553e386ad4344ca7c1375a41ff77f779606a5c8584f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051144, "uuid": "2c8e70de-ddb4-42dd-a9a7-1d5a4180df88", "value": "5E257C9D725072EEC857D4729EA81CB8EA506C7B971F4203902735ADEA7D887CF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051144, "uuid": "f323af18-59a9-4ab0-9813-37d7b939fe80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051144, "uuid": "29cc366c-8f01-4c10-ab0e-46b160f93d70", "value": "24576:LQiOdJQ3bmIpI0q0QmXoz1jZZi+v1GST5Us2y:kra/XozJZAsT72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624051144, "uuid": "adfab5e9-9b54-4dba-a04d-58d8b8fb18bb", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624051144, "uuid": "f94aecdd-a5a8-4a6a-8b5c-f29e94e586cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051144, "uuid": "4fd8cc48-bc7e-4291-8501-492e76e62e9d", "value": "Request for Catalog and quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1e81d5-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623976972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976972, "uuid": "33710eb0-c23e-4307-a962-6e7d30ee1df5", "comment": "Malware payload (RedLineStealer)", "value": "1a1cde1aa11eb7bcc7fa63e1a6a710dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976972, "uuid": "0208dc02-53f1-4c57-bbb1-c080ed9cff15", "comment": "Malware payload (RedLineStealer)", "value": "74b13418d9f50f94920aa870823732618509599ed36a57e440c32c1e9cd928f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976972, "uuid": "fab3da76-e8de-4f5d-86de-95d9cad7dc89", "comment": "Malware payload (RedLineStealer)", "value": "bfba31cd013fa55124d64985c5fdce42d060e68a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976972, "uuid": "8ebe5fa5-381f-41b0-bd5e-87d721878307", "comment": "Malware payload (RedLineStealer)", "value": "c1d820fa807536ee53d969c37a84669986709c3e9d4f05a2146e2261debea71525fefcbf48a168bb20640a7e93c8c1e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976972, "uuid": "b7c6bb53-bbb1-4b7e-b10a-366c025b0916", "value": "E8B52303F9D081B2D5229A324A68ABA1647EBD341F609EDB73E91A0CD6305D0E7357F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976972, "uuid": "a0543a2b-11cd-4e7e-a668-5bcded812355", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976972, "uuid": "cfdcf600-c1cc-40b0-a63a-8d8f7719fded", "value": "49152:8bA3lvMSr+rObQps6K1jOSj62GKoCkuOX/+D3fnH50Q:8bZS2K1zG2GelDP50Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976972, "uuid": "5d383152-bddd-4933-8fe0-0c1107e21fd0", "value": 2464660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976972, "uuid": "f524b59d-fb03-4cd7-8c52-0f6ffe9fc963", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976972, "uuid": "9996150b-52d8-4926-97db-0b202d1abb2a", "value": "1A1CDE1AA11EB7BCC7FA63E1A6A710DD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16700bc5-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623976961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976961, "uuid": "4927c13c-9e72-4b3d-90a6-4f8c08db825b", "comment": "Malware payload (AsyncRAT)", "value": "09ab479559615bd51d4ce2283958d92d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976961, "uuid": "d088eb87-3882-4fb5-a689-9e0b19021bd0", "comment": "Malware payload (AsyncRAT)", "value": "74c4a2432b9364fde0c0597f44d6818296b45c623f14022b0e1bafaaa5d85508", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976961, "uuid": "a887c672-24aa-4155-a5ec-cc0ac639ff40", "comment": "Malware payload (AsyncRAT)", "value": "3acd48c0cc5aa6cfb69e16e6726d9ad1b19eba95", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976961, "uuid": "34bc0839-efdd-49ef-9fac-b20344eee1b3", "comment": "Malware payload (AsyncRAT)", "value": "b93ea73afb492a86184da43b31b7dec0460969c474ea742993a5d8fed38ce5b3cedecc207a8b9c40951fb2d4525b5772", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976961, "uuid": "2c086554-104c-48ac-a6b6-c41e56c10397", "value": "0472731587E0D372CBE317718A61D9244B60AE2D6A11B39BA0F93D5B3FDD503C0E6E29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976961, "uuid": "8c0d71dd-0e75-4e94-a933-70246004ac88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976961, "uuid": "0dbd194f-622c-4de3-aa0d-d10460d15bf3", "value": "192:R1ce0cI3dqS5YVIz4UgE1Dg11jP5wGIbJE4Ok:R1CcItbEMPgE1Dg11LOFbJE4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976961, "uuid": "aa86865b-f12f-46eb-adae-e1d6a8d6ffdc", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976961, "uuid": "3142787f-1b6d-4794-8c00-5c3cea5f77bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976961, "uuid": "490701cf-e692-45df-a344-1f5dfadfbe14", "value": "09AB479559615BD51D4CE2283958D92D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e4d61d-d021-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624012876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624012876, "uuid": "e866fdfb-58f5-41f4-a06e-3649721fa9f3", "comment": "Malware payload (SnakeKeylogger)", "value": "d8a960f613e009eef9f81887a39e7cd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624012876, "uuid": "d56fbb02-1480-4f74-86ed-7c943981cc4b", "comment": "Malware payload (SnakeKeylogger)", "value": "7598d6cadbbded8074763a1e8b0e8c24f125c0ceaf194c9f386acf9e8a811a28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624012876, "uuid": "bf875719-e85b-4f9c-8c2a-ab06ba8d5acd", "comment": "Malware payload (SnakeKeylogger)", "value": "52e658fc0d3d436594c06d1b9a75d2c065622d9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624012876, "uuid": "ad6a9e42-e791-4d1f-b761-f04551ed2531", "comment": "Malware payload (SnakeKeylogger)", "value": "a1afba825e73e4e1d2426acbbae3d375d2585f4194ca0dbbc0b83f49123d5c3b8ef42cb68d90fc7061fe93a56dd2e518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624012876, "uuid": "08d7a97d-ac54-4303-9ba2-f1cb89c55c4f", "value": "B4040227A1D1C9B7E543A6B31A72C7B9C3F292040174964B4B71BF7BB8710DA5E4B243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624012876, "uuid": "003994c7-568a-4d3d-aec0-e911f9853977", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624012876, "uuid": "7b01b6b3-b52b-4381-9601-b1778447e952", "value": "3072:wBynOpL12riocdMBXgdZHEUjPI8N99nXsTdgR/RY6Jqii4Xh2+xNUokoZ//utkHj:wBlL/WUEUj599nXkd0/b0iTXh7fpZnu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624012876, "uuid": "e35ea5d4-aa39-4ee9-9b0e-1f843ee8ea36", "value": 178546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624012876, "uuid": "6778b596-eeef-450d-bbd3-5f27c5d403dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624012876, "uuid": "a6c76a01-47c9-4613-ba22-2b4ad1f8a6da", "value": "consignment details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e133a6d8-d078-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624050315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050315, "uuid": "9f546597-3b8f-4bae-bfc4-99dcb7f0037f", "comment": "Malware payload", "value": "543a6392b1422e4580a2fa814d657c52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050315, "uuid": "970afbcb-6036-4f05-9888-6985f91519b1", "comment": "Malware payload", "value": "76f129a0fe66ce32231fd47a2e630b2a876e071c3851169f7e87babfa0b16360", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050315, "uuid": "7443513b-193a-485a-a454-daa38db75e66", "comment": "Malware payload", "value": "24f778a3a31d35401f063eecdb410dd12733b820", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050315, "uuid": "ce5a3d70-b429-4d66-bc0a-5023a2bba9b8", "comment": "Malware payload", "value": "c068546045d5626562382bec977e056a1c28b33819ad5e832799a8930fbfad21ddbbc30bf7c1ceed44f257815104faba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050315, "uuid": "5f4f9203-5f5c-4e9c-9c30-36fdffdeb24e", "value": "A93412F236E560ABD0470B712D3BDA29FFF6A7C89244329F7771AE6F2C15285CA11241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050315, "uuid": "0dc7e38d-26af-4b4d-a381-2ac9b078912a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050315, "uuid": "5af26f7e-54cf-4830-af7c-82ebd7bcf394", "value": "6144:cQqLEv09twVo4v+/U2zewu5/cMUDYo0lJE8R3Wqt:KEvK+7keOc1WS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624050315, "uuid": "0a4f922e-9a01-4c64-abdc-0ee1e41816c1", "value": 243639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624050315, "uuid": "c9e6f9a6-f01c-42e7-b92a-9d259165abf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050315, "uuid": "742ad72c-d97c-45ba-b2b9-b87a171b823c", "value": "4121.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ec56a0-d01c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624010695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010695, "uuid": "50e85c4c-8772-4972-b509-5ea241c7ebfe", "comment": "Malware payload (Mirai)", "value": "d3ec096b21bda3f16eedbbca78602233", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010695, "uuid": "1d90fc13-57c3-48c5-b19a-18bc21f9a4fb", "comment": "Malware payload (Mirai)", "value": "775f65da82cd13831f91dee47a12e74111e566979ca2b174771ba810169f9328", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010695, "uuid": "9b57edcc-11c5-4d00-aac8-3e77f7a8909b", "comment": "Malware payload (Mirai)", "value": "6b3e6850541a6c896aefa93f7ae75ed642f578b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010695, "uuid": "b46de619-8932-4e98-a5e3-8f3f6f9a5d55", "comment": "Malware payload (Mirai)", "value": "489b6e856d472f2c05f0b00fa2ded89ae2ba89020902215e5d840c2db43ca6fa05e2368136935278b43f4f94d0d8ff15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010695, "uuid": "07e14483-dc8a-4989-9993-ab39b2de1215", "value": "DCE2F16B024B0976C15E403BAB58B9BBF12185C48FA9815E2BC162C7CF7F4732B61D6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010695, "uuid": "f8875aa1-c2c3-4b9c-925e-9e053caeea35", "value": "768:u4gXGJK2+bBP76PQ8kogxGRWM9/aVi0pEFl5cnzXo:u4gXGwBBz8uuWMZaVi0EInM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624010695, "uuid": "35debe2f-08fa-4984-b197-9ffa97b4417e", "value": 31620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624010695, "uuid": "086e5f69-88b1-4c37-bf8f-cb728612418e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010695, "uuid": "1665a646-e004-4d1d-b777-24c5e5c3e020", "value": "d3ec096b21bda3f16eedbbca78602233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf6626c8-d001-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623999175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999175, "uuid": "e6673e19-87fd-437c-89f1-9d57fce86b31", "comment": "Malware payload (DanaBot)", "value": "53eee23b33da6edad3ec2918036cc62a", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999175, "uuid": "05685b8a-a371-4784-b7ce-79c76c7cd7b6", "comment": "Malware payload (DanaBot)", "value": "777196a3c6dba0ed8fd4f71c26ffda24348ee7e0daf2d135b2cd49a36f524e5e", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999175, "uuid": "0d551db7-a597-4b77-b2b7-46989b41bf70", "comment": "Malware payload (DanaBot)", "value": "628f558198ef064d62d4b62a265e083f7b611f2d", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999175, "uuid": "685cb4ce-1d7f-4c54-a35b-841a0445002e", "comment": "Malware payload (DanaBot)", "value": "e94394ea9d007a2de6f74f5a07f76136e22be3dc3824a338935ec7aa7fed31af357761ac3757b6f76726db2646dd91c1", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999175, "uuid": "72d3dc7e-ba20-4c8f-b53c-7f1515669a5a", "value": "70350210B6B1C035F5FA12F805B9C76DB62E3E719B2455CB62D82AED97285E4EC32307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999175, "uuid": "a892f310-fee4-4cd3-8ec1-f0c12c6897aa", "value": "924d9a2d7cc05ebebcdeae3f0201835c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999175, "uuid": "32c333ed-fa49-49ef-8439-1617f3ddfc27", "value": "24576:mxzOqoE4hdryggBOZwUWdPqul9P8zsfDvDIu://ehEvWdzx8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623999175, "uuid": "a2455a2c-b12e-4a30-86de-283915243179", "value": 1145344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623999175, "uuid": "6b13740b-b947-41ac-a434-554983dc6ece", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999175, "uuid": "5d3ed0c0-8180-4e3a-be90-87e9d56e2e20", "value": "53eee23b33da6edad3ec2918036cc62a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee95dc4-d007-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624001725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001725, "uuid": "0b633b7a-c6af-41f1-ae48-0080f446fc08", "comment": "Malware payload (Formbook)", "value": "716704ffe2145a72d2fba734acbd8ff0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001725, "uuid": "ad0b881d-0bce-4f8d-815b-a4095309842b", "comment": "Malware payload (Formbook)", "value": "77debd27c7e821a3a2c480f7b91377dd2706a2a19975132a5141f92d87160363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001725, "uuid": "6c290dab-ae5e-488c-ae88-1a98699590bc", "comment": "Malware payload (Formbook)", "value": "8a825ea35dc30e117e62dc768a0d56ce98d7f2a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001725, "uuid": "d858e160-1750-4e3d-8944-3ea390abffb5", "comment": "Malware payload (Formbook)", "value": "fb45f11e667899de01bc641318553212d57ca4fd012b370c8c2df928010c3d0cbf909a42ddf48e0bc7e470f60bb4c483", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001725, "uuid": "ac7c732e-cbae-4acf-974a-b127668260cc", "value": "9664127876D2C363ED16033BAE52294013A5E4356EA5DA6D6C40C3259D3BFF48D02BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001725, "uuid": "dd08c9c5-8bb5-4f5a-bdc8-8bd6fa5af48c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001725, "uuid": "a4dcfa83-0577-4b5a-8ab6-61e8ade17bf1", "value": "6144:iCMZFojxeKGZ519bvNgoiG/ewiI/Oe0tjjXpH9CyeK97Na:soj8j5nlgo52q0tnrN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624001725, "uuid": "d9cfecd4-6ed3-4c56-a464-f9f165304e6b", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624001725, "uuid": "00eb2015-ff5f-44fd-8381-45bf6c6bfdc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001725, "uuid": "a11b8b7d-3b01-4317-91ea-05ec410eebdc", "value": "Online Doc901.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8e16b6-cff7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623994605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994605, "uuid": "3187353a-bb43-4611-841c-54fae0dcc04d", "comment": "Malware payload (AgentTesla)", "value": "cea8f9c8ab91d0cf6d51aa715615dc75", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994605, "uuid": "7405557a-7b08-4ee4-997e-fee37e0c8e72", "comment": "Malware payload (AgentTesla)", "value": "77ee9bb85ad3e7b325c619eb99229546bd980ffed3accbc24821248992211fcb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994605, "uuid": "96196bf5-ab0d-4302-890e-7cba54eb548d", "comment": "Malware payload (AgentTesla)", "value": "397a6509ac1277357ad92338ab46e564121cb2e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994605, "uuid": "64bdb3a6-db25-41a3-b4e5-ece28754d55f", "comment": "Malware payload (AgentTesla)", "value": "a1f66955b0f6bb749866f1dbaaee0aaf5eb45b9c8ba6802ac1e1a115b24da37fe7218875478bace5178d343847e72bfa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994605, "uuid": "005821b1-b422-4984-abf7-3b7c6928a9c3", "value": "62B42311C2239AA3C84A66CAB9B297D954357D3CCBC25C5C8ABFAF4DD84851C074DE8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994605, "uuid": "077f2449-430a-4212-8fb0-d449e43d5e8d", "value": "12288:9E53UqyQe5SVzkppwMcayEVjnZcTtqQxAvycZoC4lwYdOog:y5ZvVzm3cpE9yTX8gWYdXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623994605, "uuid": "2e87b122-f5a7-4c3d-87e1-a4f4d597a1e7", "value": 509802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623994605, "uuid": "6e18bd0c-f032-448d-9809-54842c191a91", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994605, "uuid": "f2078b94-f01b-460d-89a8-c0b9f7648cda", "value": "MT-103.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc8a6ef6-d01d-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011277, "uuid": "83a38975-729c-46f6-abbc-bdee89fbb90a", "comment": "Malware payload (Mirai)", "value": "4f44b707971e13303ce3aef38c1362a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011277, "uuid": "6bd47256-71c7-4134-b426-d240a2c8bff1", "comment": "Malware payload (Mirai)", "value": "7895db435c980ef8558ea407bc3c8d8dee168b827b91c6de47b39ba97e7ba492", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011277, "uuid": "6954f4bd-584b-410c-b5ba-80484cd58e99", "comment": "Malware payload (Mirai)", "value": "28426149f767d5f57f7c2306bf4aa5b008d0dffb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011277, "uuid": "171611ca-79a0-4fb8-96c1-30e26acb9a03", "comment": "Malware payload (Mirai)", "value": "7b340b0042bc7bcf197a2620244b3135ec5108ba61729a787c3151b50cef389b0bdca9348d1ec2e6f2c802d82e1fb924", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011277, "uuid": "36b3c582-df77-40d8-bfcf-8708f58037e5", "value": "90D2E1A0D3A1EF81DDF7985A52D0D6C4336213E5FEC3CE0274594FA11A17C86B22EE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011277, "uuid": "712de705-8a86-43f8-a93c-c978cf0c1fee", "value": "384:yIezHP42iBZdwhx2tLzMUJN/TsIKfS30K8lLCMS/VUqF5lIKw2XxLxnzM4uVcqgP:Ev4DGhC/ileMVqFLN5Xrw4uVcqgw09z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011277, "uuid": "02f84ab7-46f9-4949-836b-ba28f86f95b4", "value": 29920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011277, "uuid": "bf3f0934-f11b-4f3c-9934-49a822a513db", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011277, "uuid": "e4b78eb0-5528-4c34-a750-be62de5b6737", "value": "4f44b707971e13303ce3aef38c1362a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13aac142-d031-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1624019476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019476, "uuid": "09de7907-3b09-42de-8521-3a6a6178d0cd", "comment": "Malware payload (Smoke Loader)", "value": "ab7ad47fba03a9bf02ef644227661909", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019476, "uuid": "8549f1a7-f877-4273-8fd1-8f1965d75c0f", "comment": "Malware payload (Smoke Loader)", "value": "789e58502db7458fefcde8f8f920dfbf9299461146828ddba1b57d191b07e9c9", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019476, "uuid": "8e24447c-8753-416e-a319-307d22af9c9d", "comment": "Malware payload (Smoke Loader)", "value": "52c620a448c691e0895731bc2384cc10bacfcf17", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019476, "uuid": "7caef70e-1812-4fe7-9bdc-1a0dc8506b68", "comment": "Malware payload (Smoke Loader)", "value": "042d18b0041638c2f7a2136044ec6dca22a0a3e7448a35de98d08578c6c6b39ba4cb3a5d5c4e5353ce5f9757f2152094", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019476, "uuid": "96440acb-9571-42b9-9117-aab8bdece1bd", "value": "96648D10B6A0C034FAF612F859BA936CA53D7AB15B2450CFA2D51AEE56346F0FC3174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019476, "uuid": "c62ece85-c9b3-4007-9f53-44c123c50f7f", "value": "866e8b0fa01ec6fd81db7579c1be52ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019476, "uuid": "bd7f23b9-f0b5-44f5-8ef1-b85b58542e50", "value": "6144:pr22sfYpE2Iz2AaK0xe6LJZ79AqYQm1zuZgfV6RlSvEY:02+YpE2Iz2AaK0lLJBq7QmRAoVySvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624019476, "uuid": "21508eee-85f4-444b-8c8b-d0bc80a5ec14", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624019476, "uuid": "780a6fe9-259b-4751-a912-45574b9de9e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019476, "uuid": "e5215b11-6deb-40a2-b6a8-d120b94cdd0c", "value": "ab7ad47fba03a9bf02ef644227661909.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13fd0caa-cfec-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623989841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623989841, "uuid": "2f10e1eb-723f-4c52-8735-a1047c24427f", "comment": "Malware payload", "value": "a6c3d9dfddab65707a01b05c717c6a57", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623989841, "uuid": "848c454e-4143-492f-b973-7d08f0b68892", "comment": "Malware payload", "value": "7963fb66dcc4c97886484a36c7be5d94fadc99ed494cbfa1238561c1f2213275", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623989841, "uuid": "db6a26e9-48c6-41f4-bb3c-2a1a7f9a27e5", "comment": "Malware payload", "value": "fc9ce7a3484ec2ca53fb92d9de25312c28ec26ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623989841, "uuid": "bde018f7-4e20-41c9-ac59-76328181518c", "comment": "Malware payload", "value": "2e5ea367b1cf34014824df932216087be5f620a28bd4cee2ec10bfcd72eeb474ed1cb546932990f6cca6dc3a5a1bae01", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623989841, "uuid": "735c4e9b-7ffa-47eb-9ff0-7ea7ce33aa59", "value": "FD85AB36F89532A2E84EC5B406B01DA403F66DB0126F97C43276749FC237F6D9A78A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623989841, "uuid": "d354b37a-7c7c-44ce-ab30-d8e41a8cdf09", "value": "24576:IOe32CfTPovQoFSDp9KqMDv3xy3YBrGoixkNDULaXp:IO42CfTwvwIqM9gOhBULE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623989841, "uuid": "de79efde-b5c5-41e1-8b2c-eff5b71b57a7", "value": 1765090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623989841, "uuid": "b4683acf-a556-42c6-8365-692ca661f7b4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623989841, "uuid": "c9ebe0b3-79b0-4919-9252-df77432d841c", "value": "StarBurn.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9f5c1d-d076-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1624049158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049158, "uuid": "c425033e-8b32-4e0f-950d-d8003a777f52", "comment": "Malware payload (QuasarRAT)", "value": "74ef7d7f4aad8c60a09e7ee99daf2487", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049158, "uuid": "36dc3a07-156d-4aa9-b175-a918f7f4463e", "comment": "Malware payload (QuasarRAT)", "value": "79c88080262db1ffc03376d9a98fe8ba71508b03c4f2a28af50f53b8aa235bf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049158, "uuid": "43fa5149-df17-4ade-ab50-fa94efcef955", "comment": "Malware payload (QuasarRAT)", "value": "15ea7bb2b5698711d6e24461c297ab88506f2b6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049158, "uuid": "9ea3cb3f-9745-44b6-ab79-1255f4de47e3", "comment": "Malware payload (QuasarRAT)", "value": "7b769188b0a459bfead5491ee4d9634b3722c2ce0ee50779dd694c1437bf5e6bfba615cd29a8c2c89efd920d4b07474d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049158, "uuid": "a0d0bf09-7ad1-416c-9a15-afb65e680746", "value": "18352352368090C2D2762678E68D7AB338B4FDB523A006FB37656D996738DE3853C743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049158, "uuid": "6551c7fc-16cd-4c2a-ad3b-1d03ac058b46", "value": "b960c15baaf7aed95c4a7eb08f9ac0f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049158, "uuid": "00c8440a-1a76-43cd-8749-737418a87143", "value": "24576:z12HTeqzMv9FEmcCiCHZdHJSLCaJTQSBYk6B9/KKQGG5D2uAGfInGrzvSNiZfg6q:pAV8c7CH7HJSLCaJMSv6y9GKDseSIZ4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624049158, "uuid": "380670e3-369f-4502-b070-6496bda1a84c", "value": 1140349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624049158, "uuid": "50ad0a1e-e8a8-4e73-8720-368c76a5e58d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049158, "uuid": "cebaea31-1c12-4c30-93f2-616305e3ace7", "value": "74EF7D7F4AAD8C60A09E7EE99DAF2487.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7d3f09-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623977160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623977160, "uuid": "238930f2-08a4-4ee0-8499-42ae99cbb9ed", "comment": "Malware payload", "value": "ee8ec71a488cd06f09e1a1ada0637709", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623977160, "uuid": "adba94b8-940c-4709-b278-99cc67f7f916", "comment": "Malware payload", "value": "79e0a26bc2c9c902744c618ad7af045e5b1ced50f98ca066a33df44218f84702", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623977160, "uuid": "229e2f48-546a-4bd1-aed3-8bbb3e3adce2", "comment": "Malware payload", "value": "8d1868ea322f936b848054297739bc4eebcfd961", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623977160, "uuid": "2278b669-d49f-4c3b-b011-11f98fddf0b8", "comment": "Malware payload", "value": "6783313bcf025f508f81408ae8f493859074c9070a73d7db33ce13c095585c0d46209eacf5594b83fd37f1eb41f7bce3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623977160, "uuid": "6152370a-bdd6-4331-9243-a4bc8db37aa1", "value": "5FF53343FC826873F0601D33892897E5697A7D301F16CA9BA3E8195CAA351E1773E772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623977160, "uuid": "8ef2729a-7523-4feb-9637-55f9f9affc63", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623977160, "uuid": "790d9e34-2356-44ab-ac80-1c04032abe20", "value": "98304:J/zMBaj6Ve8EKTz/rSrSCQryqs9dm0ekXCy:RMa2elK2rSCFgkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623977160, "uuid": "9d89ad66-e776-4b3e-9adf-ef7786486f09", "value": 3641309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623977160, "uuid": "31fe1df3-320c-4ef9-b302-2af33e2c3604", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623977160, "uuid": "f3778aa3-ba70-4a43-90e7-1a5a9dde0514", "value": "ee8ec71a488cd06f09e1a1ada0637709", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc6e8f7-cff7-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623994822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994822, "uuid": "a56f7451-051a-4a7f-b661-5ad31a0a175a", "comment": "Malware payload (Loki)", "value": "a9e1b3e3c6ddac6d39b98366c8013a06", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994822, "uuid": "c897315f-3daf-4c37-8161-52be3b5e896b", "comment": "Malware payload (Loki)", "value": "7a7983e48b7476ce96bfde0978015c4e89dd58357d421be00ab225e85d53f21e", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994822, "uuid": "3ccdef71-0d5f-4fc9-bef9-e391e3bbabd0", "comment": "Malware payload (Loki)", "value": "7e763bcb9b700f91fd79ef276aa874e616f2e9d9", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994822, "uuid": "1cb29d28-c006-4c96-8d2a-484d9410e74e", "comment": "Malware payload (Loki)", "value": "5fd131366c98e02ff5a16e163a86c9d5e0f8107bb99b1e700be4ddc393ddf4e1f0d9055fd86ee5aa7401ea4192099fbc", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994822, "uuid": "990ee8cc-f300-49b3-9dec-55e5f98b8172", "value": "6C7423BA543E5DF196B142F8C0145E6845DCB53CB02FCC8BB7641EBC694ED728D92E28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994822, "uuid": "8ee33835-0055-4c09-873d-af51af1e2f14", "value": "6144:SdyS5XGD+boKOsH2y4Hw1Sl+yjsFuILegPaoOpYe/wFMcmoXoF+NMgLqDurEFU+:+3Ge/HC6SwyRYegPaoTwZUoMhvEFU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623994822, "uuid": "e357aa26-ac6f-4d6b-8266-0e347e41adc4", "value": 364661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623994822, "uuid": "6330fc76-360b-4e8a-bf13-995a7d8f88eb", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994822, "uuid": "5cbfd094-a9b1-4b8f-af18-d650ae909e88", "value": "PETRONAS INVOICE.PDF.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f326bf45-d043-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624027582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624027582, "uuid": "4b0e15cb-c0ae-45cb-9373-86f862c2278d", "comment": "Malware payload (RedLineStealer)", "value": "546a9eca4d933c615799614c06eebb24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624027582, "uuid": "1d6b05ff-56a9-43d5-af75-acf68fdcae38", "comment": "Malware payload (RedLineStealer)", "value": "7a99c24c494029afa4e8bad43a9e1bfa9e6fca920e42132ee9eaf914fa3e613b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624027582, "uuid": "a5f5d7d2-d1bd-4f71-92b6-0ce9c02ba8ef", "comment": "Malware payload (RedLineStealer)", "value": "977b118f037afbd3f6645280768747e4cb670329", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624027582, "uuid": "38b0784b-03d2-49a4-8dec-19507261898a", "comment": "Malware payload (RedLineStealer)", "value": "417122d5d7bc2eef746c6f126b101e00e1d2254764a155d78e3e8da96c81b2f7ec377bcb32547a09e5b3790dfc2c134b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624027582, "uuid": "ee7114f1-3cf7-42b3-a784-f93ba154c5f8", "value": "C484BF10FE90C035F5F612F85AB6C7B9A53D7AB19B2450CF52D52AEA16346E0EC3270B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624027582, "uuid": "71e5769d-6733-4936-89c1-3649b851a52b", "value": "41601b6802e3e38dfaeac494532218f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624027582, "uuid": "9bea3d99-939b-4d16-a4f4-47a90256a75c", "value": "6144:bmUCfnUsBvZnZMCV7Q2aHjC2uqPL2jXfXNz1lMUQbnFXFzkcqofdzKw:XCfUsBxnZMK7C/lsHlUbpFoFcKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624027582, "uuid": "107db741-9420-49dd-9300-a9473d6b476a", "value": 387584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624027582, "uuid": "1be50178-a3b5-4dfe-97d9-9b9c6d4a9bb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624027582, "uuid": "4e926920-2c62-4e40-933e-4b15901742b1", "value": "546a9eca4d933c615799614c06eebb24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0f0837-d02c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624017321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017321, "uuid": "09cf7320-af1f-4b61-8133-739eed3029bb", "comment": "Malware payload", "value": "d0e5906d833f62a6ee23eceef6ad46d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017321, "uuid": "c6b7f0d8-364c-4a9e-b336-ffc6a98af83d", "comment": "Malware payload", "value": "7ae57fdb72d4c4c6008ea962c9b824e889d92da020915ef62c4d3e3f3eb9c613", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017321, "uuid": "23eb18a3-6e73-407b-b4c0-5ee49f0c1621", "comment": "Malware payload", "value": "768c07016da6a3242b1897b412ef1c16e4a700fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017321, "uuid": "b2417f95-c94b-4e6b-a9c6-b8e848774dd8", "comment": "Malware payload", "value": "365949e33294c3bbdeb27fe6241cca8f7fc755e4c6e18c214399b8bf7a791fbf979afa0286ab1baa8c72f5ce7669ae06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017321, "uuid": "2d71ab20-2e62-462f-a7f4-2b7e9eef3d7b", "value": "ED92E115D68BA7F5D278A83D2BD6A9762F00724410CBF96A64D434C83E120187B4AF57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017321, "uuid": "383f0a6b-d906-4fd3-8fff-c28642613033", "value": "384:xcz2m3P/t/2nhAp7RWfhTWR5j8nn58gjAI8xxaauLYQzel2B5bH:xXqPp2nh6WfRWDM5kIDsQF5bH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624017321, "uuid": "49074c4e-9a3e-40d6-b45d-c986a29e6e82", "value": 20492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624017321, "uuid": "169b4e66-573a-4c42-8f18-2ad5319c0ba5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017321, "uuid": "2bbb15d0-0ebe-4cf0-8796-6e9bd9a16896", "value": "Samael.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea9b081-d006-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624001134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001134, "uuid": "2be69e7b-b442-48a8-ac87-7aeb17534881", "comment": "Malware payload (AgentTesla)", "value": "c4266d2ad671a7ee2bc24b944056ff70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001134, "uuid": "a3e3d2c4-e205-4f19-aa8c-10f318b65dbc", "comment": "Malware payload (AgentTesla)", "value": "7d7a782ae3f5cc42e7fe43693df597c951ac3e0cf0b834eb15779ae522c3897f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001134, "uuid": "24d42c1a-f02a-42fe-abbc-38a836004092", "comment": "Malware payload (AgentTesla)", "value": "2ba86d55310884995529fe5c8c9563c25ecbcab8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001134, "uuid": "5df227e8-a6dc-41d5-847f-75360070cf42", "comment": "Malware payload (AgentTesla)", "value": "aef6973ca9f2aa2d636ae2851521a1398ba45a0944248bcd8343eef21445b8c5441cf31afcf7533b20e29e404ef8c0f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001134, "uuid": "8d2ee796-c85d-4d7c-9e40-459eda5cb89a", "value": "02E4CF343AEAA129F177EF795AE474C69BEEB6233703D45D289103870623E41DDC163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001134, "uuid": "a6d7dda4-4fb5-4ccd-bc1a-bcc9b8cb074b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001134, "uuid": "eff033b6-b089-4790-9ecb-c00cc886ce80", "value": "12288:JoC2hlm4S4F3M9yWm2iNPUcveZ0skAWeexNnh7dSQATWtt1az487XbA3ODqaeW15:JPSWm1hUEqGnnpdSVWtdOXEAJ3uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624001134, "uuid": "0be94220-41f5-472d-af5a-117d094dc2d1", "value": 697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624001134, "uuid": "44090d40-48e7-44ec-aff5-49aff30fc3b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001134, "uuid": "eb82dc23-9b8b-491c-8bf3-cca25ac18fde", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c8e6e2-d02c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624017312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017312, "uuid": "ebac7928-6c0a-4b93-9382-bdd37f3b0e24", "comment": "Malware payload", "value": "3c041f3ee1be32319082140228f0049c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017312, "uuid": "73a939f3-a0f5-44f1-8bc4-1ff445f37087", "comment": "Malware payload", "value": "7ddda79828c65e60e01977fa45b9d7aeef980d6a2f89b753c6ad02b46898eef9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017312, "uuid": "567de1ba-f693-4354-bf13-e6b3c3c38d8b", "comment": "Malware payload", "value": "6e693e1a91c122c868d930a79a85d9756d87fa26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017312, "uuid": "189a9aa6-b2ed-442b-9014-002f5d219d89", "comment": "Malware payload", "value": "a226574654b07c71184505e6cf81cc6de084604f3b252b5b1782f2ea75406c9c964330f042fdd29a37b150506a135e6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017312, "uuid": "66f3a552-8d32-4fdf-a7d1-3629b1198796", "value": "C092D189FF18D546FA8242380B7A8590FCA797F5D03A289587CF10F87C3A91C7919E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017312, "uuid": "01880228-4752-47d6-af49-8d15a944fa96", "value": "384:gXx3jbCCawTidkSRqjyUd8o6P3aQDOcoWPoIJ7jKiQaB3cVYbVYN+0CK6TAo:gXx3jja0SQyUl62cJow7jKid3cVYZYUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624017312, "uuid": "2e631fe9-7def-41d2-9674-8ab62c4f1426", "value": 20388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624017312, "uuid": "dc953236-8f7f-40c9-a7ff-30288b30cf97", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017312, "uuid": "3df90a1f-4cd1-4ece-8931-bf11a6dd9101", "value": "Samael.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c9ff31-d049-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624029813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029813, "uuid": "3f370d23-c475-46d3-894d-d5dffaa485bd", "comment": "Malware payload", "value": "ad89c0026b6a96e57706818d1d79ecfa", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "email attachment", "colour": "#BDFE05", "exportable": true, "hide_tag": false }, { "name": "possible phish", "colour": "#DA6477", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029813, "uuid": "8a693dbb-9978-4f9f-8430-08754a433c1a", "comment": "Malware payload", "value": "7e4c0417899e153d991ff94aa7fac42f84cfc85b5abd756048b1e38d9c3d84e8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "email attachment", "colour": "#BDFE05", "exportable": true, "hide_tag": false }, { "name": "possible phish", "colour": "#DA6477", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029813, "uuid": "7acfe485-77e7-4ac9-a78e-f857444caa11", "comment": "Malware payload", "value": "7c99e1624d5858eb477b0fbf1b19b7783b7ce929", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "email attachment", "colour": "#BDFE05", "exportable": true, "hide_tag": false }, { "name": "possible phish", "colour": "#DA6477", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029813, "uuid": "c4e33a3c-b45a-4fee-b0ee-2186553f1d96", "comment": "Malware payload", "value": "ad1b28ac2f8b9555b41099e6e27cbedc344a9569eb1678ab2e01f6f5d57ad87dbfd175ba205cad9be10037c1a05d488d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "email attachment", "colour": "#BDFE05", "exportable": true, "hide_tag": false }, { "name": "possible phish", "colour": "#DA6477", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029813, "uuid": "27782686-8e90-47ee-9b93-44716dc75cd4", "value": "83C2B0A8E8431924C2C2E8FE81571CDDF44D2393C624A6DFF935E139DE808916BCBB46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029813, "uuid": "095d24a8-a666-4b6b-a011-fb071c4cf179", "value": "384:D0ASYJycgz/V7aTeL3sZBV1vIslErMpFSA4SNrElzCg06w+mw5Lr6REVpWzaegHt:wrYJyVV5L+EMWtSNrEog3pX7V6a3mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624029813, "uuid": "afd9d9f5-e393-4152-a311-561dac4a3ab0", "value": 26317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624029813, "uuid": "e7d07d73-8db3-4897-be46-e65c8aa20a13", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029813, "uuid": "7363acd9-9cd4-4135-878d-ff533186c6b9", "value": "CHECKERS..docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf15380-d047-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624029182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029182, "uuid": "238ad89d-e76c-4544-8dec-d8c3ba36fdcf", "comment": "Malware payload (AgentTesla)", "value": "3789956222dde8475824ca54589778c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029182, "uuid": "9b5f26ae-1f64-4f9b-8a2a-b87b34f9818c", "comment": "Malware payload (AgentTesla)", "value": "7e919a3abd636449a9cf40d7a2a06dda7a17000a20dd9983985ca8668a0cf1d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029182, "uuid": "ec0b8d00-ce34-4750-88ae-8b3b0140ee4b", "comment": "Malware payload (AgentTesla)", "value": "86ca58027c72ad6c763075383a0ac5a56d1205ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029182, "uuid": "b2ce6be9-431c-4621-8308-ddd13756a4a1", "comment": "Malware payload (AgentTesla)", "value": "f91113e89e3a6d76ed14d5dd230439c59e450076d9ed9533bbdd14812793818f9b3eed154db39c99f53460b76f9d27e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029182, "uuid": "531ac169-5e72-4f11-bca7-39b712642e58", "value": "FD257B9D721072EFC857D4729EA81CA8EA507CBB931F4203942735AD9A7D897CF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029182, "uuid": "7487626f-97c0-4dbb-9a6c-8f9d975b5c4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029182, "uuid": "fb4002f4-f861-4a33-a747-8d97c9c52522", "value": "12288:xLhMDglS0aubAi96p92MOQIrGbAxRVIisDmFqO10RNfucI+Fi9gF2nO7+JIIHG/D:f40auaUMOQPAdsU0ffucIcV2XHGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624029182, "uuid": "7befd2f7-9fa7-4f61-aa2b-1facb8de2b8e", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624029182, "uuid": "5fe12270-c18c-44b8-8503-3c18829b167e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029182, "uuid": "95b01bc8-1981-40bd-a93f-4ba526e5c1bd", "value": "70654 SSEBACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ef4650-d026-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624014774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014774, "uuid": "17a0b15a-2476-4e14-a57b-a6eb9c193af4", "comment": "Malware payload (Mirai)", "value": "6ca1fb07192efed99908a5b47b03deaf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014774, "uuid": "d6fabc39-e993-4516-a51f-6d64b33ca7ea", "comment": "Malware payload (Mirai)", "value": "7edb2ff320e99a1b92c7fa51dcd485edbc15eb4d23520ee26ed0d42600a733a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014774, "uuid": "d100abb4-53ef-4454-932d-72128f7fa827", "comment": "Malware payload (Mirai)", "value": "c2b55fbe9fc78400c11e9f8ed15d68ec962197e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014774, "uuid": "a5708321-d778-4068-97c1-a4e07ae0109f", "comment": "Malware payload (Mirai)", "value": "8519335eb8cd4ff14822c0607b61e2f0dba51dc1579f65a03321e5412ee57f52a21f394027b26161505a971ca5f59e95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014774, "uuid": "ca225129-7378-4c6e-a34e-d075edc144fa", "value": "8B531856F8914F21C4D512BAF92E254E371617E8E2DEB2239D202F217BC792B0E37D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014774, "uuid": "31167590-83eb-430f-af31-bf0d9aa2b1d4", "value": "1536:d0n26gntugqg5IyloM58D03EMqi+HhGHNza10aK:ugtuqG6QHhGHNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624014774, "uuid": "3517d8e9-b9a0-4f3c-8310-94e3291d3f9e", "value": 65548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624014774, "uuid": "89a609a2-bffd-4a00-bb75-3d5a506f20e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014774, "uuid": "741d9822-bb42-40c0-9716-d62869154507", "value": "6ca1fb07192efed99908a5b47b03deaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195b7778-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1623976966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976966, "uuid": "c8e86531-21dd-4057-9176-3d12f429588c", "comment": "Malware payload (BitRAT)", "value": "1b0b83981dd569c9537571c5171a80c3", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976966, "uuid": "0b043621-fc6e-4302-bc03-6c9ef57cf4d3", "comment": "Malware payload (BitRAT)", "value": "7f38a7aaa38b085cb58239af935b98c38ea41acd4d489c57dea812a99792da02", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976966, "uuid": "53d537fc-7e36-45b4-b631-6f32e99ae817", "comment": "Malware payload (BitRAT)", "value": "02af51382d6e3b91e132bc657269c293da7a5c34", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976966, "uuid": "02983775-7d7b-480d-83c8-2f56f2a8a4d1", "comment": "Malware payload (BitRAT)", "value": "3d3cf1f4fa7b70eff97b3f753d97b32cc4c3902317d8747f28798352f2ac16a836eaf8a480b96588231ddefe1eda002c", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976966, "uuid": "9a8f2fa2-ce25-4adb-b1a0-7d4086dac637", "value": "5DB6233F7268643EC5AF0A3109B3A320593BB762656A8C5F17F4091DCF765602F3B626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976966, "uuid": "39a3d6ca-c8fb-48cb-84c1-1f6267511987", "value": "aad05474bfee082c9529c0427d51edae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976966, "uuid": "52827ac8-eccc-49a4-ad88-c95e11229598", "value": "196608:6Zd5iA62TzZune18PWFPt+uwoGADQHOSHC7cuGljyqX:wvZv6PW2ut0uSHC7cuGljy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976966, "uuid": "f4c1f552-2875-485f-a66d-829df2497cf3", "value": 11397120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976966, "uuid": "49982f67-cfda-4290-8b25-bcfec76cb620", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976966, "uuid": "5906be9a-0bd0-410e-8a4e-85d84d684ac7", "value": "1B0B83981DD569C9537571C5171A80C3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab24d823-d01e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011570, "uuid": "ea8b3e49-5187-4f8f-93e5-06a1fc3b245b", "comment": "Malware payload (Mirai)", "value": "dc917eb8af414332bde75d0e472b1aae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011570, "uuid": "0bded2b9-dff3-45d7-bb16-bb0ff398a02a", "comment": "Malware payload (Mirai)", "value": "7f4fdb5c95d6ff025f96e7bb0ea86bd87311fec453f321be1050ca3094d85a1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011570, "uuid": "0747118e-66a2-4d30-9cc9-a1da13414ef7", "comment": "Malware payload (Mirai)", "value": "53a0b502866698108abffd025d5d0631949a3a6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011570, "uuid": "25387c64-c9c9-4d57-aa8a-3a9aa66394e7", "comment": "Malware payload (Mirai)", "value": "4f242c8a1eacd215735ec75fc4445ec602ccf0698546358b7533859582562b1ac24010c3c8cb249158c240bf0892d28a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011570, "uuid": "a54d412e-be64-420e-8862-0d6bf3836e3b", "value": "4AE2D0BE17010A96D76A58BD4ED10BB25E200BB62401EC277E5CBAD39D264E03DD6ED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011570, "uuid": "1d84d4d2-5891-4671-bb76-5102bacc314d", "value": "768:BFCD1yNhMST/eWyJnGR36ea/wt4b2cuddJgGlzDpbuR1Jx:mUNhhjeWyJA6lwt48VJu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011570, "uuid": "752d349b-004b-4715-aff5-ba8d8a9660f4", "value": 32780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011570, "uuid": "cd210bfb-1859-4d2d-8527-2a99a021a6bc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011570, "uuid": "8d50e83d-36ed-4ffa-a7fe-1e4bad2dee6e", "value": "dc917eb8af414332bde75d0e472b1aae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934ec833-d076-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624049326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049326, "uuid": "aac7bf15-7428-43b5-a217-2de922bf3b19", "comment": "Malware payload", "value": "f79cd0ad1f929fdc2263ff6499be9a63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049326, "uuid": "3e013ec6-196f-4bb6-84ca-ffc509cf8302", "comment": "Malware payload", "value": "803d374b6e236873f3ca7c55a94b6b7827083559c750625e8a00a669cf0995d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049326, "uuid": "e8ad0e5f-4420-4afe-b08b-68d23db41527", "comment": "Malware payload", "value": "a70044e014b5f54133b2202cbd29797557b966bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049326, "uuid": "e21ca4d4-de26-4b30-b06c-6ba63a430c53", "comment": "Malware payload", "value": "b47c554e951b0dedcacc9a67aaaeae2be485887b0a913e79cbd545843f61088520591c9965ba02578095b3860e0dd8c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049326, "uuid": "cfd6c702-ec0a-4cee-b543-f79947eaae7d", "value": "79E4BE203AEEA129F177EF765AE47596DBEEB6233703D45D289103870613E80CDD163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049326, "uuid": "d3c2c2cb-f9d5-43fe-b63e-1bb664eb22b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049326, "uuid": "a7d3063d-f798-4ca0-9f57-ed60635d8d16", "value": "12288:bpoE0hlm4S4F3M9yKm2iN0+7qEaCzhpvpCZMngpnZSUw7H3OelaRjm9oB8qQpUc9:bpoRWa1GtLCL4ungpnZcH3OeURS9oQg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624049326, "uuid": "66af3b39-49d5-4909-be2e-8526b7955516", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624049326, "uuid": "3bdf763a-ad46-445e-8796-6fa13aa6f3c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049326, "uuid": "5a8f4b6a-c819-40b1-8a8e-b0dfe181700e", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a0f802-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1623976934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976934, "uuid": "98e8a0b3-324e-4ff8-8938-e6045b425b1d", "comment": "Malware payload (Adware.FileTour)", "value": "1c4fa84fbc497731b8c3a8b130b1acaa", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976934, "uuid": "8bc578d0-7d13-448c-9a93-ea7741e1e721", "comment": "Malware payload (Adware.FileTour)", "value": "8040940621af7b77ecbb66d16ca8fc924900960d48665247aa3f77d4de560c9a", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976934, "uuid": "bd0208f5-4379-4e6f-926a-7d160552fae3", "comment": "Malware payload (Adware.FileTour)", "value": "3018621947f9a887fdc9803e4a90beff61b452d1", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976934, "uuid": "527af413-fec9-4ffc-abe0-c268ca1cc157", "comment": "Malware payload (Adware.FileTour)", "value": "2796b2581e9d1ed81b6c6f0b2371b9f65b7354f7666a63d20ecb598f34e1e3334142c5d709fda1a0eac2c5ee8ed9566f", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976934, "uuid": "f953ed51-2556-4f86-8fbf-7221caa61a5f", "value": "01E53308BB60D016EAD58B743D4EBF336F5E9B5A06712C457FA06B86AA16131980FF07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976934, "uuid": "7672842b-03cd-4ca0-8f7e-16bcec8ba7c4", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976934, "uuid": "8fa79ea2-14cf-48b5-8338-b8210de427c3", "value": "98304:JaYGDH+SH8WUt9P2MOvMRlkTHdofxqEWJ1SqFrumw:JalHTcWQ92vURlQHFLJ1Smr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976934, "uuid": "fa0f6dc7-7f3e-420a-a4b9-e2c8132064f1", "value": 3286558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976934, "uuid": "be78067a-2f5b-40cc-a8da-b8e6fbba6d50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976934, "uuid": "3cd8020b-218a-484c-beec-4588f5ee31ad", "value": "1C4FA84FBC497731B8C3A8B130B1ACAA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806c3fc6-d080-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624053589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624053589, "uuid": "3eebc4a1-5741-4599-b222-21ebb96f8e92", "comment": "Malware payload", "value": "8021e5c041aa213fc61651ebe4c1aec3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Orcus", "colour": "#FD0BBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624053589, "uuid": "a7739634-592d-4a64-bd24-a69af1661560", "comment": "Malware payload", "value": "81074c41b76fd86ce228d266821c33d86a7448f30f58966d7990b77ba321552e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Orcus", "colour": "#FD0BBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624053589, "uuid": "9ae8a9c2-2336-4e8c-ac8f-249fe8a00da8", "comment": "Malware payload", "value": "a3eb185ac2d5b3103d6ef1d7d1c173c48368757d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Orcus", "colour": "#FD0BBC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624053589, "uuid": "7ca6118f-ee49-497b-bc9f-cdd433bca6c1", "comment": "Malware payload", "value": "9aa37c4069177703ba8059332b6ea28f345378d4b9e054e712bdfda1ec4f20e10f843ffb6604c0a6a1a8a8351525a47b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Orcus", "colour": "#FD0BBC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624053589, "uuid": "0d6fb444-bea0-4606-bfb7-44a75c20229d", "value": "C0A6237532587A9CC03E85349D33FDC4A7F5A50E05B9E6EDB5EAA1D02F5FA00EA02706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624053589, "uuid": "08d06a73-b826-4b44-a58b-82468c2da44c", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624053589, "uuid": "7a9778a1-9f7e-4f06-ae19-ff46864c0340", "value": "196608:nmEYXv1GVznCi1rEM3c6gTWk8nZNLEdbVs0e/oF1jnGfqlSYID7arA:nmEYfcznrqbWkAydbS0mzqavv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624053589, "uuid": "7da12003-08aa-4b86-ae6a-f5a9b8510068", "value": 9476096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624053589, "uuid": "d8c3a600-1745-4f80-8aee-61ac1338fc24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624053589, "uuid": "0c481e82-9954-42c7-b2d9-4fd5d72aed86", "value": "Loader_neverlose.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ebdda2c-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (Amadey)", "timestamp": 1623977001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623977001, "uuid": "47c51056-d612-4558-bea6-f3499a272220", "comment": "Malware payload (Amadey)", "value": "3836079c11cefce63e18c5d66f9bd1fd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623977001, "uuid": "fd876e4a-d83d-4839-9c08-19a2dc530311", "comment": "Malware payload (Amadey)", "value": "82235c52f0d9972900d487b46ced966e6813bdd10c87269355df29b9de066b87", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623977001, "uuid": "8736333a-4b3e-409a-b216-2d5d0e532222", "comment": "Malware payload (Amadey)", "value": "1f38562df396ef665c680cd14a533e73b0d97713", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623977001, "uuid": "841288bc-28ea-4f20-b589-d0e9ffd0fe45", "comment": "Malware payload (Amadey)", "value": "454e733898b02aac1f341d2680899f5a2caf68594b2118e3b4db2e0b59852b1c7396275a4132926b1425df91aa6892b2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623977001, "uuid": "f3eda8aa-8c67-4cae-a429-c891b587a52f", "value": "F7640152A6688DC3FB44D7B59F2D9A501E607F403E16DE46280C2D086D3D2CEA7DB26F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623977001, "uuid": "bfd31c37-3555-49bc-8e18-c201f9425cc1", "value": "9c97ae43b43a6026d81f0169e8728035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623977001, "uuid": "0198f0ab-1406-4971-9446-68cc31b8c4d7", "value": "6144:KziPuFMFcKteCdiSa7X4SfGmrLUcoWaIx3Vl3t/aJm7TVP/pNUs:KzimaFcGeCcSeTfGmXUDWdl3t/MEVP/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623977001, "uuid": "39343ac7-523e-47d9-81af-32e9c0d22370", "value": 322048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623977001, "uuid": "4e81e5b0-61ee-49d1-8bbb-0a7d29d51c9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623977001, "uuid": "407fd61e-b253-4987-9e1f-3a42a72de54d", "value": "82235C52F0D9972900D487B46CED966E6813BDD10C872.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4dcbe94-d07a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624051154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051154, "uuid": "65ebe85f-b104-4c74-832c-7b05ac04dd9e", "comment": "Malware payload", "value": "0e2d4679f68796e9dd0d663137cb9e12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051154, "uuid": "3bd1f1b5-ce23-46fa-abfe-9f7a8e3dc946", "comment": "Malware payload", "value": "8249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc079870", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051154, "uuid": "38fef32b-c3f8-43b6-950d-1bdf35ab2525", "comment": "Malware payload", "value": "7cb3ea53660dbc1b4fe12e0c03c7bfea0a3c92a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051154, "uuid": "40bcda78-b1b9-4478-bdb2-3880c11115e7", "comment": "Malware payload", "value": "36edb600a9a9864c60577fce6fdd6a5cc80472d0b317438e60e4d9af4dfbe12bd2292ad1a65a854e73c843d81a0c4990", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051154, "uuid": "16dc066e-2876-43b6-8e6f-46618e956291", "value": "F6336D22B885A1B2D9F19CF095A8B7A6E87DA573132530D3D3908DB11CA13D3BF3514E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051154, "uuid": "9cfa81d0-2651-4f4b-92bd-7967bafd614c", "value": "b5403fb8687d7afd40fd8cf3b4dfe29b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051154, "uuid": "6b839bda-3aef-456b-8e3a-bb1e02ccf72d", "value": "768:2WetQRPOQaniqkpY0O5w8dBxmT9y2/jSPyyihNfVABb/J:2WXOQwi6wEBxmT33U/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624051154, "uuid": "d363e4a1-9b85-4131-8d44-b13d99547e23", "value": 50560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624051154, "uuid": "5372ec25-039e-4df4-9518-14777fee3f2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051154, "uuid": "d649a931-12fe-478a-ad23-ae503321d298", "value": "8249e9c0ac0840a36d9a5b9ff3e217198a2f533159acd4bf3d9b0132cc079870.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c8eda0-d079-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624050462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050462, "uuid": "85f48c33-02f1-4764-bb91-64bc5560b51b", "comment": "Malware payload", "value": "1dbb9bae682f4e51fdf6650b62396e87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050462, "uuid": "027c93ca-3ec2-4082-b2f7-6cb2577e4d72", "comment": "Malware payload", "value": "843953f91f7a0cea202cd389974f9bbfe111934bf175af7cb0e44804be5b9b4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050462, "uuid": "b6f4465f-e612-4370-93db-1b59737a1cab", "comment": "Malware payload", "value": "3d360f268a6985fd42c3ca80ec4d92d1e11007a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050462, "uuid": "b9e54060-4093-4423-8066-4241aefe6206", "comment": "Malware payload", "value": "6bda443dc63917f06fe97837cf052dfa79684b421360926455fd50d5ba7292d531ab8c26ae60edca98355801d38c7b5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050462, "uuid": "1e56d8d4-86b1-481c-a0d7-8a55fff538a2", "value": "C9257B9D721072EFC867D4729EA81C68EA506C7B971F4213902335AEDA7D897CF244F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050462, "uuid": "d9c054aa-6d08-4d6c-829d-a2df40e69b4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050462, "uuid": "0ae92e48-5945-4db8-b257-12712d948a0d", "value": "12288:kgS3M7pTu42ItFN7iyRdWC1APRS9zgXlnscEiyZrIy2UeWJo5Bo9hFWPLitr7QOX:Yoggdx1A5SGXOji68UeWJoAMLitP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624050462, "uuid": "5ff50a4a-7f95-4f7a-9730-3c2e6f416c82", "value": 971776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624050462, "uuid": "5066d032-0d65-4cfe-9d05-91c24fadd324", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050462, "uuid": "19526779-4800-42f1-9e25-812fe6a32d82", "value": "Urgent Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a220b546-d059-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624036895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624036895, "uuid": "14c004cc-f8ec-484c-bfdd-1b82f9814ca7", "comment": "Malware payload (NanoCore)", "value": "41d31672534cc7ecdf9ff5aa7cef6d53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624036895, "uuid": "f017727f-468a-43b0-a27c-09397b3a18f1", "comment": "Malware payload (NanoCore)", "value": "8460b20a5a6be7227b0a11fe1a2b31b588c674e817287c36c691196dcb0ac176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624036895, "uuid": "07a5d7db-41ec-4763-8aec-f7d036ea79d3", "comment": "Malware payload (NanoCore)", "value": "723d4e8f707df49c7d3ccaea7599a2c37d04bc38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624036895, "uuid": "47489524-d934-42bc-92de-efbb8a83ac6d", "comment": "Malware payload (NanoCore)", "value": "f458d5adb7e0df9792dc64eb2b2491d67716ddc2a7e99c02201479da626d8eed44abc6f55bdc4871f35345e2283f62e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624036895, "uuid": "b9523ce1-deb3-41de-9f52-db268bd57aec", "value": "1A05C0307BEA524DE5BA1B300974C18513F6BB6B7B15DA2E2859130C9E73683CB21B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624036895, "uuid": "b5d7273c-ec5f-4a6d-b4cb-797159ea612b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624036895, "uuid": "399fdee9-e321-4c93-8341-bb958aedb2cc", "value": "12288:OsyC3l5bvquwaHptHv1uUkzPBnKgRFvCOL5QP6SQPqpXC18EVyb2:LLquPHptP1uUkzdrx5QSSTpXC1Lsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624036895, "uuid": "b60d8a9c-0082-460f-82dd-1538aaf41fe1", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624036895, "uuid": "eb5d3121-903a-46de-a186-7fb25a88849b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624036895, "uuid": "9b2df2f9-0650-4fd3-86ef-d398df94757a", "value": "723d4e8f707df49c7d3ccaea7599a2c37d04bc38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b215779b-d046-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1624028761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624028761, "uuid": "c9b0f3eb-9f2d-4885-8a09-aa13976bda9f", "comment": "Malware payload (Stop)", "value": "b628568f10b8b63a69d69f40b71e1cc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624028761, "uuid": "2887bfa4-0166-421b-89db-033a3707e364", "comment": "Malware payload (Stop)", "value": "85e7c79b9a284abce257b900655b285fdc5c52d4c4ca3eaa7c5274cf0307d467", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624028761, "uuid": "d82daf83-4604-446b-be96-d9b604ddfa4e", "comment": "Malware payload (Stop)", "value": "8d8dc436fe73532a95cd0645e1b04bef98cec115", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624028761, "uuid": "9ff24332-3d74-49e7-b46e-facc6d5a12b9", "comment": "Malware payload (Stop)", "value": "209516594aa2c26135959a9c84ea9349f28b2269db84bd3918dcb7098aad412db4127218f2fd2e329326aaa072377c39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624028761, "uuid": "fd4d437c-dab3-4797-b89f-95e80c3b8b9c", "value": "91050100AB80D035F1F756F8197A93ACA92D7EB16B6441CF62E51AEE67345E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624028761, "uuid": "ad2ebc77-636c-4653-ad4b-e2284f9534fb", "value": "705a372c868b933d973ca642948b7012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624028761, "uuid": "7f5b9cd4-d1c1-40e3-99ae-a9e8383ddd91", "value": "12288:OBeG3TrC9UzTSmVofaUV8Yj1zrWzrQtIT4Vasr8MmOLrmgu8Kk/OfZKQR+:03TrCa+faszrWaasQMJmxuWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624028761, "uuid": "8aad6fff-d976-49da-946f-0db8ebaae821", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624028761, "uuid": "57ce2d96-c383-42fc-8f54-90cf271801ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624028761, "uuid": "1f589015-ec42-4152-b82c-2f96029c1a0f", "value": "b628568f10b8b63a69d69f40b71e1cc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134be6ae-d079-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624050399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050399, "uuid": "4a360838-6dc8-490b-8197-470e22254073", "comment": "Malware payload (NanoCore)", "value": "3fa42db5094cf6c2b8df75f97f52a857", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050399, "uuid": "47b555ff-0784-4c3a-88cc-0c7df50432d4", "comment": "Malware payload (NanoCore)", "value": "865d98a17902e0f89ca77c7bedee95427cfad341f773dae541087772a63268b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050399, "uuid": "5b10147c-8b5e-4b55-a464-8e2dbea66b38", "comment": "Malware payload (NanoCore)", "value": "f66f842829d3d36f76eefb36cc3e104cb7c462e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050399, "uuid": "866f43cf-982c-4f04-bc4d-009b38a79a13", "comment": "Malware payload (NanoCore)", "value": "5f26b026cc5b73026de182423946dec97dfdc6dd7270d3b52966a6babe53325934e315d7b57a56a2407b5103562f6074", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050399, "uuid": "82295858-3962-4a35-a106-30279340d335", "value": "F9B4028637BC5F23C4BE03F6746954A017B1B173A1A3E35E2EC620E94E66F404F66227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050399, "uuid": "09842425-a6de-494d-9e38-0b3c9df01974", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050399, "uuid": "ca1046f9-423b-4d6a-9e7e-0133209842fb", "value": "12288:HUxvxhNYXoWJyunZmkFGmMlp7Z7K6zVxZOlXvo4jn:0n0XoLunF1MlpZK6zQl/o4jn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624050399, "uuid": "fe139d15-e90d-4a03-aaf9-01f202964014", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624050399, "uuid": "83fd14fc-dffb-4972-b23d-be57311269ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050399, "uuid": "2ee5e5a7-864a-4273-896d-2b3c7b80bd28", "value": "ASN#02021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7281be95-d01f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011904, "uuid": "842d4d47-a7cd-46e1-a7bc-0f64ef98a77a", "comment": "Malware payload (Mirai)", "value": "8f2b421f6d18ba762e32986cdbd10daf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011904, "uuid": "881cc4ed-a308-4665-94dd-05f735c5e3fd", "comment": "Malware payload (Mirai)", "value": "86ceab9f59194b54f49709951e1707f5a413170155ccfb081e60f91769e11b93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011904, "uuid": "d4505302-ee59-4db2-9644-69e88b337f49", "comment": "Malware payload (Mirai)", "value": "9248944733f99722e6b02913cfd52102f010543c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011904, "uuid": "23e756f6-c587-495d-aad8-99ebc63f9eb8", "comment": "Malware payload (Mirai)", "value": "ed2382f550becf181933e93cb3e0aa6eed513d2ee163f8f53252482f227e9bd78574660d2710ebd53d158cc56c821892", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011904, "uuid": "9f35255b-5b84-473a-a302-20326848b9c6", "value": "3BF2F12DCB3E6720C7F41837DB3B8B5B4A2A47BCC0F8719794C410A4B4E12597AB959A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011904, "uuid": "23610cf9-5763-48b4-a70e-8c9c1a060cfd", "value": "768:fB86Rj5gwX4uEltN16tAqQegtWAp95IjT3svRy6s9q3UELQC:q6ppXAlX16t4kg/ycYSLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011904, "uuid": "02b5ac2b-f994-48eb-bc6f-01dc27a58895", "value": 36288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011904, "uuid": "150d8314-d3b1-44b2-a2ba-60abf14a70bd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011904, "uuid": "d7b253f2-c685-47c7-8189-0e07ef625ef9", "value": "8f2b421f6d18ba762e32986cdbd10daf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f4277b-d010-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1624005441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005441, "uuid": "fee17e3b-15b8-43bb-936f-ae6995e0ca63", "comment": "Malware payload (Quakbot)", "value": "f2387e25f2e1a33caa550034e443673f", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005441, "uuid": "82212938-29bd-422a-9116-4f4bb79ab90b", "comment": "Malware payload (Quakbot)", "value": "86f672f6e8d604d0af61b015115542114e57d9db719969341101056d69a0eb60", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005441, "uuid": "4eae0e76-5e66-4953-9535-dea04de43223", "comment": "Malware payload (Quakbot)", "value": "4dd0cc843ccd2518ac2ce2a6268b06dd9c9a50f2", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005441, "uuid": "5aa7d0e2-1fc0-4db5-818b-e7e62ede16cd", "comment": "Malware payload (Quakbot)", "value": "4ba96c419961b3f4f962fe880d6d2414d99dfe8761157c463ed597e3e50838e2ae3af8e6b916223c0653cecc3cf48655", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005441, "uuid": "517049cc-0809-42cc-8403-11dfd82c66c8", "value": "27F3128B61A160FCDE1560310A436DF11E1A702BA751FD8F4AE13F8662229E3375DB9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005441, "uuid": "b2bfb920-ecf8-4efe-8c40-8d10ca054ff4", "value": "3072:aIIh9vajtC1gBbZmxVymd1xXPMU9VlUBWA6CFvA7bRCxAVIKPMa2:ZIQegBbcxVyWxfMU3liWA6FsYPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624005441, "uuid": "e37473ba-7526-430e-adb5-aabacd26e8a6", "value": 159542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624005441, "uuid": "bf07dad8-8e6f-4c8c-a62c-e9e200da5cdd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005441, "uuid": "1b6e7f7a-790b-4d84-9d0a-a709c02126a2", "value": "aim-479987626.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12f1576-d03a-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1624023660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624023660, "uuid": "77bf3f51-4d4b-4818-8c9c-70b8053aac26", "comment": "Malware payload (FickerStealer)", "value": "e919b3e2fbe69d8d4770889e7476b947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624023660, "uuid": "4b780cbc-a6f3-476a-87e1-26b7a64f62d7", "comment": "Malware payload (FickerStealer)", "value": "872689bf87c4789712c2d066c958f87ff3069d167bb29f6788ce83c9bc2f126d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624023660, "uuid": "74947991-c213-49b2-850a-9de6f7edc5fc", "comment": "Malware payload (FickerStealer)", "value": "4a0b7efd8b726588fe2991184a18fb7df86b1e2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624023660, "uuid": "d74972b4-4d7c-42a0-90f9-199dc3de5e35", "comment": "Malware payload (FickerStealer)", "value": "0ebf2d11407a92ad5fb85569d5eea235cba4c9aecf29ea0b7fcd185fc3de0eb1348d91271f2ed60900bb085ef8f8c61d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624023660, "uuid": "c849264e-9eca-4d8a-bced-94e5facc1693", "value": "17E533117BF0C0B7E69256303909BF32A6AED74D4B311C977B64DA4A9F38435D42BA0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624023660, "uuid": "fbf66ebf-8aa0-4c23-9f2f-7e4152ee4a31", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624023660, "uuid": "0ff25915-3341-4b5a-a8cf-6fb3eed20b8f", "value": "98304:xOCvLUBsgUtB/0YMXgDlchxTof1NiZ10EXN/ysp:xHLUCgQZ0ZQDl0xjZ106Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624023660, "uuid": "42202ecd-5f2d-4dd2-b730-b0e17d2debca", "value": 3305604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624023660, "uuid": "266d4611-7cb3-4095-bc72-2e801c7e6cbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624023660, "uuid": "c063c16c-023a-4cdc-9ae9-0fa993fc2805", "value": "E919B3E2FBE69D8D4770889E7476B947.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340edf1a-d076-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624049166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049166, "uuid": "96df5a14-ebc8-4b38-87d5-9e8014a0019e", "comment": "Malware payload (NanoCore)", "value": "78c38efc5c41f4047ee410d3b33ad073", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049166, "uuid": "ac37b9c8-1318-4e7b-84e5-965852fe0f15", "comment": "Malware payload (NanoCore)", "value": "876b731a87a9261f5f533bab8b57c6cdc23664268fe8232cb6c65adb37b99c79", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049166, "uuid": "d5191bd8-f3b0-4763-b39e-a9a4179c4c45", "comment": "Malware payload (NanoCore)", "value": "90f47fbc81b0b78090493830c10853272c1a4269", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049166, "uuid": "c46fae5f-cdef-416d-b29e-bdc7ce05985e", "comment": "Malware payload (NanoCore)", "value": "015dcfc8805edeeabd6525897f17eccc5b28837149e3bec28197ca54ee3ebedad8ec44ae6fd7ccb18c325d5136ad0450", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049166, "uuid": "8b31a82b-9080-4e10-a7f5-762998bd2366", "value": "35A5CF37D1D3BC977B672E4073D42A3C2CA97AEB8B611919B5400DE82672A70EF549F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049166, "uuid": "51165fd3-455c-47ca-8495-03083d36cc99", "value": "24576:ob14l86ARrnCJZv+nc/yY6UmALwmZz0Inl2s167UF9/nSGnEaRr8IxTaZinTte9g:Z0Um0wPIl2v7AVt6QEDgK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624049166, "uuid": "31efe1cf-1c94-4a7f-8089-f634df6c4dde", "value": 2064867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624049166, "uuid": "472908b8-4925-4e87-8e8e-35614b331b26", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049166, "uuid": "8b3a094e-95e6-48df-abd2-603d1cb3bf9b", "value": "Specification1PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec673f1c-cfe2-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1623985910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623985910, "uuid": "35cf3b72-4e2a-4d56-a52a-9dcec9de44c9", "comment": "Malware payload (BitRAT)", "value": "0a721ee6e7d6deae7befb61f937301f8", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623985910, "uuid": "e8312431-5bb7-4ebc-9a75-7d930654dfb3", "comment": "Malware payload (BitRAT)", "value": "88d413cd1c86f67b6484f694cf829fde9df980755442cdaebba7c6a1e41b3ea4", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623985910, "uuid": "3c31ed8a-df14-4f3e-81cf-208b2912761b", "comment": "Malware payload (BitRAT)", "value": "822a683438f72d0996a9743d50f964427502b2c8", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623985910, "uuid": "2079c543-2dbf-446b-b467-16db121bc05f", "comment": "Malware payload (BitRAT)", "value": "a01d0c41776cd983e2b70c08b437d5e03195939cbca8f3da19932e21210646180353dc2895fa2dea964b15b2dc23493a", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623985910, "uuid": "cbda8ef6-87ff-475c-b9da-e342b3a0f376", "value": "09A512559124FD62E1D0E5B684B6FABB1230CD3972488A416CEAAF13F83EA4DDC05D73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623985910, "uuid": "7d9121cc-141a-429c-a20a-79aa830a0d22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623985910, "uuid": "8d59d753-1f5b-4391-9844-e84448c0a1f7", "value": "49152:VN2pX0f5/S30Gfv0vR7LWgG9497h29dfmD58B3bJhOSEWz:r2GN80GEhYA7AnmD5wqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623985910, "uuid": "25e18856-749e-43fa-aa6c-879a1c97dc02", "value": 2243584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623985910, "uuid": "0d28a59d-ea04-432b-ae38-36719d91e388", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623985910, "uuid": "fa05da9d-4d72-42e4-ac78-a171d933aa9d", "value": "88d413cd1c86f67b6484f694cf829fde9df980755442cdaebba7c6a1e41b3ea4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653a869f-d00f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624005010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005010, "uuid": "8ccacc9a-9c68-4cf8-8d57-2afdf917ac67", "comment": "Malware payload", "value": "6a0660a71795cb8d67370524b56bb29a", "object_relation": "md5", "Tag": [ { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "v4.6", "colour": "#287FF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005010, "uuid": "45a152f3-4814-4e1c-8752-1098f77f30dd", "comment": "Malware payload", "value": "89025ff12018ed90a709f3c8bf47b803c5c5b2b533858bda398fca3e1d6140f1", "object_relation": "sha256", "Tag": [ { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "v4.6", "colour": "#287FF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005010, "uuid": "b34580da-aab2-40f6-ac6b-8cec6c40bda1", "comment": "Malware payload", "value": "681a02883944f6f14963815e854f3fa3de5cc6f3", "object_relation": "sha1", "Tag": [ { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "v4.6", "colour": "#287FF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005010, "uuid": "87922ea8-0bbd-4149-8509-6384f729d4b6", "comment": "Malware payload", "value": "ae23c166faa966dde9091771459ff7d38e51c556ee3d428f68d0083bfda9766e58cbf9f3457a8d6cc17a763ac26a006d", "object_relation": "sha3-384", "Tag": [ { "name": "flubot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "v4.6", "colour": "#287FF3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005010, "uuid": "07ba627f-6952-47ec-bbf3-10497835512f", "value": "3C26232AFEAAE456D407D034C5AB98639404004C9A48FF5B1A32815C9DFBE54A7BFFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005010, "uuid": "d96d267b-7b03-4dfd-9754-a8b2a1e2c275", "value": "98304:41DNrQxdkTDyZWINaesGQn59u9lfACK6tlt6C+E/ECH:4J1Qxdcy/NafGQ78fA76tltNJ/ECH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624005010, "uuid": "d085ef45-73bf-4648-a631-5ee6b16bb28a", "value": 4652470, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624005010, "uuid": "691e52d5-7408-47f7-8b59-aa849281e998", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005010, "uuid": "5aac27c9-5abc-4dd1-9129-3c494f7ed26d", "value": "89025ff12018ed90a709f3c8bf47b803c5c5b2b533858bda398fca3e1d6140f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070ce11b-cfff-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623997980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997980, "uuid": "07a3c0dc-9e51-4399-85ba-749a1a336c66", "comment": "Malware payload (AsyncRAT)", "value": "421bba499d009a4dbee871cb90c56e09", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997980, "uuid": "124fe824-86d0-4d80-aeae-256f76dcb527", "comment": "Malware payload (AsyncRAT)", "value": "893a65f72dd8001e458a1929cf48406170daba94ec53c3c01c92e612c63a7b55", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997980, "uuid": "1961f329-77bc-4a72-9692-1a9a4d3c7e77", "comment": "Malware payload (AsyncRAT)", "value": "31da999e91688049e6bdb91ff29470376eb01b5f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997980, "uuid": "d806b01d-d144-4da6-8c65-e5d61b07d022", "comment": "Malware payload (AsyncRAT)", "value": "74cb66c021aae1750ee2d6555f9e6d72a56ce5c067edc585ebf5695006552bcba51f62ce40263d64bbf40a347c57093f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997980, "uuid": "d0366e29-09d9-40ed-b114-6e5f8b2a5879", "value": "F7D023EF6970CC824149A78D1547784557D34AED936518A03130CC30745D831EE1C4E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997980, "uuid": "833bbca1-1879-4b29-8a59-df69eef28bb9", "value": "3:32wXfbOFo3oL3FHpTdH6HovM4QeUB8DFoCMVObOL3QVJlsM1UxIDMOlD0sT2Nn:3HOm343TdHiovrRNFRbODQRt1M+50Kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997980, "uuid": "275d6b26-e200-496a-bef1-b130a64b6aa6", "value": 210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997980, "uuid": "99ccf436-aeed-4cf7-8608-bd1a256250bf", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997980, "uuid": "3c243c36-0c57-47ff-b2ea-651285d6560c", "value": "eBill-ID039769984118858.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216d9357-d009-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624002319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002319, "uuid": "759e0b44-baaa-4761-8c3c-69277d93d270", "comment": "Malware payload (AgentTesla)", "value": "6923c85fba97c629150ec70f06707bfb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002319, "uuid": "b9dd116b-21c3-4d36-8634-d9d89de05b45", "comment": "Malware payload (AgentTesla)", "value": "899349b954e4845416a050ed30015ab2cbf4b68b08958458dc406bfc7ed682f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002319, "uuid": "aa63212f-516d-45ad-a2ee-7721ca857ff7", "comment": "Malware payload (AgentTesla)", "value": "4d0d81ddd5cfcdf7121b6b1d139b10e6fdaaccb3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002319, "uuid": "8d176744-955c-4d2b-9519-9df3eb231278", "comment": "Malware payload (AgentTesla)", "value": "b180795a63b54f653abf540acd6c4b96de6d191f2bc3aeab908d23b11caa4ba8686ab6299ead4a5f6306ce8ccf1e9d1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002319, "uuid": "8fb1f151-9cbb-4de0-952d-e2980cdf0c88", "value": "93D4BE302AE95229F173FF755AD475959BBEB7637703E44D3861038A0B12E80CDE263A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002319, "uuid": "dd7d419c-5ac3-4919-aae1-482474a5fcc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002319, "uuid": "9247f5a3-876f-41bf-9c73-b4338a0df5e6", "value": "12288:41XOphlm4S4F3M9ybvY8pV/HNpwgib8r+fRqxJZya6:41SWEFV/HNpmQyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624002319, "uuid": "c429f86e-d41b-42af-affa-170150bf940e", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624002319, "uuid": "d742ea51-9c6a-4d9a-a0dd-6592cc19b5b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002319, "uuid": "7eac8461-7f3b-4875-84d4-0154cb49df9e", "value": "ORDER TSA-A090621B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b0bf46-d01d-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011244, "uuid": "52faf6c4-5232-4829-a096-4dba05f94d70", "comment": "Malware payload (Mirai)", "value": "83a9e8e27f3651b0a6a91010c2af1231", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011244, "uuid": "d1398acf-36ff-437f-b5ea-2270db42754a", "comment": "Malware payload (Mirai)", "value": "8a4dac08801c0042db33cffb252a3017bc0c14db305546466cc9b5c358799811", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011244, "uuid": "f3247bca-1c12-401a-ae7e-9429304302a9", "comment": "Malware payload (Mirai)", "value": "9f2e6087d8cbd65b13af69876e458cbfc580aaba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011244, "uuid": "deed47f3-f521-4de0-8382-af615fff8f70", "comment": "Malware payload (Mirai)", "value": "be32d849c19eb5ac78aaa0a66c8a0df150a08cc7976bfa0849941b9520e6765aab90b6f6d9c266483ac0d2c1e550f7ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011244, "uuid": "4e65c05c-f208-4467-9fbe-52e1cb505f5e", "value": "02C2D0ACD5410C5EDDEBEE340DC8D7B0B3B04BCEBF998F905151BB82994351A9AB99C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011244, "uuid": "90567974-7e6c-4300-8ae2-68893dce2c9b", "value": "768:TAEyPEeogW8yI753G0xxEioneo1J98J2K4uVcqgw09A:TLyPEejWAtpeioeoX9+/4u+qgw09A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011244, "uuid": "f7c7a9a4-05b2-40aa-854d-9a19320ba9fd", "value": 27276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011244, "uuid": "aca92474-cdeb-4280-a08e-5e0a3e89db73", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011244, "uuid": "8c7c6a33-a5c3-4e43-a222-b66b3b958918", "value": "83a9e8e27f3651b0a6a91010c2af1231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61e6b62-cff7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623994838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994838, "uuid": "c40e9961-ec3e-43b0-aef6-f59c84d32522", "comment": "Malware payload (AgentTesla)", "value": "255608e0061c48fbaeecf84f8038282f", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994838, "uuid": "5d713f85-f283-462d-ab75-0787726bc94a", "comment": "Malware payload (AgentTesla)", "value": "8acf97d2e4ea86a2a3d7e3ea84fe5fb96e1229c45e1dc7f2df870759bf4345c1", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994838, "uuid": "fa8ce08c-6c8b-47ed-ab4e-c9c39d62f7da", "comment": "Malware payload (AgentTesla)", "value": "e83b44ee50a2437ed39b682db1ff0d25e59bacde", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994838, "uuid": "2872749c-a195-4bee-8b71-fcecf5adc800", "comment": "Malware payload (AgentTesla)", "value": "222460aa39b98775656b9e01ca324e5faa84fa8eb9050e220b98f378dff66fdaaf166e2fb3c56f035bebbdac9f9d4b5c", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994838, "uuid": "5e0cba0d-ebf9-4ddd-adc0-bf73f688afcf", "value": "76D42381A379C1CD82CD84A6F34D07B16FD8A2ACA1345E07839F5903D6D53F9352BE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994838, "uuid": "41e8ce55-ff13-4da1-bb71-5b793c853cd4", "value": "12288:onugE50ol4QiPc0XfDxR8AjTz5a0UE/m/PpV:vgIXQuCzVUlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623994838, "uuid": "56e17f28-fcce-4d97-aa34-b8c16852c795", "value": 614565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623994838, "uuid": "272fa256-680c-4bb6-9997-01ec056fc951", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994838, "uuid": "b176b0c4-b0bb-47ec-bd86-9a14dc3e5323", "value": "Price.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50c17c5-d031-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624019747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019747, "uuid": "9b34ea8b-1990-4324-b065-330b31fd6a89", "comment": "Malware payload (RedLineStealer)", "value": "13cc08981072a60642ce957d3378d110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019747, "uuid": "09a66817-9fa1-4141-a466-34e8689f2082", "comment": "Malware payload (RedLineStealer)", "value": "8c031056d718f770dde763f4e1db77f6b129cb9f71129461a2fc7a3f893a5bb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019747, "uuid": "871192b0-9c94-4ade-b7c1-3ba713346897", "comment": "Malware payload (RedLineStealer)", "value": "aee852832c93427447a84dd76a7987bd3dbab09e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019747, "uuid": "0b487be0-68dd-4047-bc54-80329f06d509", "comment": "Malware payload (RedLineStealer)", "value": "82746357c4bb5ccd32c7d1d1688f0b3945b2ee0bc45ad3b73412b02e97850afd80cd598ffb3469af7cba8f10cb2dabf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019747, "uuid": "701d700a-7111-414c-bee7-1eeb7cc40bcf", "value": "D584BF10FB90C035F4F652F85AAA93B8A63D7AB05B2451CB62D52BEE47346E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019747, "uuid": "86dc7e60-2d72-43ae-9af5-e56ed5ffdd86", "value": "0e61e5ee811a73c290e64659dd192375", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019747, "uuid": "01a5f96e-f6a9-4b94-9939-cfde69235839", "value": "6144:3WnbDp3wFbpb8D64jgJptrznuaylIxz4JZcD/nJ7jhXrMc892uYgTtK5:6bN3wFbpb8D6hrPyKxzD/JjRrMD92jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624019747, "uuid": "cebf805f-f4c5-4a97-b372-c2045add30e2", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624019747, "uuid": "c773c70e-d553-40cb-99a6-a5fe85df812b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019747, "uuid": "2736ee58-c82a-4707-8e00-179a89693371", "value": "13cc08981072a60642ce957d3378d110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e913a5be-d02b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624017257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017257, "uuid": "2f03c023-87e3-415a-83bf-cd43a8a4c547", "comment": "Malware payload", "value": "4745b0e4eece8900b7d357a9a158b486", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017257, "uuid": "790f0122-2351-4a72-aebd-4b7c95ecd4e5", "comment": "Malware payload", "value": "8c1fe91c8a544c3a08b9a646ec81a900bb321ce84920669852094017e00716e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017257, "uuid": "83533c93-f937-4ce5-a5c8-06b4d37e5ccc", "comment": "Malware payload", "value": "d694b97321bb547541da050aacc0c75a5b5b2fb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017257, "uuid": "68e36d5e-44ce-4c9b-b868-f5a3bd1fb0d0", "comment": "Malware payload", "value": "557dae1cb855858b849b9451d81e256c2f88e5bdd1a3c6f1a568b019e3127959e70f8a072426a760ff7c82eb123c8efb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017257, "uuid": "ee0b193f-fe38-42fb-a60a-cd992f6173ff", "value": "CCD2E162BA3F1C68EC311C73E91608C369A7BB79D49A64A620355F74A782784237C2C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017257, "uuid": "b89ae1ae-69d7-4603-ae0b-0508ae7df365", "value": "768:HipH9q3jjsLy0QUIC5a5GFMam2tc2kdX9q3UELo:HrTjsOgb5Dy8tumLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624017257, "uuid": "9de6d7c5-68f7-4164-9132-a94374c975eb", "value": 29356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624017257, "uuid": "e96d1d9c-d552-4dbb-9b36-1e570720cfa0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017257, "uuid": "54a2e00c-2062-4028-ad60-2583d578c65c", "value": "Samael.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93685eb3-d035-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624021408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021408, "uuid": "1e54c040-8e6c-4e89-bf18-044ee05a6242", "comment": "Malware payload (Loki)", "value": "b7684e6ccfdfb2d817fe280f0a6b5e03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021408, "uuid": "882063cd-4268-4474-b9aa-1f626cded2ec", "comment": "Malware payload (Loki)", "value": "8c228195bba438b4931fd25e11877d8c8a12ab6ded397633c01dd9bb50bddd80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021408, "uuid": "fab8ee60-0526-4c85-9bfe-8fec935f9a3d", "comment": "Malware payload (Loki)", "value": "9ba7d8c1b1d95a45bc75fdd6a544f21d44a51cb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021408, "uuid": "77f41662-c6e6-4754-92eb-08994930407e", "comment": "Malware payload (Loki)", "value": "914e9c60391f48e2760308f4ed7ad193537811cdb2ea185a6af73c62d86456e3861c02bca86d09f42ee7bbf0a30d75ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021408, "uuid": "67dbf017-6dd4-4aa3-92ba-11ca6ac0fe44", "value": "68156B9D721072EFC857D4729EA81C68EB506C7B831B8203942735ADEA7D897CF245F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021408, "uuid": "07faba78-77d7-4fc8-94bc-a5f4aa2e10a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021408, "uuid": "b2a1c8cb-dafd-4947-ba78-2bb81b2b68f2", "value": "24576:1xa000X/hyEbLMt+59koxIU4kShmfZPOh:ba000XZbLMiDxIwOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624021408, "uuid": "f6d1619a-aaca-4120-a223-567a75cd3702", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624021408, "uuid": "1f7cc620-f4c8-40ae-8855-9642c52d8293", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021408, "uuid": "5899442b-fda8-407b-8a15-c976ca3b8063", "value": "DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15aabd38-d031-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624019480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019480, "uuid": "ac314d75-e693-452e-bd6d-77850cb05a07", "comment": "Malware payload (RedLineStealer)", "value": "8f789ae687b5aec043503d1284e06d4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019480, "uuid": "1875c755-97fa-492c-aa09-7da33b498ec4", "comment": "Malware payload (RedLineStealer)", "value": "8c373102d98ba3188c4361deee0bd43f89e4e8785b613a7af99bddd45329303d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019480, "uuid": "924ae728-9bcb-4525-bc1c-75dc2b3824d4", "comment": "Malware payload (RedLineStealer)", "value": "065043168fdcc424d74e2570ab12dcebd6f8345b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019480, "uuid": "7e2a5c22-b2e3-4d9c-9e57-212642b1409f", "comment": "Malware payload (RedLineStealer)", "value": "b1c823af4ae31898ce2eb053dd2506ee4b71e962d265c946d07ffc265f0c8f1c2f5b960d895ed288c13cef9d1a8cff64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019480, "uuid": "8357be62-258d-489e-83b1-6cc8826db5d3", "value": "4FC533D5F77D1CEBEA22017AD84E21240125CCFED949970F310AFA0965D67C42AAE8DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019480, "uuid": "bf9ae9cc-477f-4fe8-ae7e-b956e3d26770", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019480, "uuid": "3a86acbf-72b3-46b7-9798-1010c75f1c94", "value": "49152:2QwB27rEwOL+URpR3zLWO8BFsHZblaFfT9O0PtRooR9stm+tC:LwsvEL+CVz2v6ErM0PXRTs5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624019480, "uuid": "091ffe19-22dd-4251-9eca-16427e2f0411", "value": 2711850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624019480, "uuid": "e7381721-b554-4202-859a-665556cfdefb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019480, "uuid": "08185eb4-f09e-45c8-bc46-cbbd632ceed4", "value": "8f789ae687b5aec043503d1284e06d4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7d3e5e-d07e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624052535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624052535, "uuid": "7de48eff-2c22-4609-96a7-b8726bbd1af3", "comment": "Malware payload (RedLineStealer)", "value": "5b71454cdfb43d153d6d9d10514853ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624052535, "uuid": "cdadbbb0-6337-4be5-94c1-3e32b1b78455", "comment": "Malware payload (RedLineStealer)", "value": "8c83a85312854e6c59ea11dbec728019fc2f53ae0b1b934c455d26e0cc0a566f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624052535, "uuid": "bb3a9132-4f67-4105-b3c7-87a13085b801", "comment": "Malware payload (RedLineStealer)", "value": "148dbbf0962a6cdbc0f37636ef28b12ebf664faa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624052535, "uuid": "63e988ea-bb64-40da-8b24-a6a2e31c961f", "comment": "Malware payload (RedLineStealer)", "value": "8cb1f823fb6bdadf5829ef9fe879b760fc5af53e0a577ee159488688c97952688f6fcb81732ef585c8d51dd5000741c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624052535, "uuid": "8e43c92a-d7fb-451a-b0d5-9644236e742d", "value": "9384562864BFC05984E3EEA22DDCA8FBD99A55E3640C743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624052535, "uuid": "e0e7d759-5aa1-46c4-b983-5820819b32bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624052535, "uuid": "9e06ea8c-85b6-4a73-a590-d450ccf95819", "value": "12288:ZEalveC/2LWuc9feq0JkSzR4dfw8GynCgUYIwHVEOV1Hzc:MMc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624052535, "uuid": "7dd0ad87-91e5-4c5d-8616-80eff3543753", "value": 401264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624052535, "uuid": "b3e211f5-ac10-4327-8caa-4094e5c9d9c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624052535, "uuid": "095074c8-ff9c-4feb-8dc4-d29a28c4fb34", "value": "5b71454cdfb43d153d6d9d10514853ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b19623a4-d021-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1624012869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624012869, "uuid": "3a290236-d5f6-4a0a-8a44-80a8391b0742", "comment": "Malware payload (Stop)", "value": "1041a01adb4c4f2214e67735d82b907a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624012869, "uuid": "8d3ef4fa-628d-4a9d-b245-2bc20eea6d44", "comment": "Malware payload (Stop)", "value": "8d22aa46311246d6b88edd6206a344cad253658094424bd5601742887ece604d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624012869, "uuid": "cc8d2b4e-9940-4829-94cd-0797d2e35e76", "comment": "Malware payload (Stop)", "value": "49cf663fe10d33d821f7251f7d127c67a1b6a2cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624012869, "uuid": "14e19cdf-3519-4941-a3a3-c99555e84b25", "comment": "Malware payload (Stop)", "value": "8cc20e6ab1447ed4cc7d427c9fa3267a5c8f14a2c6f8894a882cd19734c2c4339d5d401349859f8446fe249f169218c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624012869, "uuid": "0eea1f7d-b4e0-45d5-9f63-5bf1e8264458", "value": "21050100FA60C035F1FA11F865B59399A92C3AB25B7454CF62D96AEE6B346F0EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624012869, "uuid": "60985c11-96e3-419d-af7b-535e032f8bba", "value": "866e8b0fa01ec6fd81db7579c1be52ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624012869, "uuid": "f83ff171-18eb-4888-bf69-6f30cd2de7e1", "value": "12288:5Y0+pb34rZRMnq7K6fdCpK3DVU2Uh0QDmivPU/81sNurfUQxhVtK1gkWNXNJmoGt:5kbeZzdCp4U/hui3U/XOLkWFNJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624012869, "uuid": "651e8f7e-406f-4ee4-98ac-d6e94be5a30d", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624012869, "uuid": "cb9421dd-445e-46c4-bd4d-cdc078d784f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624012869, "uuid": "f7a03818-001e-414f-ad45-d7ae61f6f837", "value": "1041a01adb4c4f2214e67735d82b907a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d003a3-d028-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624015827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015827, "uuid": "e193d3fb-acf9-4fad-8898-24f8087f66b4", "comment": "Malware payload (SnakeKeylogger)", "value": "8cb33040c9f75754659ac2b3055b84ca", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015827, "uuid": "99f6287d-3cbe-4a79-92c2-7aeb320b261e", "comment": "Malware payload (SnakeKeylogger)", "value": "8dd5df1ce192b6101814de114129b653f7179714ff4ccd3654769f45ba237bc6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015827, "uuid": "64ab9946-302c-45f0-9552-2850f2e65cff", "comment": "Malware payload (SnakeKeylogger)", "value": "0c929ddb43bca71a0862f5f3fbaf724c6139855e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015827, "uuid": "f95d40ad-fb6e-4de9-bafa-b8fa42bb4cd1", "comment": "Malware payload (SnakeKeylogger)", "value": "9858aedc9270eeac923dd06fed04176a7d86c2a78c88f3d4bcb6693efaf8a875158174a4f69b365603268861fba2d8c7", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015827, "uuid": "33a6a9db-7b13-436a-a066-19064b673160", "value": "74F312DF3A7D05EBACC29160670908038E0FD2C408D66E415868AA71DEFADE345F3B39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015827, "uuid": "c2c163b5-4af1-4007-a155-00cad3f95cd3", "value": "3072:nLcACixl2tSVpplWgB+eVAGPbzzn0srm1Ilhg6MUf7PbgDUDdq/VT3nfnD7H/2qC:YAbl2tVgZAonV/mif70DLRPDT/8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624015827, "uuid": "6deb6399-f468-4bff-a0d9-b6b2b5475b75", "value": 164705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624015827, "uuid": "e536f2f3-43cb-40b0-b104-46d7e2fbb978", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015827, "uuid": "093632bc-8c9b-455a-a895-8de24d8d2ee7", "value": "consignment details.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c25a29d2-d071-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624047257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047257, "uuid": "fd1a8d71-e10d-4cfb-bad9-20c5a7c11d45", "comment": "Malware payload (Mirai)", "value": "64a8ef24c618d621d9d7f6d3cbf1268d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047257, "uuid": "9c4c3c2c-f37c-45cd-a444-553d4799958e", "comment": "Malware payload (Mirai)", "value": "91a90a8c1e143d76b7403851430a708295f04fa25e1a202973465074dc7f62bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047257, "uuid": "3be5f14a-e382-438e-914a-110a95142caf", "comment": "Malware payload (Mirai)", "value": "34f5e58136e6c7a28b4c0d9cb133236aafb01014", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047257, "uuid": "bb803339-5844-4e65-b2e8-53ec47882d09", "comment": "Malware payload (Mirai)", "value": "163244b61221492791781c2ee58a6c9eaee2850f257af3783f1849b408c2edf56f9c2fe438b8fdcd5d507e36ef89e0c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047257, "uuid": "62f4dcbf-2fa0-4219-95dc-c6d78bcc237b", "value": "19132986BC829966CAD01776B62E108E3321B3E9C1DF3217CD245F1177C9A2F4E37A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047257, "uuid": "7de585bb-8c2d-4c96-9333-987e2363379c", "value": "768:4e29cZjBmP2XBDFlumI9NY+uanihajaer8pgwmiSWAySxoNYmBNT5:32uZFmP2XB3uVO5OihajaR2wnSJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624047257, "uuid": "4ce999cc-10dd-4211-ad73-6f7b12f1f49c", "value": 44128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624047257, "uuid": "98786cdf-02ac-49da-adcf-24c2fe7786fc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047257, "uuid": "1014244a-baab-41ed-bab2-6d62932424f0", "value": "64a8ef24c618d621d9d7f6d3cbf1268d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b18d14-d005-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1624000869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624000869, "uuid": "03bcd1ac-5863-45fd-b89c-8e4aa36db2d9", "comment": "Malware payload (Stop)", "value": "2f2506f0d7f62f22018c3e69438b7ce0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624000869, "uuid": "73a58f53-9110-4d9c-a217-638260d70c0c", "comment": "Malware payload (Stop)", "value": "923c862ca56a102b3ac83cfa26630325260dd549e8690a430fb39c15b60d310e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624000869, "uuid": "91f5ff2f-0dab-4408-a0a9-8c7d5c46b974", "comment": "Malware payload (Stop)", "value": "e3922c19f2bf5934c2b1718860f53fff72492591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624000869, "uuid": "7d6cafe8-35a2-4e16-a859-4cdffbdb4514", "comment": "Malware payload (Stop)", "value": "910d86817264a24a09acd770412467555eb84954624d0ddfbd2cc303289b7c721d3f0355a5db00411a5cad9b327ed319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624000869, "uuid": "cede6e5c-3254-489e-8a59-8e042525125a", "value": "52050100BB90C034F4BB21F8567A9368A62D7E715B6552CFA2D91AF91738AE0FC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624000869, "uuid": "1b336d65-d101-4b69-b5f4-e9cfbbc562f0", "value": "0e61e5ee811a73c290e64659dd192375", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624000869, "uuid": "a1939d6a-9a2a-4746-ae29-8d1a21971598", "value": "24576:94diCuVUTnPAmG7dMVT3yXedakAy6T7lW1:CLrPlcKmBkAy6TJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624000869, "uuid": "2be0be51-0dbf-4aa4-806c-31edb1090596", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624000869, "uuid": "a282407d-7000-4ff8-ab20-70d1371e6eaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624000869, "uuid": "0eb8fd43-5e1f-4214-8d03-5110c70d4408", "value": "2f2506f0d7f62f22018c3e69438b7ce0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bef3a6a-d01d-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624010981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010981, "uuid": "2e355da5-31aa-4b62-9380-b1565a64314d", "comment": "Malware payload (Mirai)", "value": "fac5f5888e9aefc2f8f44f51519bee68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010981, "uuid": "9dd0ca4a-a8e2-4d8f-bec1-2149730b4573", "comment": "Malware payload (Mirai)", "value": "9488a7d294a8ed2d9c40073dde0c2cb68fa9055f6a94b45ee0867b05605439c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010981, "uuid": "74264684-8ec1-462d-b64c-d93bcf91421f", "comment": "Malware payload (Mirai)", "value": "35a40b201970f1392b86ac12d3b7c0f6ea422f84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010981, "uuid": "33cbdb98-3805-436b-968c-7f3044288293", "comment": "Malware payload (Mirai)", "value": "dc2b75c8cadf59f90a2ba3ab58e54150fb01564e970139f6d5ec9112d63c4254ab28cbc083b05927d57b568ac2fb9a1e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010981, "uuid": "cb63dec8-e938-40ba-8700-f29e4bc5a9b5", "value": "9AD2D06063E5BC22CF9008796FAED74167518BF095A0333F939AFBB869C3D86597C406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010981, "uuid": "c9ff9eb0-7135-45a3-8d94-d0f42faf9850", "value": "768:0PXbpq3JCoHLf/ScupTsMQpdtGqcqfjYD5iCs3Uoz9:wXbp6oqf/SH1EfcK4Gz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624010981, "uuid": "f601ee85-f9ab-41fc-b8e5-3ca0b7437b59", "value": 28608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624010981, "uuid": "c23b212f-da56-485f-93e5-7dc03862fbba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010981, "uuid": "d24049bd-e294-4785-ba76-f95cdf6c0179", "value": "fac5f5888e9aefc2f8f44f51519bee68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00c2476-d044-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624027872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624027872, "uuid": "f6484713-f99b-4329-827e-33e96bfbad55", "comment": "Malware payload (RedLineStealer)", "value": "d004ee936720abc8ddbefd50a98d3e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624027872, "uuid": "27c62597-84ca-47cf-86a2-781edc2cfdfe", "comment": "Malware payload (RedLineStealer)", "value": "955a82756ddc59a57c4432206d4e26b9987feb074f9386240b45349d4cfea6cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624027872, "uuid": "43c17443-8342-400f-9260-99de9672279c", "comment": "Malware payload (RedLineStealer)", "value": "9d876cdd61ec03b47707abad787812b9b2cc03d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624027872, "uuid": "8742cc07-1c6f-487f-ae28-35a23f43f84c", "comment": "Malware payload (RedLineStealer)", "value": "f6a234d9c67a5753ff343de71c1af68b431143a919369fe26b2d777ed211c055fc3ba274746d61b99e8dd72e60be6630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624027872, "uuid": "845af6cc-018d-4461-aaaf-7a617a660a4b", "value": "F784BF10FB90C035F5F212F85ABAD7B9A52D7AB1572490CF62E51AEE16346E0EC32317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624027872, "uuid": "2bd156f7-5d8a-41fa-957f-99c9ab4d7a8a", "value": "41601b6802e3e38dfaeac494532218f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624027872, "uuid": "b26929a6-c502-49e6-a8d8-24878787a877", "value": "6144:M2AC7nIsivZ2NMCVbk2aHzn1vYScOsVrOuJ2lshzc+6Ip6RvgQxYjCWojN55:UC7IsiR2NMKb211cOwKA6I4Wn25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624027872, "uuid": "5993493d-f67a-4b29-89e8-0e699b4c418e", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624027872, "uuid": "23b93a7b-cee3-4779-ad9f-4f09180ca207", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624027872, "uuid": "36cfdd3e-54a9-47b4-8c44-d8a0c4e41226", "value": "d004ee936720abc8ddbefd50a98d3e9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b2f3d4-cff8-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623995190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995190, "uuid": "79165e0b-2ad8-4124-8118-5a71380a69a8", "comment": "Malware payload (NanoCore)", "value": "faee7964be7ecced60998a55bced25ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995190, "uuid": "8ccd6822-e3eb-4041-9c72-740703f2ec90", "comment": "Malware payload (NanoCore)", "value": "959cdffe6cfb1d11b91bbf2d54fad6e8115d4d74034e39eb7c5ac157edc7d996", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995190, "uuid": "70b90d8d-2829-4277-9abf-31f9a9db9862", "comment": "Malware payload (NanoCore)", "value": "6fb0f4aaa31a2b12519b0b269235f41845d0d086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995190, "uuid": "cbe8e2b7-a73d-454d-ae3c-5f6166cad5b7", "comment": "Malware payload (NanoCore)", "value": "1e8ae88a02f537ad0a23f74e9634e4ba782ccfaa6b4a0438d7b664884eb1133d0e90147e85ba30c60749a62b06a929c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995190, "uuid": "f07aeb34-3777-4116-908a-5a7a4bb246c8", "value": "48B40101375C8B65DDBD9BBA951B118003B6FE6E81A5E74DADC631E21EB3B850603F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995190, "uuid": "9793e8b8-61f5-4e19-b434-324e9435df18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995190, "uuid": "2422bf54-6291-41b7-842f-86e3c24d3d1f", "value": "12288:0hcWUDJtdzknYaztEg6Cit9MMGVZIBNCOmS1IhuOiTi36Q4Pb:0hcWUDJtVIFtExCy9MVPIBkOfyDiG6Q+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623995190, "uuid": "73d2efd7-48e4-470b-b378-1e1137198a71", "value": 520704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623995190, "uuid": "4fce85f1-842e-49a0-8b91-a88de74e6805", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995190, "uuid": "8687dab0-6f9e-4d43-94aa-6f4ec5fe2bbd", "value": "Ow10nyS2IMeAWdz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ae83c3-d030-11eb-875b-42010a9c0053", "comment": "Malware payload (Ratty)", "timestamp": 1624019151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019151, "uuid": "08766914-fcac-430c-b149-7be99399545e", "comment": "Malware payload (Ratty)", "value": "8dc388ab159f029f318a518ccbc06d15", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Ratty", "colour": "#3FA1D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019151, "uuid": "79c135cf-51cf-467e-9bc9-b9a6f895a2e9", "comment": "Malware payload (Ratty)", "value": "95dd45bc7d3ad79b65a248b429d37688a7fe7fa78fb470c060fc269b0586ad47", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Ratty", "colour": "#3FA1D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019151, "uuid": "6a9f858a-00ad-4dbc-bb75-0f21ad1b8ff3", "comment": "Malware payload (Ratty)", "value": "01a684c3be778e73c9bd004968eaa9c3d4834dcf", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Ratty", "colour": "#3FA1D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019151, "uuid": "ea27cc74-1373-42d9-b2f0-118aa1f98bd2", "comment": "Malware payload (Ratty)", "value": "1d717860751d77c566a6acaf9956bc3e11355c994e29efcefede322219d9c077d6700ddaa0bbfbccd42e924b49c0ba61", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Ratty", "colour": "#3FA1D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019151, "uuid": "1656a768-6ca7-40c7-9ded-e8d114bd5a24", "value": "B0F3DF49BFF499A4C1B7B374905D5262BE2A53DCE610800B416F022A2DE5C504F9BEFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019151, "uuid": "034f43c8-b79b-4f98-841a-ab5fec263318", "value": "3072:F+X10rLJP1LV8ta2cLgZD8T32h3Idc6o+dN7Ny/0CD:F++yt1ugZDU2hccC/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624019151, "uuid": "082dbdc7-ad6d-486d-8f78-598b6d5c2acc", "value": 159412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624019151, "uuid": "cf169eb7-31b2-4247-b1c6-698f51d62941", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019151, "uuid": "f32b450e-73bc-40ec-84a7-65507b74125d", "value": "COMPANY PURCHASE ORDER AND PROFILE.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d01c83-cff4-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623993621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623993621, "uuid": "8e3b8c9c-4f3e-4c9b-9a87-1729c0c6ef4c", "comment": "Malware payload (Loki)", "value": "95f4b34df50f91689beb35af3954ba24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623993621, "uuid": "dfcabf35-3447-43ee-a006-2444d856a056", "comment": "Malware payload (Loki)", "value": "9662475e81c447af9308de4c7d244eb0fd360e902ab23c2cab7ef855c6d24533", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623993621, "uuid": "6b73899d-2491-433e-b0ac-a1626adf4924", "comment": "Malware payload (Loki)", "value": "30dd251f7dd210cfca7fa9b59bbda1d6e8860ac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623993621, "uuid": "c6ee7d61-1772-4528-8964-b30e73f3f01c", "comment": "Malware payload (Loki)", "value": "c040796948472b4f1764f59f88d6af9f1c8165ad1b11e5e12129cf12730447802f9c5380fd9cae354a931cca3e7cc739", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623993621, "uuid": "5ad47f9f-a14e-4a27-ab68-d179248a59c0", "value": "92F4AF212AEA5219F077EF785ED075959BBFBF237B02E44E289133470633A81CD91639", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623993621, "uuid": "5db2248f-e005-4a12-a7d5-b2b697920f96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623993621, "uuid": "946e278b-cda2-4227-b278-4aed67a1dea4", "value": "12288:SI2Chlm4S4F3M9yxa/vmhLsGbLfZshnDDrTB4kO8Grh0UGy21wMudb96vCebbuyD:SoWyEvc/Lfa1X3B4khGNVGyfMk9kfJ04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623993621, "uuid": "d7b90b93-6ec5-4220-8cc0-7ce144523d7a", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623993621, "uuid": "d69bf8cc-b8fe-48fd-9eba-258ae907395d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623993621, "uuid": "baa31798-b91f-4afa-8a25-bd04f1e35c50", "value": "PO Invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bce77e-cfd9-11eb-875b-42010a9c0053", "comment": "Malware payload (Adware.Generic)", "timestamp": 1623981983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623981983, "uuid": "28b3e04a-6d2e-4950-9e17-c7dbc57cda14", "comment": "Malware payload (Adware.Generic)", "value": "2e8dc08fbd25401117f6cbcc0319f33b", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623981983, "uuid": "a9c4f585-e14e-461d-a071-0956f710c8e3", "comment": "Malware payload (Adware.Generic)", "value": "96d1a194f5dc6fbecb472b5b39c1c5fddcbe7b8d6f5a879d106f8a5c28aa1334", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623981983, "uuid": "20320d23-c653-43a9-a650-08163dbcb486", "comment": "Malware payload (Adware.Generic)", "value": "f1ee353477b751da3e8a039a955db5c24efc936c", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623981983, "uuid": "86062e7a-8896-418f-aedc-17bb3ab473b3", "comment": "Malware payload (Adware.Generic)", "value": "500628e68f66a122fc813350adcae2f9820276b5675aca81f156bac1803459d09a5c5261c28b1b9393207f5d541d94cf", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623981983, "uuid": "eb437b47-5980-42ca-b672-bc6e7d27c236", "value": "3CE533123CF54177FAC14872A8646ED4E0F8E6280FB14DE7375E8A2D7F3925192287E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623981983, "uuid": "e4d9b733-f081-4dd9-a5b8-64a00d2c91a1", "value": "e00de6e48b9b06aceb12a81e7bf494c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623981983, "uuid": "12e4ca12-205b-4238-95b1-b0fd3e13b5f2", "value": "98304:bG5QgxEwE6X/foVF2OjVvgxyJWiD+aS2OSrT4:bG5pjq2c8yYiD++fg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623981983, "uuid": "c0a2cae7-a5bd-4818-ab26-2385476e9a93", "value": 3176424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623981983, "uuid": "0bbcbef5-df53-4044-91b7-b594de5a95e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623981983, "uuid": "3d11a8dd-2041-43c7-9a18-8896c7916ddd", "value": "orbi-valorant-injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d202065-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623976999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976999, "uuid": "4c5907c8-31eb-4084-92a4-a7b8bd540b40", "comment": "Malware payload (NanoCore)", "value": "661aba3881dbc32e62d4def29c29cb6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976999, "uuid": "f75d5ca1-98c5-4ebb-bdc1-17195882190f", "comment": "Malware payload (NanoCore)", "value": "97ad74523db8a357818d1d579030d283760d0a2c442c54e37dcdf6e76f6bd8a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976999, "uuid": "1687f4b9-e111-4bd3-9698-31bf2bb9a6cf", "comment": "Malware payload (NanoCore)", "value": "3dc9f0da37c2e009f208cf1189e58337e7511f60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976999, "uuid": "8308ccfe-28ba-4716-be63-48107cc05cf5", "comment": "Malware payload (NanoCore)", "value": "29b16c0abab4b23c9c3ec06e8daf89428a10074a343a69b5c00d4be455d263996e40df59eeef0be2a9b736c7751b27f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976999, "uuid": "8d8e528f-1807-4e4f-b57e-3813044726d9", "value": "F284121937F528DFCD187B7221B26625F33C6306173229DB67A99F792B440C29E7A243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976999, "uuid": "7dd122ee-167f-4e5b-b0b5-caa0cca6fbf3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976999, "uuid": "c30b8d34-725b-4ebd-ab75-1a6a24c0dcbe", "value": "6144:pAPQfRGk8tfM6QLLgjQfXuocxPLVhu2E35YKIIx6PZZoRwW4nO9OANYE2nO6c:PfRGkCHyUjouLxjPOpAIx6hn7nuNp2nW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976999, "uuid": "a48864a9-0355-480e-b24b-b7101742331c", "value": 371150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976999, "uuid": "32528a53-4262-4691-847b-5d3b87393c94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976999, "uuid": "760a4528-69d3-4c78-8fed-04e42a6095a9", "value": "97AD74523DB8A357818D1D579030D283760D0A2C442C5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b435c0a-d01c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624010604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010604, "uuid": "e13e2a98-2ace-4294-9510-05126ab34cab", "comment": "Malware payload", "value": "4828706cfc63ea3043b05456d2df8029", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010604, "uuid": "a4fd896b-7dfc-4360-b482-72ef44441a7b", "comment": "Malware payload", "value": "97c65fc5e4e6cb68141853ded39ca1e62b374430b80765b7f4a96244b44c58f5", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010604, "uuid": "8e5a6eea-adc0-4031-ad5e-954bf7eda151", "comment": "Malware payload", "value": "dafd2836f1c915451a47e7b0b320b8804f1b8990", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010604, "uuid": "f24ceb24-81da-41da-9b71-40988687b37f", "comment": "Malware payload", "value": "adc4e0d37bbfc8a5c5a45e7408aa3a05ff19d6a538eb504a61436cca337377736010bc977cb628dbfbb817de8ce4a9b7", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010604, "uuid": "f57dc422-34a0-4538-b361-a088c6161e52", "value": "EEF31205A212F0DFC2602039D793A450AD35B29EDD43FD5E1A71FF466B121FA278D68E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010604, "uuid": "c28e7e5b-7453-436c-ae17-3a74103b1620", "value": "3072:XzTkdm3bGeAxidxVymd1xXPMU9VlUBWA6CFvA7bRCxAVIKKU0:jTkeGKdxVyWxfMU3liWA6FsYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624010604, "uuid": "5cc6d32e-708e-4d0a-8771-549f19c36bc1", "value": 162061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624010604, "uuid": "b6d0f4f0-83ac-41ba-a48b-0f1779e565e1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010604, "uuid": "bcb1eded-f11d-4440-b5b8-b1cae7ec06b8", "value": "idea-1128721882.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b3bbf3-d07a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624051178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051178, "uuid": "5867a8f9-b153-495a-9dd4-58f0d5e9af73", "comment": "Malware payload", "value": "145e3c224e4ecaf26d4638efb9d622a7", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051178, "uuid": "fd1c007b-7652-4071-9011-754e1aab8134", "comment": "Malware payload", "value": "9804787b31e0025dd2ae9344ca1beae2e701cdf8fd77a60f424295dc9280dc89", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051178, "uuid": "35115966-ebe5-4097-9224-cdc6a1768a09", "comment": "Malware payload", "value": "70d5b0be6ed51e43c0a19b773cead8793257bbc1", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051178, "uuid": "c58684c6-5207-4777-a260-4139f97b8db4", "comment": "Malware payload", "value": "c5713c83201c4e9f5a71ebf4ee166e9ca2e0111a1fe879c00336008a73e230fe344fb9b0aca9bb30517af08ad0ad71ed", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051178, "uuid": "3ec00d10-44d1-42f8-a4da-7f0b96c7eb29", "value": "E2C4E732418AA017F9A564F739F5BB88F4A7EA2051B34DD3ED64ACCD26484F20BC5E1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051178, "uuid": "75d0b6fe-34cd-4f48-a26c-d5c1debad6c9", "value": "70621d2ef55d2dd65a1fa41928fe3d0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051178, "uuid": "cef70fb5-b77a-4787-a42f-a79baa01a99d", "value": "6144:+zhRwaGlf2ofbRuNPMxJZWWXR6UVUmxTOdbRnveIks9HRizWtlJVv:+zLE3TRuNP8cU0UVUCINWns9QW/JVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624051178, "uuid": "357780f6-167c-489d-acda-5662b5b09e77", "value": 577968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624051178, "uuid": "dd780c6b-a63e-4c77-9a92-a5b55283861a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051178, "uuid": "a2b25910-c23e-4109-8c20-02cf794263be", "value": "9804787b31e0025dd2ae9344ca1beae2e701cdf8fd77a60f424295dc9280dc89.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf2d314-d008-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624002257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002257, "uuid": "c1384353-f5ce-48af-90c4-1d4088ebaffe", "comment": "Malware payload", "value": "9c2c38b4685ebbeb9ae981b3ba51961b", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002257, "uuid": "c820d3c8-d064-47db-b62f-a7188f843e29", "comment": "Malware payload", "value": "9835b30340902d19ed9560fb8eda2af745161ef0d178ccbfae9679b83291e2f3", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002257, "uuid": "cb94d45d-bd21-49cb-8094-512d5021f4a1", "comment": "Malware payload", "value": "7ef416073f0a89d49e4fee022ea3d23983c7afc7", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002257, "uuid": "15c78298-ba4e-4521-8eff-ba6f0dfaabd3", "comment": "Malware payload", "value": "a96677f8769a77e0d5583f2e505be8e0fc8ef70913c88db3ae24e75756b4515a2c97e92e7fa1a9b477db8b83f0b92c97", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002257, "uuid": "fd757e7a-5b22-4c9e-b590-d600143c630a", "value": "9C24CF92F2A5E81BC54507345ED3C2E8AB34FC539E62470B3784B72F2E32684DA17766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002257, "uuid": "b777c35c-0a26-43ec-94f9-07ea2c63d714", "value": "6144:KxEtjPOtioVjDGUU1qfDlavx+W2QnWxuXkMfiHT5bG3lueUblUWdVM:mJMMVSOJUWTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624002257, "uuid": "5eceef7c-ec55-49fd-b9d2-f2b67dfa9966", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624002257, "uuid": "279f1811-dda3-4424-81f6-ddaa82cae8f6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002257, "uuid": "cbfb71b0-2d93-4d44-ab92-e7ffcd741235", "value": "viru.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7280402-cfda-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623982492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623982492, "uuid": "fb5edd84-d1a9-440e-8355-6eb6f044e0bf", "comment": "Malware payload (RedLineStealer)", "value": "aacd1b602a791da60708f341a29eeec3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623982492, "uuid": "0227e4b8-b766-4da8-b6a7-f37a0d9a8ade", "comment": "Malware payload (RedLineStealer)", "value": "983c0382ec70c1735beee57fef88ca9fc6f5f3dfbf457e548790518408339cee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623982492, "uuid": "17c82a44-eb6c-4bcb-9c7d-76c9494d03cb", "comment": "Malware payload (RedLineStealer)", "value": "46f6cea928f4a6b86fd52a5b706858609ac18c3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623982492, "uuid": "bed36cc1-0b0f-4572-b778-edce1165ed3f", "comment": "Malware payload (RedLineStealer)", "value": "c007dc6ce5e16a8aca6fa4a4ed6a6b2b1daec837176a8361e7b30eac323d05f1f1429ef868c1e12f16b1efc8a9721fd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623982492, "uuid": "2e969078-d927-40a8-b4d4-7a1c4ecc94a1", "value": "D894212864BFC059C4E3EEB12DDCA8BBD99A55E3640CB43701B4632B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623982492, "uuid": "d5398cc2-3d5a-417d-9dd4-f74d4b1ec730", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623982492, "uuid": "4427e2e7-b82d-4b80-a981-0bc39f057a59", "value": "12288:GZalveyu2Jssc9fnfT0Jno+NorWJA8GeE7tuYIwqVE6vSRuh:h6RQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623982492, "uuid": "58ec9802-88ac-45f3-ab93-f83d300f8047", "value": 418944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623982492, "uuid": "c6e45c38-4860-45fd-ae41-b954dd01ec6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623982492, "uuid": "a1df246d-09b8-44df-92b4-a1bd01df67e3", "value": "patcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b2b85b-cff7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623994864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994864, "uuid": "858de06a-7381-495f-a504-a29b8156d7b5", "comment": "Malware payload (AgentTesla)", "value": "ab316dcda907f92d689924053881b05c", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994864, "uuid": "40f72eb4-f0ed-4ef8-8fdd-91e417be2373", "comment": "Malware payload (AgentTesla)", "value": "98ec0a49ce8bb1fa047da66fc023332321bae4c11a2b472b99d9bb78becb6df2", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994864, "uuid": "c934803b-35de-4af2-abdc-6e850caf3fd9", "comment": "Malware payload (AgentTesla)", "value": "41d112788e632c7841b9817e9e8e86c215db0b53", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994864, "uuid": "9c9aeee2-848f-4c8e-8140-a427a2938ce5", "comment": "Malware payload (AgentTesla)", "value": "6cdc43ddc73e515d921741c30810a8055f0acb4fdbedc9bb1a28ffa80536ae10c1ac2c730d1d7e51bb5dedc2cd700fb3", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994864, "uuid": "232b00a3-5854-4944-91d8-41198967b44e", "value": "91D4335989E116BADC777A13994F0CE022250D22D7386572497448B2ED734F3AE3FE2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994864, "uuid": "35a6c2d6-93ca-4906-b4c0-a2efa35e5c9c", "value": "12288:B6sVoEKtN5OJ0VT369OkxQlieJ1Ryd18rNb3Bbkp1wkoPu3xd:AN5OJI36UlieHRVXQ1wkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623994864, "uuid": "24432c01-7220-4ef3-899e-eea40bb6ce04", "value": 642339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623994864, "uuid": "1fa0e497-4673-41e4-ae18-f6f1e7f306fe", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994864, "uuid": "7fee69b3-2250-430b-aa78-50eaeea407e4", "value": "shipping\ufffdinvoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7469e3f-d071-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624047238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047238, "uuid": "903ec893-dbed-472d-9078-047fcf06a4e4", "comment": "Malware payload (Mirai)", "value": "5647388c8cf0d03c0cf855f51ac048af", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047238, "uuid": "9bc3dccc-b8f3-4e0a-abbc-e24343926d29", "comment": "Malware payload (Mirai)", "value": "98fd2ffae9faf12e28bb1539b2334daa6e03c63e80507940194b980e23ebb73f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047238, "uuid": "9806235e-2f5a-42ed-9630-fa860eba0021", "comment": "Malware payload (Mirai)", "value": "cc289d284ad31756ab1e1fea663bccc0d39f67cd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047238, "uuid": "f248f1af-0ba2-4599-8ad2-360c0de66e90", "comment": "Malware payload (Mirai)", "value": "6e15ce707408854dad9282e5496e7fda61888d11216dc688684da38573c09053f39cafdfe8392e0922ff0f53c33c1507", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047238, "uuid": "4e52fb20-dcb2-4243-a770-6f3debefdae2", "value": "9133280BA58181FCC559C17443FBB53AC876787E0639B1DA7BC8FF276D85E601E28889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047238, "uuid": "b4f2bade-7f2a-4181-b9e7-11421d44894d", "value": "768:Dbs093tGOHn2PAe6nCAQTGWexrecbwBg4ubt7gwE1rjWb571H7wungg:M0937QAe6CAQiWexKg1sV1rs71H7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624047238, "uuid": "64b213d2-12ce-4032-b1fe-19385c85e75f", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624047238, "uuid": "e0df5b1b-be0f-4c9e-b625-13f4c343ddc6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047238, "uuid": "13ab894e-37aa-48a2-a54e-358e7e073f66", "value": "5647388c8cf0d03c0cf855f51ac048af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab75522-d090-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1624060532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624060532, "uuid": "d717519d-8b85-42f0-9dfd-28bfa6ff57ba", "comment": "Malware payload (Stop)", "value": "75ba605b793d48b9502b205d6b627e8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624060532, "uuid": "bf0d776a-30cb-407f-8fe7-8a12fafee6c2", "comment": "Malware payload (Stop)", "value": "990cac874f50cee849117b4d40122773926582c1806f1f14e323efbf05a82bc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624060532, "uuid": "dcc557b2-91bc-4319-a192-cef60a811985", "comment": "Malware payload (Stop)", "value": "8bbad93011856e49d81690883ae21cfb2044e9a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624060532, "uuid": "f6ed5e6e-d2cb-44bf-95e0-5f3f08196b7d", "comment": "Malware payload (Stop)", "value": "def5f92966cdd7579b146b7f6ef52d7d013891e9c723787f235a405f598c7fb9e8bcd769ddff048240f1aa4849e4afe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624060532, "uuid": "658bb695-5067-4fad-ae2e-da08057e95af", "value": "F1050200AB50C038F5F602F81AB5637A953D3AB29BB460CB53E556EE56386F1EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624060532, "uuid": "8422090a-22a5-4ccf-93ef-1ede85104db7", "value": "f47db0f213d1aac5a10ce61704d76431", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624060532, "uuid": "354d5bc4-61cf-4101-9888-8bd11f9933e8", "value": "12288:NDavewd8XtDgj3G7Kw+oP04SvNgCT7RSikDq+moLx391p/K8rABYn6a4HdTU7SN:Qewdz3G73+oglfMjDq+jx393K8x6acB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624060532, "uuid": "8e0e6522-dd07-4084-acbb-9c33c2c88532", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624060532, "uuid": "b05f6091-4006-4bcb-9712-20d277ef2060", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624060532, "uuid": "88573503-ad99-4a26-abc4-e9d133453f74", "value": "75ba605b793d48b9502b205d6b627e8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e323309-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623976947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976947, "uuid": "f9a18734-24f5-40b8-9c0a-d155871b0ba4", "comment": "Malware payload (RedLineStealer)", "value": "2936ca9b5fb34bcaea34432aecf04169", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976947, "uuid": "46aadf4f-e4bf-4a3f-8f52-254d531eee48", "comment": "Malware payload (RedLineStealer)", "value": "99ae16d1e80b1ed32e3ce57483763f3b635dd3b01add1b4361ab07b51b78e98c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976947, "uuid": "e8e00a70-37f6-42d8-9498-fe5d132271ca", "comment": "Malware payload (RedLineStealer)", "value": "4808c21ef5495fb06a3a248f19a0f866f68e8baf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976947, "uuid": "1073ab5b-dd7a-4295-ba86-2430b5339420", "comment": "Malware payload (RedLineStealer)", "value": "30eb86d88a25bdd6d96d20923bc2a427e3af82a52771ab16e71127fee1420e9559254b86a65097aa9314ac395f14540a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976947, "uuid": "3903df8d-94e7-4b7c-80ff-b5936507e1e3", "value": "C64533D114B216CEE586D9B6E51FF81C4B6F0E2C8277C56C8C225C6CAF7825AA23153F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976947, "uuid": "bdae67a9-0048-4bbb-bc2b-eac36139f9c1", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976947, "uuid": "a3a46a24-9ca5-47dc-a74d-7991011ee261", "value": "24576:i3Od5gdH6Fl7jCaXrtIU2o9z0FwifwR0/R29qhAYL+l/gEfy07LBo0l:ZMWvqU7iH0SR28hA8+l/lDHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976947, "uuid": "5c8c4bf5-6815-4c4b-bae6-726b18198d8f", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976947, "uuid": "dcfecb82-4028-4294-a5b6-061d919a186f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976947, "uuid": "66578589-089b-47fb-875f-b16eace7c42b", "value": "2936CA9B5FB34BCAEA34432AECF04169.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb10e905-cffe-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623997933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997933, "uuid": "29b2cbc6-ff4e-4cd2-87b0-3d54092dae51", "comment": "Malware payload", "value": "a73d29e705cf5dacff58eee2c84f313d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997933, "uuid": "7700dfe4-7218-4e77-93b4-c9c58c48d33e", "comment": "Malware payload", "value": "9a4043ea9be9b4e3f53f4ceae96676615eb19a24fa6d9f8de46c36ac62f339f8", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997933, "uuid": "37cc8907-c5fb-4036-b539-ec13f6050fd9", "comment": "Malware payload", "value": "07cdde9a5c3ace61eb41b649d1eb0d8712199972", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997933, "uuid": "5e572880-645a-43db-9504-3d79a8d96465", "comment": "Malware payload", "value": "48e506902b6bde5115ead9595f4d455243c6d3293dd39a0b22f412bcd0a35a4742cbdeaca4760ab28fb09591e1c2a432", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997933, "uuid": "2c59a429-f825-41a3-bf6f-cc31d21dcc32", "value": "5C1149044FE20320E6B69739AC7AB310C9767C52EE624FCD024051486821610F8B4F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997933, "uuid": "0232004d-2e8b-491c-8c99-47e4ea2c7f71", "value": "12:80m/++VSXvk44X3ojsqzKtnWNN5UcCsvXFQL6H/sfUpHsiN33YqlPcr+9m:8JpHYVKVWB/CWS+n3H/dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997933, "uuid": "e4dfc3d8-42d6-4ebc-9da3-8c8abbb95480", "value": 1110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997933, "uuid": "d59f0489-81c9-4445-af87-f6ded498e361", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997933, "uuid": "d3048884-d723-479a-b6f1-3977feb5dc04", "value": "PurchaseOrderJune2.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7930b7cc-d065-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1624041980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624041980, "uuid": "70665f08-5605-4a9d-b759-8051308e34da", "comment": "Malware payload (OskiStealer)", "value": "07155ac8305b41c6aebb4530ec888f15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624041980, "uuid": "4234694a-015e-4c90-8b51-c27dca9d0058", "comment": "Malware payload (OskiStealer)", "value": "9a44105204e206bf8463f398d9321d40f672110e8949a3432085c4bf32a66d79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624041980, "uuid": "975b7725-b037-416b-af0a-2c82f4111f14", "comment": "Malware payload (OskiStealer)", "value": "428e2a2280a89c60d96a70186152d1d47dfde12a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624041980, "uuid": "68929c41-d069-4dc3-9e6e-201c4f26718e", "comment": "Malware payload (OskiStealer)", "value": "24ec85f2596a58043a5ef56d73961ee14c70a3dda6967912ef5c3668d1803295d9c8cbaa4758b56c954b60cb39bd150e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624041980, "uuid": "a28382d3-075d-4e68-8c81-8b81d348ab26", "value": "6AC4022033ED1220C6774B3E68F0D150DB7DA133BA0BDA0535A5629A4ED7BC1DD63A6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624041980, "uuid": "14eec409-a392-4dd4-a45e-caf94a5e440e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624041980, "uuid": "9044fa64-b827-449c-8b93-98be11a31a8f", "value": "12288:49KztvTrncKt52M5A2Wb8zxphnko/4ShR1lZMmSej4wZNaHah9+7/R:kK9B7N68zxPkY48RbmmSQ4ONh9+7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624041980, "uuid": "7721bc31-5928-4b2e-9100-a944816fd914", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624041980, "uuid": "216a4ad6-578f-4d1f-850d-3005d73ec4d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624041980, "uuid": "371d4c9d-0710-45d3-8091-5fabb77af67a", "value": "07155AC8305B41C6AEBB4530EC888F15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242ab2f4-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623976984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976984, "uuid": "a81b8141-1763-4d83-9fa3-4de4824cdaf7", "comment": "Malware payload (NanoCore)", "value": "5303cc3275e1e6d4d2465d44b9463b20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976984, "uuid": "156a2b38-f957-4248-a7cc-a3d0c892ab58", "comment": "Malware payload (NanoCore)", "value": "9cf0ad120d6b3b0c632047d9963328e6afd535786a89108df10c6e8777c14531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976984, "uuid": "74056c96-24d7-4928-97a3-330c27ddc232", "comment": "Malware payload (NanoCore)", "value": "22c00156d363f6eb45b22adfab6be589dbc54f8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976984, "uuid": "ff3f8399-594b-4bda-860d-d41402163128", "comment": "Malware payload (NanoCore)", "value": "6b9b8c04ea78573f3b221006f5b4394b04701a55b7ac692194190bb91197ead48b11b203f592471e20bbcd230e42f4d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976984, "uuid": "8bb5113c-4db1-4dc1-94e3-cc51ae964b2a", "value": "4E35BF121ECF422DE2769FB51BB0BC8782B66E663605E2153DC0329ECA335D5CDDE522", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976984, "uuid": "901730f5-b626-4f7c-8e0b-7bf2ff1ca5dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976984, "uuid": "14f25538-7fad-40e9-98f8-ce635dad49b4", "value": "12288:tMwhlm4S4F3M9yzSMPQipP599k22ru3/N1R9DFdClFQUGAnTsHoLHOlKNPOo:CYW9ip6/mNRpd05FfqKNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976984, "uuid": "49332ac6-a91e-4915-8524-3336a6277b09", "value": 1108992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976984, "uuid": "c9884372-c777-4d2d-9157-0f9d21bd5ba3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976984, "uuid": "0219a5eb-3841-445c-a8f0-ce03e9e68a4f", "value": "TNT AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc01f79-d001-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623999089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999089, "uuid": "61112d0d-422b-4da7-bc87-a0e4d65d7c32", "comment": "Malware payload (DCRat)", "value": "ae917663e480a07a5e29eef70d09805f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999089, "uuid": "7f57cec7-08f4-4bfd-8e7c-4c0534457edc", "comment": "Malware payload (DCRat)", "value": "9e0bcb9216a6eda727bed0f615ec57120bdfb62c784d9660670c9a90e58aff8f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999089, "uuid": "e0bbdf57-adbc-4bf9-be74-1a4a8a63262e", "comment": "Malware payload (DCRat)", "value": "406bd9ef967ccbe1041b57a952b6c34a9443d725", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999089, "uuid": "5659a336-2aee-4123-851b-42d8e1a05bee", "comment": "Malware payload (DCRat)", "value": "e902d6bedb03c6733d42cc6fdf694898deb26fa58d3df5afbc74c30369a25164ab67ad77603937bbec2986ea532a1e52", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999089, "uuid": "e0c59ea4-aed5-4347-8974-e7dd7fd7d73d", "value": "6B0549233648CD05D069023BD9EF56180BBEEE01B662D71A7D5F73ACA5513A32E0D2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999089, "uuid": "744f1b8a-6d1b-49e6-bdd6-616ad79f6c7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999089, "uuid": "dbebf2a6-ea03-46f9-804e-13cbe24adaf6", "value": "12288:yf9kcEt6m92YjZe48sq6Vy3/zY6Hwh9bp/AN/2K0aayzxgDqn:Uynt59njZw6Vy3/zlQTpQ9ayzxO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623999089, "uuid": "d30c8773-ef3a-4288-aecd-ddcb9d19cff7", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623999089, "uuid": "9dbac83d-a556-43dc-b56f-30985a454a29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999089, "uuid": "aaa2028a-2d03-45ae-b5af-34c1cbb7a1b0", "value": "ae917663e480a07a5e29eef70d09805f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fab77d3-d074-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624048273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624048273, "uuid": "cea75fa9-e1d0-49fa-b451-e046f89a186d", "comment": "Malware payload (RedLineStealer)", "value": "3018361348976110a024661c3e3e4663", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624048273, "uuid": "b9f6fc07-a0e3-4e5e-8b4c-2bc467556833", "comment": "Malware payload (RedLineStealer)", "value": "9fdac966350f89fd6b341097a4551fc9cda6abd1e0ccaf92acdee5ca54960367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624048273, "uuid": "49f2b4fa-4eb6-43af-bb13-a9a30ae0008e", "comment": "Malware payload (RedLineStealer)", "value": "7a65e279594a1d424b00d4343172a45e12217a9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624048273, "uuid": "3cacaccd-6b45-4da4-9505-298c191422ba", "comment": "Malware payload (RedLineStealer)", "value": "a9f5b851d2c88791723147292db180be6ae6812fa82a72aaa9499d746fdc42917a72a7ff15845b31ae2be575c24a7b7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624048273, "uuid": "8c5ae18d-ae4d-48b8-9440-8f1f2fb52ba7", "value": "A356333A92008577D1902D368C4FB2ABF53AB6894F7711DF17C85EB95C3260927B03B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624048273, "uuid": "5b1e06b3-9dc9-4bfb-8293-042428d93e02", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624048273, "uuid": "c2848c61-7077-4a27-8b64-0c770b6c5618", "value": "98304:pAI+0p+goreqMswPavGIM45Uz8hyraVTe5fh8ndMfrh0hQIMsNbyVRR3q2E3U:it0p+gyhio5UzQbMfqtMAezRa2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624048273, "uuid": "2731f24a-a160-4e98-8aec-2c29f2a486fc", "value": 5919784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624048273, "uuid": "e577e8c7-4fb9-4ef4-9d73-cffbba174ef9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624048273, "uuid": "445eec55-7349-4c1f-84d5-6ba8d40d77d5", "value": "3018361348976110A024661C3E3E4663.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0797bb4-d001-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1623999231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999231, "uuid": "0d7f256a-087a-4bd9-b226-3ba1beff5ab1", "comment": "Malware payload (Smoke Loader)", "value": "5a9ae7b212ebc856dda3f75f372cec95", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999231, "uuid": "2dd5116d-bf2b-470d-9f1a-6c109f0f37dc", "comment": "Malware payload (Smoke Loader)", "value": "a0154b4fabd2c805e493581d18ed2972032fbbd7558271a4317de4b61ac36653", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999231, "uuid": "ae04e99b-f9fc-4a9c-8a2a-7803c3590dc3", "comment": "Malware payload (Smoke Loader)", "value": "faa97e21b1dfa25ae4534361fc6a43351087e236", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999231, "uuid": "ee445586-92f6-43fb-84f9-cfc43dae9a6b", "comment": "Malware payload (Smoke Loader)", "value": "7882a7d69060a6e182d04164ea458637bb8199231c58fe06d6a5687ee8762b20c98f3be4b24cf9f6bfcf60c38a44bf46", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999231, "uuid": "5288047d-c296-4207-bc6c-2dab099bf2d8", "value": "D5547E11ABA0C035F7B711F80AB6937DA52D7EB05B7490CB92E51AEE56346E0EC3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999231, "uuid": "24737116-9552-4302-ad4d-077c4e255777", "value": "924d9a2d7cc05ebebcdeae3f0201835c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999231, "uuid": "319f26dd-d40a-44f8-af49-d2be478303fa", "value": "6144:j9lOTW6yv2ASS5jO8RAVGOdb1YaKwCt09:LOa6yv2ASSXAVT1tKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623999231, "uuid": "9caca8b9-105d-4068-a6df-5d2d8eb54c14", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623999231, "uuid": "fffcf4fe-0ae8-4a71-881d-e889e9008415", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999231, "uuid": "c98e99af-630e-4c8e-8f96-24a5c344d33f", "value": "5a9ae7b212ebc856dda3f75f372cec95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701210eb-d008-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624002022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002022, "uuid": "0cecf8e6-4401-4ed4-b9cf-dc9e8f01cbd7", "comment": "Malware payload (AgentTesla)", "value": "c62d3480a314a6a7ae3d05c7066867fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002022, "uuid": "3b9bd7b9-2d23-47c8-9fa7-2fac63c3880e", "comment": "Malware payload (AgentTesla)", "value": "a1629f14833195672e2b59b90d643fa90376f9ab7ceef315f08e0835860234c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002022, "uuid": "6378f5f8-81c0-46bb-91d3-bddad542ea4b", "comment": "Malware payload (AgentTesla)", "value": "2f5b8838b8837ebea12710869ee1af961815dbfa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002022, "uuid": "07c2b1af-8dd4-4cc5-aa72-f78a4b33f932", "comment": "Malware payload (AgentTesla)", "value": "11569102be46613b1994d2c10d0467e8402a5eb40246f27fe9bfc345d2ff0d5b8c4eee901c4f66a82b1592019fc3783a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002022, "uuid": "a2c3d2d9-1b40-41d2-b7d7-9bfc909de41b", "value": "9784EF56F8A8B05DD57C47F004F6FBF5EFA4AE68159001CB27D67A6EE13E0629E1C202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002022, "uuid": "7433a69f-89d2-4d31-ad7f-d0b71aa69657", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002022, "uuid": "4dc13c5d-3e82-4395-8366-6564ad625786", "value": "6144:zQqOY0JA5RbKGd701QCW9zqkV2TAXefuYiksGt:jTzbKGd709WswXedBs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624002022, "uuid": "eb69574c-c283-408b-b6a4-94d408b18327", "value": 380521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624002022, "uuid": "3ce5b313-868c-44ec-b2be-657b8e87bf12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002022, "uuid": "18069bcc-c366-451d-ab22-a8d736208928", "value": "SKM_59922543567477363.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6eff8e-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623976996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976996, "uuid": "08122338-de3b-42ab-998b-bb62d52e4470", "comment": "Malware payload (DCRat)", "value": "50984eba05e0014ed4dd6f5a16c5cdbb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976996, "uuid": "e9d7b8d5-e003-4137-96e9-0c0a09e9aeb8", "comment": "Malware payload (DCRat)", "value": "a393fb9ad8a42849aad09cbb83c6d4e9b32a406276b8f9dddf1ac9d657116866", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976996, "uuid": "2363b11b-be18-48f4-b31c-82e9aca1b941", "comment": "Malware payload (DCRat)", "value": "db2a36a945aaf69a1422694e1b3327c94fd541fd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976996, "uuid": "14f4b413-6832-47d9-a416-37433069cb0b", "comment": "Malware payload (DCRat)", "value": "39aaedb1c41deb919d652ad655d74e7b59d288a67258826baaafbae2f96112056976633134f563034ff89f8167be20b3", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976996, "uuid": "e6b7efe8-62ef-4f62-8c89-8b0a3e6bbd41", "value": "4C653392313A4503EC19B679852B9C09DCD8E1BE8207CBC183FD8B51F78ADD51267B6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976996, "uuid": "c77037ff-e3f1-4ebb-8de6-5f12b833d1a1", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976996, "uuid": "3d099d08-29ba-429b-91e3-7027d6f2a2a4", "value": "24576:K6gdrs0/cDr0SO92f1/HhzNXPUziXYn1JxI7szx6dxoRAGGF3PDPn9hohEiLPGx:pJwcDoL2f1/BBXPcN18uGWHGFr/voRLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976996, "uuid": "9fb24381-bd6e-4b34-96f8-9df4abb9c8b7", "value": 1531392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976996, "uuid": "7fcf5017-ca14-4ffe-a331-0f74312f4ec4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976996, "uuid": "73eedae2-09b6-4cfe-921f-d6d8da4955b2", "value": "A393FB9AD8A42849AAD09CBB83C6D4E9B32A406276B8F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7145354c-d078-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624050127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050127, "uuid": "ad0c6e0a-3f8a-4c08-bdef-e80d958241a4", "comment": "Malware payload (Mirai)", "value": "6f00f87a4772446d89016dacd6bb749f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050127, "uuid": "cc63bbee-4612-4229-b56b-3ab1c54b9572", "comment": "Malware payload (Mirai)", "value": "a5825d65eba295ddec7342e5a65c5a5af3b0b44c679ba00007672ec623ad0a71", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050127, "uuid": "77fd891f-5ef4-40d3-812f-97bc03ff6656", "comment": "Malware payload (Mirai)", "value": "f31ab51c266a965d5551ef31fe251444b44224fa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624050127, "uuid": "3b299123-01ea-4847-92c9-d0d31c0ab6e9", "comment": "Malware payload (Mirai)", "value": "7995e109dfcae107bbb433c2730fcad241867ec6e346459a5231c78e8095256d928d2d3bd76f7984c90efa60a2c99384", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050127, "uuid": "539f3944-c4ed-49b4-9f06-ad191514f8e7", "value": "B8935C90B644AC32C59C6C3777BB978A3F5715D59A92D201C840D7CEBBCB680EA184FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050127, "uuid": "af420bca-01f8-4216-bf54-d944c8879f4d", "value": "1536:RsNEM0K9Y50YWQU40f9Sm3+TeK3Aa4aJ0Dbie2iOeGczCI/yUeTyg:RnE9Y5mQr4S5TeK3Aa5JOrqeGcbyog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624050127, "uuid": "2a1a58e7-a52c-4029-9062-7f3e8d902b17", "value": 92720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624050127, "uuid": "2e7ee7a4-d841-42ef-ac73-506795b02d45", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624050127, "uuid": "1173c1f8-f916-481b-9722-4eeeddf8112d", "value": "boss.arm4eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd572924-d070-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624046846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624046846, "uuid": "3f838ae6-23cb-46e2-9ba9-8992fff17e40", "comment": "Malware payload", "value": "8bf00ef4dd6bb308c76849901b03ccbd", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624046846, "uuid": "89e82903-9652-4cd9-9eed-ca7c01787829", "comment": "Malware payload", "value": "a5c873085f36f69f29bb8895eb199d42ce86b16da62c56680917149b97e6dac4", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624046846, "uuid": "96f4245a-2f48-4b95-b32e-7d2db3e4b7fa", "comment": "Malware payload", "value": "04e8a8d30869cf60ad42825667224d5cd01ade15", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624046846, "uuid": "e05a879c-3fa0-4164-8a57-cad524392219", "comment": "Malware payload", "value": "4557b0d697141c8224eedfc2c4d13214dcf72443fd00ad0f226110b88f4099fe43a26eca16927fc089ff3c11ea86696d", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624046846, "uuid": "e09daf35-1431-4e20-911c-fc3e118b25ae", "value": "22123E67AE87CA2AC12E0631A2B2C262767193705745AD86E3440DB4FDF7DEE621C30D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624046846, "uuid": "c4d2d06e-ff26-4e51-947a-fe462c2cca84", "value": "7e3bbc4aa48a3d61a7b995aba939311c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624046846, "uuid": "4af3c0ec-1b3b-42ae-b8bb-24da241f0bc0", "value": "192:oCaQ3qaG3GO/pfg9m3CJ3Mc+YeZBkvmKI7H:o5Nt/Vg9m3CJ3qZ0jI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624046846, "uuid": "349e99d9-1296-4b7a-b5d2-621ab945077e", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624046846, "uuid": "47831329-2519-4eb4-afa1-9665f411b496", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624046846, "uuid": "714ebb36-7e97-4b15-88d9-9f4fabdd3176", "value": "a5c873085f36f69f29bb8895eb199d42ce86b16da62c56680917149b97e6dac4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d823e7af-d058-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1624036556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624036556, "uuid": "1e286122-6497-46bc-976a-e718938a18cb", "comment": "Malware payload (Stop)", "value": "c45e786a7a184e0fabf4f4597675f36f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624036556, "uuid": "c5b51adb-8065-4e12-ae2c-7b4463cc1e30", "comment": "Malware payload (Stop)", "value": "a600359c73bfa888a22e5d0cb18625558cf8abf5164faec2d45e5d4fe5cdfbf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624036556, "uuid": "f72cebe0-3124-40a1-ac4a-902bfe48a258", "comment": "Malware payload (Stop)", "value": "b1e8efe93e9addf754bc17a429eb9c8c349479f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624036556, "uuid": "fcfd0954-cc86-4731-b0cc-ffb87a6c017e", "comment": "Malware payload (Stop)", "value": "1fce87a4c0e5f8019c2723fda1f9e055e1cc552c148a7aa197cd563c88951ed0476142e621aca37809f67a01a2fbe3c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624036556, "uuid": "033f39ce-739e-46c3-9ac7-41cf7867fa17", "value": "D0050210AB90C035F4B702F859B6936DA83D7AB26B6090CF52E55BEE76345F0AC32717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624036556, "uuid": "c00d4dbf-5ef9-4961-a486-1df1a409e0dd", "value": "705a372c868b933d973ca642948b7012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624036556, "uuid": "d28d1e9a-9a12-4679-ab7b-d00570b2b80a", "value": "12288:vgHpHgbCv0zIf74m/YnQRjU5lSfjkdG0D6fkbOhdgMYwX/doAPaakyqiHPNAD:iHgbCz//YBLSAck6gczyKqAAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624036556, "uuid": "6a75fbf5-4e16-46bc-9e54-baa9f09a5eb1", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624036556, "uuid": "ec02f93b-326e-4e72-85f6-8945129209de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624036556, "uuid": "cac5d9da-026f-4526-9a2c-d262e25aa7c8", "value": "c45e786a7a184e0fabf4f4597675f36f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d192cc-d047-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624029247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029247, "uuid": "056a28f3-5ad2-4fc0-82db-041bf1e88a1d", "comment": "Malware payload (AgentTesla)", "value": "77bb78b08f9c95c31872ec4d11c778c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029247, "uuid": "3f35dfc9-540b-465c-8e73-f2a8dc86a2ee", "comment": "Malware payload (AgentTesla)", "value": "a6b91c8938497e679518d6376a474f275ad7715b861fbcdc7b8429a87eeb7b62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029247, "uuid": "916aec19-ec90-43b4-af29-1302a4da6622", "comment": "Malware payload (AgentTesla)", "value": "ed7d2ec51c51e8d757583ade36fe61b4536fd970", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029247, "uuid": "5d1044fd-3c3a-4825-8874-a73feef86034", "comment": "Malware payload (AgentTesla)", "value": "88e5c3378401d9b30a091c5e2ebaa0d8a2200ec5867c1ae7c2091ca8183c772ddaa7aae27e0915b5dd5757bab4ec8c06", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029247, "uuid": "72e3fa78-0ee1-4218-bff3-ce958b1dc1aa", "value": "2955199D365075DFC85BCD36CEA41C68EA60B87A830BD607A05712ACDE4DA9BCF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029247, "uuid": "30849139-358d-497b-bc5b-ccada7591962", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029247, "uuid": "0f32e3e4-4e66-4902-9bfe-bea1589b41a2", "value": "24576:I6ML0ZeQCmq5u4neXSHkDm6bcJGkRkgyTlJ:KuavneWKm6bcckurTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624029247, "uuid": "b1dbca60-c763-4b5e-a771-d64b78783a40", "value": 1377792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624029247, "uuid": "80306959-e3ea-4674-b6b3-6ae9f12e6b30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029247, "uuid": "d024bc19-b6c2-4910-871c-a537481d30e6", "value": "NEW ORDER \u00a0121120.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41e1db9-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623976849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976849, "uuid": "2879dcb5-61df-47d9-8ece-d029886a0bdc", "comment": "Malware payload (NanoCore)", "value": "b40f63ed57b578bf0fc347b2c8ad3312", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976849, "uuid": "d411542e-ae38-49b7-a681-c67c013b9292", "comment": "Malware payload (NanoCore)", "value": "a700a31fdf0f656afe8c8e15b16d60075b8651156c361342becd27d01102815c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976849, "uuid": "1323c2d0-9657-4865-9d29-e3a98dab469a", "comment": "Malware payload (NanoCore)", "value": "91994a12dd2c542e801b33a3206b9cd138d7cf7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976849, "uuid": "68795fe0-606b-41d8-82a7-2882f9ce5a18", "comment": "Malware payload (NanoCore)", "value": "4ccf80d753da9f1340ce56778342fc8b6e0bd5f279f951cf0f1df9b0b47005c740816feac8277e87ab631d1e42469fa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976849, "uuid": "ea476481-7794-4e6b-b11d-b28353e7c83c", "value": "DB7401222E57C12BDA25C83DF46AC2F546A3DF90D693B74B214AFE88F974746F253201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976849, "uuid": "1d818904-ccbe-4c27-bd09-8acb82704d71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976849, "uuid": "dfd002d9-f964-40bc-bf45-d67ca962dc92", "value": "6144:fIgzWXfepXrWYbPJUCxsGKLn8AkM7U69Dh710658:flWP8fPJx2Gq3kMZp1fS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976849, "uuid": "7507993a-39a9-4a3d-a6a8-d196e9e31971", "value": 337920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976849, "uuid": "8cd48055-ab29-44c6-b57f-8a798f2cc34a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976849, "uuid": "cf49c61d-0e16-4fb5-8904-772bad5ce6bb", "value": "B40F63ED57B578BF0FC347B2C8AD3312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f796321f-cfe4-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623986787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623986787, "uuid": "18738df0-0a7c-4841-b674-f097a2f81b31", "comment": "Malware payload (Loki)", "value": "6525fe8c07697708e40d80d68c074149", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623986787, "uuid": "3b01fe24-1564-472d-937f-f50b1786fd70", "comment": "Malware payload (Loki)", "value": "a73bae0022c8d7e7a0daf987bc193355748c960d3eba65059072687e8743c552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623986787, "uuid": "7b00656c-82cd-4ab0-80d9-4ed71d4cbcb9", "comment": "Malware payload (Loki)", "value": "66194367e00e0c49975ac1a7b0f9229a46037c99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623986787, "uuid": "f41d016f-f2ad-453a-a061-77ce2e5d2bed", "comment": "Malware payload (Loki)", "value": "b597b3b0b7a9bb00334d1ab7a743e62da71ae1ed64f8f7633d853a53eca9035bd8745b2d24cb7c61cff27e9d84e0fe44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623986787, "uuid": "77dd9e79-9d26-40a1-9288-786fa56a032d", "value": "1B94E1112447F51AE4BAD5367493F10132527F2854B38ABFA30B3A3D56B22899AFFD34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623986787, "uuid": "61bd07a9-3b6d-4b2d-8bc2-9a2db89c39e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623986787, "uuid": "58a9113d-bc98-42f4-8310-f5f74b6d4d4b", "value": "12288:I1sUifkpoyTbKUrWbEaKpdaG4KqwInZr:RUi1EKZIaKpirxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623986787, "uuid": "fccee7f3-f338-4117-8cf0-57058c73af10", "value": 410624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623986787, "uuid": "bfc8b898-64b9-4812-9b4d-7cdf3c5092a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623986787, "uuid": "7cf3cb56-9a2f-4877-a2b9-3acfe88f2948", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b153f096-d010-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1624005567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005567, "uuid": "3ef91458-95f8-44c9-8370-ecfe4e9ce9b7", "comment": "Malware payload (NanoCore)", "value": "004e261032df1aa24058984d3fb8764c", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005567, "uuid": "6f904b08-708a-46a6-814b-024c20640129", "comment": "Malware payload (NanoCore)", "value": "a908ae499fb8b8806c076b62418e6b800d199e337fca20cb3c35124e8f70553d", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005567, "uuid": "455a13a9-e1f5-4e0a-9630-55ee03c653a3", "comment": "Malware payload (NanoCore)", "value": "001f0a28cd7e06a52a16f6631e35ba3b23da13d1", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005567, "uuid": "0ffd501c-37a7-4703-b431-34ec95bddc46", "comment": "Malware payload (NanoCore)", "value": "0d6970276baaeb1b10243cf0de7ee64a5963acfbf36ceacea3c3c0d693060c0681dedd9921926714889e8ce68c9a6742", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005567, "uuid": "7111975f-e3a2-4622-9884-9ea5da3a3676", "value": "72A423A790C83F5370631772A5938EB0B03199E76FB27078B7ACEA1E9D0929747134A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005567, "uuid": "a45d9648-ab15-48db-be3f-9044817ca7ad", "value": "12288:zch4o8M5DTxWdlhIPFsCtTgIWFh+8r3TesIztPT:zclFalhId7tMNFh1LTeseL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624005567, "uuid": "63bfc62d-41bc-40ff-8f94-5b0daef9017a", "value": 465032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624005567, "uuid": "a3d64d61-e8ff-41f6-8ee0-d199008466b4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005567, "uuid": "b32cc6d2-61cb-4b12-b065-aaf7d5b42980", "value": "INV 00286.Arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0961169b-cfd5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1623979945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623979945, "uuid": "70815037-8e38-4257-8b18-eda3ee4bd669", "comment": "Malware payload (Mirai)", "value": "a87536251fdc7e46c0e372ee4b6ca748", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623979945, "uuid": "f383f2a6-df54-41ae-8b17-3ccb1d9a9131", "comment": "Malware payload (Mirai)", "value": "ab01c18fe8bb0412cece111ede5b28bdc9b11083a054ffd27996db52f13e4acf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623979945, "uuid": "e78a63da-595c-4278-9ddd-27aa9d5fd510", "comment": "Malware payload (Mirai)", "value": "0c693b9cc7cbe076e690d9dd82360bdd97b45299", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623979945, "uuid": "c86f40a5-d4dc-4cc5-9cb5-42453ad9c1d6", "comment": "Malware payload (Mirai)", "value": "64e438ee3fe9f287f4eed2526094d27ec2086d84b580834b883c964166b0204fc56c5836f9f06456bd2c423039900479", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623979945, "uuid": "f508bad0-f098-474c-a28d-869b4b994284", "value": "08D3D607F4415A92D8D1D37BFA0E168932A7B354D3DA7003C8C84F25378E96A2EDE6D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623979945, "uuid": "6e7420d0-c59f-42f6-80cb-b7c27e8141a2", "value": "3072:Qo5nw5aD5h25Hr85UY5fM8c6NyY97y9ffFR7TRhz0i6aR9ujvHGnqvb93MWqL:3uACy5tM8cVY97y9ff7LzF6aR9ujvmn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623979945, "uuid": "d1283efc-fd86-4b07-8239-9fb9e37771e9", "value": 138976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623979945, "uuid": "9af63aa5-6a7f-41c7-98c0-414ec999e703", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623979945, "uuid": "30d952dd-389b-46fa-9f0e-00858ad6cc0a", "value": "a87536251fdc7e46c0e372ee4b6ca748", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052da91f-cfff-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623997977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997977, "uuid": "f06affbe-084f-4468-96dd-944219df56a6", "comment": "Malware payload", "value": "a0a3709f722cbc3596d5519b9e8b470c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997977, "uuid": "b6edd9a5-a10c-443b-9413-02bc6e9f001f", "comment": "Malware payload", "value": "ab1deb3c9d070b387674efe054b74bb60b024d4ecb118a62bfb398de5df8bb49", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997977, "uuid": "17a2f0cd-22c8-4b6e-b270-bdc29134c3f1", "comment": "Malware payload", "value": "e45df65a2107afb4f63d4c67f75e847249c82f1b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997977, "uuid": "55e85203-393f-4a74-9a3c-c16e06b75d77", "comment": "Malware payload", "value": "eac9f9a8b51d9de4be4b57ab96d5cd954b8b95584f271418ec6641248373c5fa43a384db25404d1aa767fb1d678db31e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997977, "uuid": "b877d367-aa21-4aaa-ab24-9b4029c828a3", "value": "8841F911DE04ADCE2E2B82D36499C458697543A7DC0C59703F22CE699F30DEE46F558B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997977, "uuid": "c79c8ec2-fcbc-42d7-b2d3-9335235a8e80", "value": "24:2GDvUnaSmbtNydZd9k9eFcZ6xIAlXAk3Hv5ZsICfgkmQogmIAlXAkMHv5ZsICfgY:Dv0aRbtNAd9k96HUYKi4FBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997977, "uuid": "0a9f6285-3b3e-4432-a6c6-ece54dfd4adb", "value": 2105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997977, "uuid": "99eabe9c-b5e6-444d-996e-b4845f1db17f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997977, "uuid": "cda6822a-333a-49cf-b2ae-ee7750bc7e15", "value": "Zelle-Sent-88442601.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec53089-d05f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624039279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624039279, "uuid": "25a5be83-011d-4e5f-a0fb-a65c88989e54", "comment": "Malware payload (RedLineStealer)", "value": "5ef818717382149abd1b1b77fae2776c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624039279, "uuid": "9892a658-0d89-4b2e-a6de-98c6ab077581", "comment": "Malware payload (RedLineStealer)", "value": "ab52993eedd9f43a7407fae78be23151f0483599d2a6aeb8d1b59919c2f8de2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624039279, "uuid": "2be6f5b8-7712-4dcc-b730-e68d3519bff3", "comment": "Malware payload (RedLineStealer)", "value": "89e9662e6d36418aa8660982343d71718b633b2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624039279, "uuid": "2b727a5f-dd15-424b-8671-8d8a63d4f20e", "comment": "Malware payload (RedLineStealer)", "value": "58e8a997ecd8d613bc0ccd0785116bf7be599845328a7830203814c4e0daefc1c898b141f057b9de2ea5693962b29e31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624039279, "uuid": "efe7e08d-2df5-4618-a866-8d4aa7fdb4da", "value": "D6C41E1825BFC449C4A7EFB12DDC98BAD99994E3A40E753311B8633B4B62794DE0F078", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624039279, "uuid": "eb3c884c-7aa3-4b8e-a559-6539c35f07b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624039279, "uuid": "b1d1da6b-964d-40ce-bb47-3724c7c138cc", "value": "12288:1So8j9FsXXHalve0T2lMYc9fcu0JA9iFlPRKmqzeD2aiXYIwCV/OkffHjB:k/9aJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624039279, "uuid": "1abbfeb0-e7bb-4971-af65-04adb052de79", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624039279, "uuid": "15ea0a13-f2fe-41e6-b096-a0287b079311", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624039279, "uuid": "0a2077a6-5d39-430f-84aa-7384ef20f136", "value": "5ef818717382149abd1b1b77fae2776c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3194ad-d01f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011897, "uuid": "f622bca8-b46e-4f3a-bdea-45b3223bc65a", "comment": "Malware payload (Mirai)", "value": "8e5007dda66761794f248dc60c50da58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011897, "uuid": "87436de1-c71d-4d03-b4d3-f51b7c4728f6", "comment": "Malware payload (Mirai)", "value": "ab691bb74d2ca9c1142d9017aaa3ccac64e455ba6dd0006ffdb827233b3d9f1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011897, "uuid": "959413f9-00c6-4cd0-b7ad-42768326d789", "comment": "Malware payload (Mirai)", "value": "227c06c1e9b4f46bb36611c24025b23e525ebcc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011897, "uuid": "abee0d02-6444-43a0-a957-faaf7e020e49", "comment": "Malware payload (Mirai)", "value": "b272e4adfdf12074568a832be474a298630bae2b30ca1412b660917be360c628e7ec203d7c4decb7cdf9bad04b596525", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011897, "uuid": "dffad563-7d6b-4058-a7ec-03eb7f2df33a", "value": "70B2E017DB22A9B2C9302C31AC048AD37A8B49BC52A834762301DD97FDA519E61FC8DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011897, "uuid": "08398583-61b4-44b0-b921-6cc12687c776", "value": "768:cTK+1cfu81uxnzy/2LNPx6LTvLns3Uoza+nr:M1cGkcz7gOz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011897, "uuid": "90bf405f-8d5a-4b14-b6d7-18e3493b140b", "value": 24916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011897, "uuid": "ac1f2f49-d074-4d33-a296-cad2b8ddab02", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011897, "uuid": "468103f0-14b3-4886-9a60-c01d083f372e", "value": "8e5007dda66761794f248dc60c50da58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2245f0dd-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623976981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976981, "uuid": "8c9e875e-78b8-40e3-821a-011375de02cb", "comment": "Malware payload (DCRat)", "value": "02e022eb77d6085bc477e55c42aad94f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976981, "uuid": "ca5826d2-0b6e-4566-b229-39fb99907853", "comment": "Malware payload (DCRat)", "value": "ac5690010ad06525c90e0d604403e9169f2698d82f5a4e89d328343d59ead472", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976981, "uuid": "f65a156e-b0eb-4c27-911f-47c4a9a0d716", "comment": "Malware payload (DCRat)", "value": "ec1b90242b2943bcca59150cb623e2e1be888070", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976981, "uuid": "4dc14141-39f6-4afb-94f7-31c191ac99d6", "comment": "Malware payload (DCRat)", "value": "de1e34c735e9775f1b33e0ee7804b4cd6e8a7abb17eb98ee1b65a94749dcca6d955ea4b9c95816ddea021335672f955d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976981, "uuid": "64c528ad-5c81-45dc-bb9d-492f8437338a", "value": "F0F439223748CD11D069173BD9EF89144BFAEE81B662D61A3EDF33AC64613636D0D1CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976981, "uuid": "64f9c0ca-b8b7-4112-a368-0e9b36ab43d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976981, "uuid": "abf6395d-f59d-4fcd-8731-945e7a74766c", "value": "12288:7pQpu1QHnLLhvMEEKhL1Sdzy1j8SASbL5T8cOQWqn:7L1+n1MPSj8SAoL5IMW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976981, "uuid": "f60eee65-5a10-410d-ae50-ef88cf178454", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976981, "uuid": "ab8a93e7-ce1e-4e8c-a170-2cefd5923a8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976981, "uuid": "436986db-4b56-4a79-9032-4e7be3e3931d", "value": "02E022EB77D6085BC477E55C42AAD94F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992496a2-d000-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1623998655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998655, "uuid": "985f755f-b8d2-4a5a-931c-fc60a94938e7", "comment": "Malware payload (CobaltStrike)", "value": "bc055968569f6edba24a9fe62f51a8ad", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998655, "uuid": "8c46b59d-a559-438a-bb94-753138e1ea94", "comment": "Malware payload (CobaltStrike)", "value": "ae5b18cb1f45bb4409facea15bd5e309af0ebc6c687ccd2d4273f2c7008925e4", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998655, "uuid": "de057a70-215d-4d2c-ba54-07857629e100", "comment": "Malware payload (CobaltStrike)", "value": "e49a51cceaa9423511be1a110a25934672869485", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998655, "uuid": "b4d568ac-554c-4eef-98ad-ab55d927a5fa", "comment": "Malware payload (CobaltStrike)", "value": "83a84d9a24706cccc859d659a0475b9378e1c86b2a2f6456ed38c2e51b32897e1261e15ba116094d05ce8e62012c3f7a", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998655, "uuid": "858d5ee5-4d6d-43ed-abaf-6a237274b3c5", "value": "2B445A4572A07CF5ECA7D23AC657461BEFF27C224630D75F03641A6A4F273A1A22E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998655, "uuid": "10b8e03c-7c54-41a9-9417-fec9d7ab5cba", "value": "aa81c1b260a0efe3cd2c26c7046b78ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998655, "uuid": "27857cb0-0cb4-428d-86ea-ca35d1f1c87a", "value": "3072:qc0nsHpyvGj346lbkBN/gppj8aJGIhxjT3A8ygbLAZmitdGlGOy9tQYJ1b/S1P3H:qc0bPzIpt8ahTw8PHA8itQsOIQv1uE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998655, "uuid": "b47f8ffd-9e0c-4896-8d0f-71725afd7ef4", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998655, "uuid": "1493ffd1-9f34-4381-a15a-3caa1520e87a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998655, "uuid": "0a50a0fa-c96f-4358-953b-4a84f73b9066", "value": "e7539a18-c698-43ce-83b5-66cd25b49d1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb85d5e-cffa-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623996055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996055, "uuid": "2dca39cf-b61b-4a46-8909-b25fe97c56e2", "comment": "Malware payload (Formbook)", "value": "8a95e4cc72a245275fe3cf3f6aeb8dc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996055, "uuid": "ffa7476a-6e4e-40c0-a143-cd411cab9e38", "comment": "Malware payload (Formbook)", "value": "ae894e1cebb5dcb29c64c8be3157beb1bf096e9720efb6cb976c77aaf406bace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996055, "uuid": "c90793c4-d68d-4b92-acd0-a266f591452d", "comment": "Malware payload (Formbook)", "value": "354ad16e45fe151671b1c4e912b251037da47e00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996055, "uuid": "fcf43a4b-2e88-44db-9ea6-9551310eb5f4", "comment": "Malware payload (Formbook)", "value": "f486a0782df97f48d1b2f24e61799f28b199bc7de94b834bae1fa7a5e509c02ea13a2ed445aa3a13dbfc29929d4258ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996055, "uuid": "36c95d6b-f905-4ed6-941d-2e7804b771cc", "value": "6305BE112EE951D9F077AF785AD075959BEFBE2FF602E48E289132870733981CD90239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996055, "uuid": "2f97dfee-125a-4bf5-89b1-4eb8f3045965", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996055, "uuid": "9394be31-d08a-42de-b013-9b85641edc3a", "value": "12288:hFTUHhlm4S4F3M9yTa/vmhLsGbLfZshxhydfEgtCAZdwkyvbMXnlQwl/Fv8yLCJ:h50WgEvc/LfaVABndwTItl/ayL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623996055, "uuid": "ad87a3cd-4746-41c2-81c3-a10530e97e56", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623996055, "uuid": "d72c87f7-760d-48c3-b446-71232efd1d53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996055, "uuid": "17131635-727a-4e17-85c0-96de632f2273", "value": "\u4ed8\u6b3e\u53d1\u7968 2021 \u5e74 6 \u6708 (\u4e0a\u6d77\u56fd\u9645\u96c6\u56e2\u6709\u9650\u516c\u53f8).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3bac84a-d024-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624014242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014242, "uuid": "b3661333-c64c-432c-8f82-441bfe1c45f4", "comment": "Malware payload (Mirai)", "value": "71cbcff97131091916a35501fde4fc9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014242, "uuid": "e9c311a6-5d72-4bce-8e07-2a4ed463ad23", "comment": "Malware payload (Mirai)", "value": "af8294db4210a7840cb918ccb178e3040e4451922333e49c6138b9b340de5317", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014242, "uuid": "1fd9bc62-e38f-42ff-9acd-61960707c8ee", "comment": "Malware payload (Mirai)", "value": "9401084e88deef3b0957287d48d12991c0bdb738", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014242, "uuid": "937bdb43-d8b3-4728-bcb2-77f05f27b890", "comment": "Malware payload (Mirai)", "value": "86e5f138e8c204253284a49cc65150ef936c72e67f04bbf84b6628483a54d7ca40326dde9921043513f7f806ad95d670", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014242, "uuid": "32a513b6-7cdd-47ab-9d06-3087e13be60b", "value": "F1E34C46EA818E13C4D52776BAAF41893332A764D3EB73068D185FB43FC6B6E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014242, "uuid": "ded3f352-9858-465e-ab97-c1f179f273b2", "value": "3072:QNAFGVYNTgsbStFBb4oLfaGOFQlKJsP2FD7dD3UvM/9SIaAFpzX0:QCYVagTBbnLCjFQlKJseFdD3YM/9Shca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624014242, "uuid": "60aa28c1-7976-4464-8446-e1152dc0144b", "value": 157022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624014242, "uuid": "96f6a026-ea70-4ebe-a0ca-692d9b81e3e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014242, "uuid": "5aa3e20c-c475-4172-9a00-847e3d05b3e4", "value": "71cbcff97131091916a35501fde4fc9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7bef68-d08d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624058981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624058981, "uuid": "6760d8a9-9853-47fe-8e94-b536ac711991", "comment": "Malware payload", "value": "607a1510ce7946e7e5528dee9a6e6e2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624058981, "uuid": "c837acdb-2153-4643-9dc1-3d2e657d88b3", "comment": "Malware payload", "value": "af9417afddd1867732538ff369e917f68407906bef20dfb2e0b99ee8a04664cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624058981, "uuid": "4e5e5791-2f91-44d7-895d-9d51f68c004c", "comment": "Malware payload", "value": "ee1c495e4238ad9ee2ba69cc521b035673aef6a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624058981, "uuid": "7ea24ce9-fe8e-4898-a301-201d205540c0", "comment": "Malware payload", "value": "2b9631f169eb121a6f500c0ddb381b074ef0057f3f4112baaa47ba0c20cc74c6135dce19d6921b73a7a08cd38ec5f275", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624058981, "uuid": "f95e4302-9267-4da2-aea3-48ea35a5f796", "value": "2784CF10FB90C035F5F612F85AB6D3B9A93D7AB1576090CF52E52AEA16346E0EC3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624058981, "uuid": "301c0de9-20c3-4c8d-ad1e-b2afdabc7352", "value": "f38124646e535204cd12e80d37ffde43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624058981, "uuid": "bd168386-01ed-4a32-956d-e126cd7eb983", "value": "6144:c/a+CnhocDMDVMV4HkwXozxdOW6IsusZ5HhLX64CFPZPnheSjY:1+ChocIDVMmHuzxdR6w8FMthNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624058981, "uuid": "7cc3c5bb-38f7-4123-9571-3d87e58b8450", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624058981, "uuid": "357c6dc6-65f8-48b7-9c91-178c127e5d8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624058981, "uuid": "04f93b5f-616d-41aa-ae56-1e9aa8ae0d08", "value": "607a1510ce7946e7e5528dee9a6e6e2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ace878a-d030-11eb-875b-42010a9c0053", "comment": "Malware payload (BazaLoader)", "timestamp": 1624019032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019032, "uuid": "d0958e19-f294-4701-a985-722bc18e2652", "comment": "Malware payload (BazaLoader)", "value": "c3146a80e7a0c5069b3b3172bc4a16c1", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019032, "uuid": "e9fac922-9dc7-4840-9326-e322f8e949d1", "comment": "Malware payload (BazaLoader)", "value": "b057eb94e711995fd5fd6c57aa38a243575521b11b98734359658a7a9829b417", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019032, "uuid": "5df16464-aaae-4dc9-89f2-f529d09ce8a1", "comment": "Malware payload (BazaLoader)", "value": "ad3fe6390c5ed83333574de3b925e7434e552762", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019032, "uuid": "76e4318a-0bc8-4257-97a0-d9b1cd6b727c", "comment": "Malware payload (BazaLoader)", "value": "26a857d26747fb1b7f6f07dffdd62fe2d6a5e345eae08acd29e8b22b952459d3b04b18f5f5bd1f5594e052fdfa253109", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019032, "uuid": "f9691989-549c-4671-a520-08792a432399", "value": "3F14AD4279C88C53ED1351FF01C88FAEC35491095EF3250BB64ADD74B8E73DB51A89AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019032, "uuid": "5bfa5157-90ed-40b8-a999-9cf55dea7688", "value": "0934687d08f28a028d91dfbde9816da0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019032, "uuid": "b42c9dc8-3e1b-41e2-90a8-2ee2708631fa", "value": "3072:KqpWD9mV/3ZHV0CYq46g+iDtPIfnL3KZ0OC0sGH/WarJlmoaX/tK9ZArQl3z+R6b:K75mV/330x0T8O4H/WafFaX/9yj+RB37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624019032, "uuid": "f21c6c83-a2a6-48a6-acca-146ba18212b6", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624019032, "uuid": "9ed897a7-cd37-409e-96fc-01663dfc30b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019032, "uuid": "f50ad78d-b947-49a3-89e2-75b10a3deb21", "value": "c3146a80e7a0c5069b3b3172bc4a16c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7993ad5f-d000-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623998602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998602, "uuid": "633029c4-3c3d-40ee-b776-0c09a5f911db", "comment": "Malware payload", "value": "fe6bb808dff8cb1a8571a1a07dbafe89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998602, "uuid": "ce5e7596-74ff-4704-a2f8-d7764c73425f", "comment": "Malware payload", "value": "b14a43816be48e5624a82bc768011389daf67645ae8cfe2078a9ee523d8e8afe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998602, "uuid": "e18815e3-7e0a-40ce-94aa-04a67335f023", "comment": "Malware payload", "value": "5611d48b3998ca8d428cd19f8ad85c30e1e54686", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998602, "uuid": "06164913-03cb-4cde-ae35-6e211e5bcc23", "comment": "Malware payload", "value": "a492e7563df75cacb168363caaae4435a0ae1ed93478b0222f1ae91d3843d29e8b70edfd8a8ecb3a46987ffc520d6f2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998602, "uuid": "b430dbc3-4a82-459f-b46d-b43f803bf574", "value": "C954AC5672A0C084D6A581B6D541C7F5E7307C721B18A3DB2BA47EB73B1A8D69F3C3A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998602, "uuid": "a5f57420-d22e-4951-8933-92f09d6d9fc9", "value": "7182b1ea6f92adbf459a2c65d8d4dd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998602, "uuid": "dd3d3bff-8a0f-4786-be20-a4dd93ad7b9c", "value": "6144:Et5hBPi0BW69hd1MMdxPe9N9uA069TBIcr7tGuHo67g7GnJaKeOnSlt6iPigOqZt:Etzww69Ta0ZGuVLJat/lsiPigO0npUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998602, "uuid": "b2e4e05f-8821-468c-afce-2c5cc7bda696", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998602, "uuid": "6b1de38d-a460-427c-a7bf-db082f46c042", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998602, "uuid": "bfeb9d84-6702-4dde-943b-e8d2395dc4cf", "value": "fe6bb808dff8cb1a8571a1a07dbafe89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38360c07-d01e-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1624011377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011377, "uuid": "bd0104c3-c9ce-41c3-b813-b47d1f09fd4b", "comment": "Malware payload (CryptBot)", "value": "28a8f63be71f6d426408427ec83766d8", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011377, "uuid": "b9a80fa1-27c4-487d-a92e-198727c52fa3", "comment": "Malware payload (CryptBot)", "value": "b27136291ca18c364454b29f1f76e4d97cec1c3bd2f2d7a7f1f7c4f7e49044e7", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011377, "uuid": "8adcf406-e2a8-4d7a-8172-ce3ae715b665", "comment": "Malware payload (CryptBot)", "value": "4e03bbbdee217839b6376d87a9ce4ab0ec6b9357", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011377, "uuid": "b67839c2-ee01-413a-b70b-98732f651b90", "comment": "Malware payload (CryptBot)", "value": "77b8739e24a1441a91e696e19008a8241a2d9bec77817be1a1545c87d6b05f5c094c0bab1d6d197fc291c153eaee9d07", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011377, "uuid": "0bcf0ae2-7ffa-403c-b74e-c8027920efbd", "value": "5EF4F110AB50C035F4B712F899769329A52C7FA0673854CB62D92BEE17796E0FC31E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011377, "uuid": "6e20551b-1166-4bd4-b1f2-d0e33e3d640a", "value": "866e8b0fa01ec6fd81db7579c1be52ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011377, "uuid": "e1071fab-4dfa-41ab-9b55-04624fad8fd8", "value": "12288:dki76uZ5O0uVgh34bWBr/A8Ozc3u5nq7rZpbHGsO2sO8BppAyPcNA/:v6u5ptPdAdce5nq7zb3OVJBpp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011377, "uuid": "6eccb4d9-d9d2-41b5-9119-c419b89acd38", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011377, "uuid": "984b650a-9a92-4b05-9fab-3f6fa62865fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011377, "uuid": "0a515212-3e9c-455c-ae55-640e016d827e", "value": "28a8f63be71f6d426408427ec83766d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc63151-d01c-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1624010685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010685, "uuid": "be317289-ee26-4591-9c3f-aa5f78349529", "comment": "Malware payload (TrickBot)", "value": "84f647e0737fdb6398ab92cadd0dc70c", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010685, "uuid": "5e1f75dc-5567-41b8-9018-5454140432fa", "comment": "Malware payload (TrickBot)", "value": "b4eee2808e62c97547707f5ec4abe46371eb79ebe970f2b311de9eaa3da1432c", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010685, "uuid": "cc6d6bce-35b4-4ff5-903a-d86d1210b3f0", "comment": "Malware payload (TrickBot)", "value": "4e142fc9dfdf7386450495e4995e885322752562", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010685, "uuid": "2eb03d13-3619-4f5f-8907-781b2ae4525f", "comment": "Malware payload (TrickBot)", "value": "6942a4f8814cb57532b3495c9429f9f1a643205d370154ee255ceaa1e0c44b6e440ccc591a0b4e0a6bcc89dc65917cf2", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010685, "uuid": "21b5918a-9ec1-4167-bc02-3f6053ef5f51", "value": "7EF31206D701B0E8C66350B5594235D97C6970BABE42FE4E6F74BFAAB3010DA32CE716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010685, "uuid": "08f2e113-dd98-430e-9db2-e1a874dbbc2a", "value": "3072:iJU9VlUBWA6CFvA7bRCxAVIKBIKxVymd1xXP4XHwYoQz:iJU3liWA6FsYBfxVyWxf6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624010685, "uuid": "e53f63e5-07c5-44be-8126-1ab4f9e4ee20", "value": 158973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624010685, "uuid": "021a2c19-b5c5-41f2-95c1-f537efc0bbcd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010685, "uuid": "b3d24138-7d44-4458-9b3a-d6fa1fc33b45", "value": "idea-1134058065.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79aa0c22-d01c-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1624010628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010628, "uuid": "d1a1e4a2-709c-4790-9484-f853b31f3984", "comment": "Malware payload (TrickBot)", "value": "8c14a86adde3863e681143f447844558", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010628, "uuid": "bf67a5c0-ee40-4787-9666-a7337d725a1b", "comment": "Malware payload (TrickBot)", "value": "b550f1eadcf4a23cef048140efabfff3596a3d88364ae6b6acc4d9545e97ab02", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010628, "uuid": "1d19f968-2c7b-44d7-b5a8-61ccc0619f38", "comment": "Malware payload (TrickBot)", "value": "97d4353e41ee3ba2836a95cb9e457274fbd84587", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010628, "uuid": "8ad85231-e4f8-4083-a204-7e0af20fd875", "comment": "Malware payload (TrickBot)", "value": "27d3b8ea4fe825f71b2175796a4acd407d2d62d7de00d94a1b40a35c294555eb9149546d21d474055fe1855bc6ad259b", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010628, "uuid": "12f37fcc-7254-4af7-b64a-abac585ce1a2", "value": "51F31205A212F0DFC2602039D793A450AD35B29EDD43FD5E1A71FF466B121FA278E68E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010628, "uuid": "42ca85ed-53c9-435c-a4fc-ae331a698c89", "value": "3072:HzTkdm3bGeAxidxVymd1xXPMU9VlUBWA6CFvA7bRCxAVIKKU0:TTkeGKdxVyWxfMU3liWA6FsYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624010628, "uuid": "cc2875f8-c66a-4c10-9354-f07990dd3565", "value": 162061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624010628, "uuid": "a75b2f9b-4e47-4e28-bf12-7a67f9f4610b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010628, "uuid": "13e3ff78-9e4c-4ef2-83a5-ff311a8be09f", "value": "idea-112755060.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e7a03f-cffa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623995883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995883, "uuid": "a771bfcf-518a-49c0-9472-7965ce71eb5f", "comment": "Malware payload (AgentTesla)", "value": "e294bd7cf1940a5c8863aa001b853989", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995883, "uuid": "593466c4-3539-47b0-8cf2-e03ea94bb00d", "comment": "Malware payload (AgentTesla)", "value": "b6c2562f158da85b6c25d51f1d5fa1d768454f733e035009fc8ccd0deb0e4423", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995883, "uuid": "d15b9aba-a50f-4365-9eb3-abebbe3193d5", "comment": "Malware payload (AgentTesla)", "value": "12b04653d204eb7e69f7dd2cf6344cde40bcd2ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995883, "uuid": "4a34d2a2-c232-4681-a1e2-6e70d13be979", "comment": "Malware payload (AgentTesla)", "value": "4c1db8502fdd7fc7a205be7bbd68de3729c87bb10722d75d68980cd7ac4691763cf4eb642c492c8c595c652f3560dfb0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995883, "uuid": "03ebba2a-846b-4ad2-b027-5914242e7fcd", "value": "5B55089D325075DFC85BCD32CEA81C64EA60B87A870BD603A05716ACDE4DA9BCF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995883, "uuid": "31e59f79-ca7b-4d58-b4e6-d0a72d762b15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995883, "uuid": "63e3d26d-2237-4d56-a511-ca57f87f16b7", "value": "24576:MzRE3Pc3Qpit4Joc/mEfK8mCOpwDCT/FE:lsg6ci8mCOpiCTtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623995883, "uuid": "b4d7a351-d849-4456-bd94-7e518190f6ed", "value": 1358336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623995883, "uuid": "cb21b381-b177-41a0-a277-dbccf3a5b1d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995883, "uuid": "dad0ff1a-faa2-4a33-b02b-2dd2b39d2959", "value": "statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f695367f-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1623976907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976907, "uuid": "d19ef038-1f13-416c-8de9-2327e2965ec7", "comment": "Malware payload (BitRAT)", "value": "c225532271604599fdd6165139990db5", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976907, "uuid": "8c96aaca-0258-4a4e-95ca-289ee57d871b", "comment": "Malware payload (BitRAT)", "value": "b6ce6b4e43c8d9c4941d9ea50cd5a816a1fa044f8732357c642966811c3dd1b8", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976907, "uuid": "1f1ace08-5d63-48ae-8c39-82db244ec578", "comment": "Malware payload (BitRAT)", "value": "6ed96a70aea8eb6e3ceced8a118e23c9f1c59973", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976907, "uuid": "40d5415d-c081-4c47-9709-c5e48ab5b341", "comment": "Malware payload (BitRAT)", "value": "e73122bc3ddcdab31437a5479d64c3bcfaa5faf7730866836977af412c2e89660c9a5f49c6a42668ecf9a80c7908f843", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976907, "uuid": "15a1eccd-44c8-4dc6-bdde-807e868b4671", "value": "0306336B38D046C7EE45A035A61B359AAEBC4A8F144EF7E7D7D923FC2C5804741A3623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976907, "uuid": "55410cbc-c03e-4ec2-a958-cccef1daf60d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976907, "uuid": "e016b762-321b-4c61-83e8-ead45f16cd13", "value": "98304:tNGB5F93XsAJaOx9HyjzZqY6uV9Rxv9Kq2tZYv1K7NA:tAB5F95aO7HMZT/xQq2tZw1SK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976907, "uuid": "66e00a1e-9b5c-4591-ae91-68dc39223a32", "value": 4009969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976907, "uuid": "b9751720-53d4-43f1-8d01-7bd3d51c263c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976907, "uuid": "b78ab314-db8d-435f-9375-8d03d1581f28", "value": "Booking Confirmation 06162029746647134765751..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ccb4084-d000-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1623998607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998607, "uuid": "59221274-a412-4737-929e-ceaafeb383b5", "comment": "Malware payload (Smoke Loader)", "value": "7aa2be816ab6bd4f9decb75fd31e0f29", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998607, "uuid": "77a21e5b-1215-4fce-ae69-4e1aa187ac69", "comment": "Malware payload (Smoke Loader)", "value": "b751a245f558db84cf77e46e473073e2dd23fbde9f9d150d63e525bbf4b88e8c", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998607, "uuid": "6215f1a7-dd1f-4612-89a2-643a523237cf", "comment": "Malware payload (Smoke Loader)", "value": "4f8ee409345d50a626a3a3f963364ed0bb5a9644", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998607, "uuid": "85db306b-4a93-4d7a-abd2-3b0abac52c4a", "comment": "Malware payload (Smoke Loader)", "value": "ebf12bc46bd7e1be9b1a4bd97bec6ac5205e4bdcc2125248413a29e9bc5e53e7f4ee05464c1c9fd1cc92fbb97e5d3f0b", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998607, "uuid": "ec0b817d-c5c3-46a0-8b19-c2238e68432d", "value": "CD547C10ABA0C035F6F722F84976A37DA52C7EB05B3450CB96D52AEA57346E0EC3171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998607, "uuid": "023973fe-0924-41a9-b1dd-be9bfaa1013c", "value": "0e61e5ee811a73c290e64659dd192375", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998607, "uuid": "fde1f341-aa1b-4a25-86b3-44cc15b2e032", "value": "6144:7CwuWDYsxNANSOqelTe4Us6VLVzEUac7yyj2lt2lC:9uW8sxNANSOqe96VLVQUac77jGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998607, "uuid": "2b8c96a6-1d45-44be-884b-d57b1c3a6060", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998607, "uuid": "24d04901-c988-4c09-ac67-d0e9365edd96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998607, "uuid": "dcc08124-3dd8-4df9-a901-d66c8185dacb", "value": "7aa2be816ab6bd4f9decb75fd31e0f29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f085302b-d061-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624040463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624040463, "uuid": "8af60d77-143c-4e3c-bc3d-2b18d4f4f39c", "comment": "Malware payload (Formbook)", "value": "0d459a9762572513cf3d1a4c84707fa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624040463, "uuid": "c62e0536-0096-4107-82ed-deb1837aabe1", "comment": "Malware payload (Formbook)", "value": "b87622ead26347ccef7029bdde1ea0393196dc571f649f2e0c24020eefbb7ec4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624040463, "uuid": "4a0cee72-67cd-470e-9872-bec7d075ee23", "comment": "Malware payload (Formbook)", "value": "69c4e8deea6be9d7509fa6b72ae2bd484de42fd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624040463, "uuid": "bea02785-3abd-491b-8c7e-51b2b035a449", "comment": "Malware payload (Formbook)", "value": "3379ef160e7d6851a27b921ace2f2ec72d4699a22025cf18e898639e8ed9b9e28299bcfce84821a7b2e2c3baf5208dbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624040463, "uuid": "5b6d1115-5faf-4b7d-a916-dba4872b92f6", "value": "1A653396E93E7644D83DFABF02B274782BD556BC2C89115336E0D225D17A7BFC8860E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624040463, "uuid": "7c8092bd-d08a-41be-8252-0997c9362cc9", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624040463, "uuid": "23a15a65-e9eb-439d-ba43-2d1ab9bb3a93", "value": "24576:Fs+/xcbpjcW8TEV3Dm18Hp/dg+yWxZtjWmP3Lcwr/KkB++3rMd1kAaJuNchhg8uD:Fs+/xc1YHTEdgq6+j7tjWS/SkB++3rMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624040463, "uuid": "4bca5ce4-562c-4f3d-9ef4-3ca8119ffc91", "value": 1543680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624040463, "uuid": "a845defd-3323-4ca2-a5b9-666d18cbeb89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624040463, "uuid": "1b290662-8005-4075-a1cd-ac66330d0a3a", "value": "0D459A9762572513CF3D1A4C84707FA3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a4959b-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1623976912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976912, "uuid": "ab0e39f8-45bf-4273-8b13-2299ec207f73", "comment": "Malware payload (DCRat)", "value": "f8fe9248ec2f007d7b6631c892e7cf91", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976912, "uuid": "f98cddd3-fdd9-4513-8d44-5b029148a009", "comment": "Malware payload (DCRat)", "value": "b9bd8b8a68c178b40cbe38af42b5023b0ba6b72bbdadf4fba3d94efbc225a72a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976912, "uuid": "26753048-97fc-4029-b0b6-0a838432f6e6", "comment": "Malware payload (DCRat)", "value": "bad4a4855efdd7fcb5bf5a19182957bc92b9ca00", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976912, "uuid": "6db7e50e-cde1-4935-a4d2-bb47d43260fc", "comment": "Malware payload (DCRat)", "value": "d8e26fbecbf9aed36adfa0be2de7a97b85276fb8d12edd171070a54c2a78a4e44f9d7787bc6b3ccfb8c7830a86ae9336", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976912, "uuid": "06adf584-5135-461f-a932-b6a267ec8cc9", "value": "F3A45B152F9CDE45D22FC6F444F9295347BB8186F6A6D3AA0CB440E4BE433968F4E09E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976912, "uuid": "e9f0464b-eda1-4775-afc3-56a935b1a4ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976912, "uuid": "b14b97e9-c39f-4c2d-ae24-b4153888ce77", "value": "12288:raF4KBUCrtPKfgxl6QL0cXur/xchRXZlmqn:HR8Pagxl6Q8mm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976912, "uuid": "467ed5b3-2bac-4616-b710-0570cf4a34c2", "value": 451072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976912, "uuid": "50588086-7eaf-4ad5-9453-110d38f6472e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976912, "uuid": "0cfd32a9-3c9f-48d0-a179-ed0b46ea61ee", "value": "B9BD8B8A68C178B40CBE38AF42B5023B0BA6B72BBDADF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a641491-cfda-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623982282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623982282, "uuid": "dd94b4a0-fa54-42d1-a88e-87941ea7013c", "comment": "Malware payload (RedLineStealer)", "value": "39c117ace849f637797628c0d42d3cb2", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623982282, "uuid": "372a1461-0b25-47eb-b980-0ae712281736", "comment": "Malware payload (RedLineStealer)", "value": "ba1d4c519566f6e1e5cfb4e5650847a3d5086b3327685000a78cb2010633fd0d", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623982282, "uuid": "92a22b5b-5231-4985-bc79-a6ec3226d215", "comment": "Malware payload (RedLineStealer)", "value": "624d98234bb68b887940414ee8765925aad6b6b5", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623982282, "uuid": "ff36c4d3-9b34-425d-bdf5-7d61070c0453", "comment": "Malware payload (RedLineStealer)", "value": "6680a4382f4540bf7e7d08f2b57427d84ab64a288b67e4df557a5118a59986300f98df298eec8fa2291d02a739414de1", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623982282, "uuid": "82037d67-e9e3-4404-a5e2-c657066d9962", "value": "48B5239B666063E7F057237898D6AA06B3F034464727D2EB4220D6766F13BD06D3DB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623982282, "uuid": "2866f2d7-e9c8-4936-bed8-7bec44e9dbd1", "value": "22e7125b95acf497b07e79559bdc556c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623982282, "uuid": "44db5b45-a191-4045-b894-7ea07a4c498c", "value": "49152:mW3yaykSUuEXu5WrTDVASDQHwucjb02fCzMPGpM:mWiNkSUtDVAS0HDol/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623982282, "uuid": "ff12f85e-b8d1-4762-bf46-dcf45b4b5740", "value": 2467407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623982282, "uuid": "949e378f-8a21-47f4-b83b-5a71cf633ae3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623982282, "uuid": "c5e847e3-a576-4b46-bb07-f3c9162fdf30", "value": "sE3PiwL1fx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4da8246-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623976877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976877, "uuid": "250d5e1f-0f02-499f-85bd-9cd64f3f9947", "comment": "Malware payload (RedLineStealer)", "value": "5defc5ddab48f02ee0de6278946949c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976877, "uuid": "161e5d7d-b8da-4fc8-97c8-13043f3a499c", "comment": "Malware payload (RedLineStealer)", "value": "ba9c1b8eca8da8168c6e5db31aacf36d2b9859054992d05e06faa61927ce3d59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976877, "uuid": "a8ea7cd8-10da-4377-a5bd-22aec266a828", "comment": "Malware payload (RedLineStealer)", "value": "fa2e959ee285f6cec0c3acf2e13ccd0be7241571", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976877, "uuid": "c922d25c-44a5-41d2-a7ab-cddc61e5e657", "comment": "Malware payload (RedLineStealer)", "value": "6b19ecf0984917f1208c640f92b9af93e98bec89bb8e04e99e61a7504ae2f2c19d46d71eea29551524157c2d1d459347", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976877, "uuid": "96f9701a-bb03-4fa3-9cba-c4e227b2ca25", "value": "0F55371869BFD01961E3EE512DDCA8FAD99A55E3240D743B10B0733B8B52B80EE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976877, "uuid": "776f6e34-026a-4507-8d98-4d81fa417c84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976877, "uuid": "c7fc921f-f6cb-412c-8d1a-f679a9b38d44", "value": "12288:JHK8xalveoN2XPYc9fSg0JwqPj9BdkXdFQyTYYIwBVvfHiQMe79oNbrKcHZiFGr6:5tBqLEZMs96TbxwX0lKLRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976877, "uuid": "e505d737-4994-4a18-beb1-b1b03c09a516", "value": 1300480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976877, "uuid": "57fe1426-3deb-4589-8d6d-5a2225412bff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976877, "uuid": "9ae4bdb5-2cbb-4f28-b986-1d83ff12fa95", "value": "5defc5ddab48f02ee0de6278946949c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c52e24-d077-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624049575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049575, "uuid": "63b5580a-8f38-4d81-8b72-c1e765a6b9c9", "comment": "Malware payload (AgentTesla)", "value": "8296ade807c06e548618e71cc38d7b78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049575, "uuid": "c474059d-3671-4fa8-9c0a-c0da7170e796", "comment": "Malware payload (AgentTesla)", "value": "bb1317ced122d23448353be57ded7530347445fc3f14994ec293169a9dc628b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049575, "uuid": "be9fc1ff-7368-4026-85ca-365d27e1ab3c", "comment": "Malware payload (AgentTesla)", "value": "fb969bb8628ad46826f090d828fc676ab2767348", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049575, "uuid": "95eb6ea2-13bd-4aeb-89a2-66400afec2f5", "comment": "Malware payload (AgentTesla)", "value": "876f6809cf3676de392d762dda21a9310d4f9e566727827fe4bbfefad14ab06509ccc2c8707fd925caec0f645b3b6482", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049575, "uuid": "27cbf933-672d-48a9-a394-596571456147", "value": "7EE4CF243AFA6129F177EF755AE475D69AAEF7233703D81D2891038B0613E40CED163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049575, "uuid": "8ba59d84-b5d7-4527-9dc2-1bc385a08cae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049575, "uuid": "16c0e6fc-fbb2-4624-85cb-b1c8fcb5225f", "value": "12288:vsshlm4S4F3M9yxm2iNJQcAH4zJrgseqAmQOJm1NGeP3niBjSIqFc1:vFWB15KgjRQPN33niBjec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624049575, "uuid": "2ac84946-5453-469a-a7a8-852a17466521", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624049575, "uuid": "a1940048-6d28-4bb0-bcbd-64fe073659fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049575, "uuid": "fbaef3ba-08ff-466f-89b4-864bd3eaaa34", "value": "Purchase_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009e5fe2-d05f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624039201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624039201, "uuid": "caee7414-65f2-4c47-827a-23ff5e7d3199", "comment": "Malware payload", "value": "ec7d6fcc6914a94f4cf893e731ed3619", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624039201, "uuid": "ee9f6b54-cd1e-4ccd-a85f-c4a8e9a865f4", "comment": "Malware payload", "value": "bb2c9c585e1eb2ee984d3bed9cd6d061560b65a64afa16725152e50d5a60c4be", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624039201, "uuid": "d538f226-7c10-4524-897a-356c0c768316", "comment": "Malware payload", "value": "b09270f078401f4786771c7b43269b4070d82b79", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624039201, "uuid": "c64b586b-3952-456e-bd75-90d943876ee6", "comment": "Malware payload", "value": "be60ab41911834dc79aa60ed58ce9eab7e6747d161c9ff17a0f0aab5ea48612ba4df167119f1cfa2e262e8217de5a66a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624039201, "uuid": "01449f76-9043-47cc-972e-179a264c42ac", "value": "763533B1F8671157CA0778FB0D0406D8618E3A925EE2D2A5FEB0E76D04BE5B41F831A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624039201, "uuid": "25c20f79-995d-4a97-ad30-c8981efe59a2", "value": "24576:ZaI2DqGgQxsF+d0U31Jtn8Zrxzuv3hCU84biCyoNTFlv06jgRNvmc:12DqmmoTt8Zr6CRSRFlvH87mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624039201, "uuid": "214fc694-eeeb-4f98-82cd-65e5f839bc31", "value": 1161441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624039201, "uuid": "37c56f59-0a57-4fe8-a30e-63d1150202fa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624039201, "uuid": "58fa5f67-b2f7-46b3-8be1-ae6dbc528fca", "value": "Doc-347654566091233.LHAX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a95a14-d02b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624017246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017246, "uuid": "5af4d3a1-fb59-406b-911e-63f5129e1927", "comment": "Malware payload (Mirai)", "value": "32c44b3b094071dd2e313bdcbad10d4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017246, "uuid": "965ef9da-f6a9-4fdc-83b2-ce5decffa6f5", "comment": "Malware payload (Mirai)", "value": "bb63626eda7dc960e055a017e2b4959be7f496ab0caba1f3e203cdeea0c04565", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017246, "uuid": "a8d76540-9854-42e3-ba85-c91ba5c33184", "comment": "Malware payload (Mirai)", "value": "5167400d442ac4f513caf52326f44b61722c4916", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017246, "uuid": "86b29966-1499-46b4-a374-83545bf506ce", "comment": "Malware payload (Mirai)", "value": "44cf8da373194e7a2f5b03382a22a6a854f8f7ce46016fd0d672f41dead1a053e6378587f8b4a5fbb0ed9e15d339a782", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017246, "uuid": "8b7cf415-f01e-4ee0-8fb4-6c4bb43e9257", "value": "CEB2E178AD425D1385716A7BFEB88D843B446FBCD0B4334352B0C5999A0388A6BFF593", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017246, "uuid": "ca5362d1-9086-416f-841f-60d9afae8dce", "value": "384:LOrdwj9M/ThgBJr/z/SIP1ZD40w/C5xg7j+7Kogh7qmdGUEpiaY:KyybEP/SIzDM/Em2g9q3UELY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624017246, "uuid": "d985c833-691a-4d21-a32e-43d86831e863", "value": 24720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624017246, "uuid": "91b17019-b205-4b58-bfdf-124a9e6eecd7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017246, "uuid": "b42a10d5-7dbd-455a-b40c-26ef183a59b7", "value": "Samael.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae5e943-d071-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624047110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047110, "uuid": "f92be207-b96b-4275-9059-40fa335f28c1", "comment": "Malware payload", "value": "530f12f8058199964d0b41f1856185ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047110, "uuid": "86431cb4-aef5-431e-a737-c4e086967565", "comment": "Malware payload", "value": "bbc58fd69ce5fed6691dd8d2084e9b728add808ffd5ea8b42ac284b686f77d9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047110, "uuid": "527d8953-0dbd-41ba-81ac-a841c4c44bb3", "comment": "Malware payload", "value": "8b04023990d18dcd5cc4c5538b332b017f3962fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047110, "uuid": "6b3dab62-3437-4e9a-b1d4-f1a606e1671a", "comment": "Malware payload", "value": "e8b08618ecb6c590918bf6f112108b8413c2e395df23342e1b329bfa165e5885a0ba8a3d8d1c01e00a606d59c8aba9cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047110, "uuid": "efa51b69-2b17-4487-b98c-0feb6a02dd73", "value": "90438E95A6A814D9CA77E1B4C266AA1BFBF17452232183CF0371C5950F633E0EF3A781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047110, "uuid": "0049065e-e43d-415d-8aea-f33d737458f0", "value": "d252001e327cf09463aba69fb4de2125", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047110, "uuid": "000ff20d-6c3b-4250-9082-07461cb61089", "value": "768:01ZqCQKy8IYdfWiUelR36ihR6nmRYsn5jS/OPNi7SbpG:0Nyq+4lRX6IHnsOVi7so", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624047110, "uuid": "fbddcb3c-7d02-4f04-b355-36705c73fa20", "value": 57216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624047110, "uuid": "bf5e7d3e-9e0f-441c-8bed-01f78c89619b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047110, "uuid": "7741d763-b3ef-47f2-bff2-2df336823527", "value": "bbc58fd69ce5fed6691dd8d2084e9b728add808ffd5ea8b42ac284b686f77d9a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ab65e2-d021-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624012898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624012898, "uuid": "b1296c22-661e-4081-93f7-26dd2a2310c6", "comment": "Malware payload (AgentTesla)", "value": "c857c6373623587f6a5d763900b1437b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624012898, "uuid": "5bbdeaae-3bfd-4bfb-aa01-57af4d6c458e", "comment": "Malware payload (AgentTesla)", "value": "bc57e420dec21d7e6a08748c9a531cbdbddf2251e656492521a4f16b692c23f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624012898, "uuid": "3fb5a5a6-200d-490c-96dc-f05e75878621", "comment": "Malware payload (AgentTesla)", "value": "5cffca028593478cb248813e315b834559e7a800", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624012898, "uuid": "366a85f2-f3a5-43c5-a9dc-295591961b3d", "comment": "Malware payload (AgentTesla)", "value": "3884067533a949af3dd5dcc7c4ea2d6be8dc1c59ec3fc609445b6841156b1f67b3364b381cdbe87bf30f002f33abf2ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624012898, "uuid": "c2420dc0-aa28-4088-bbde-c49d8233680c", "value": "63D4CE377406E06DC637C0BE6451E099BE630E231DF2961A23C877BD693B665BA31F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624012898, "uuid": "a1ebdfd7-cda6-444a-8c73-70d2f189511c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624012898, "uuid": "168f2f0a-cb6a-4da2-b416-1ae3117ead10", "value": "12288:Sej00T45Ld3ksRLgCOcMEonF8+7iY7rCW1zRnWaI2i2:LbMJdZnOczG7iWr518aI2i2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624012898, "uuid": "6f784f67-c78c-436c-bae5-3fa43bd65029", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624012898, "uuid": "9ae68231-4009-4d34-ab03-73029fe66501", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624012898, "uuid": "e37476f4-da2c-4c09-a3f2-dafa30b66834", "value": "MT. TIGER KNIGHT_Ship doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f714ae-d01c-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624010784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010784, "uuid": "2fdd57b6-24fa-4fbf-9068-107d03dba4ce", "comment": "Malware payload (RemcosRAT)", "value": "8598f657885173256e450b76296a5f38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010784, "uuid": "d1017d53-7584-4a26-9548-fead4357aac4", "comment": "Malware payload (RemcosRAT)", "value": "be63bed59267683057545aebde3e553ca5f270b6750ab9285b881fec0ddd5dac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010784, "uuid": "ff015ee5-d7f8-4589-bcf2-83c2011dc269", "comment": "Malware payload (RemcosRAT)", "value": "d29de9a71cf3b1708bc0375c51fdbb25fb15bf32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010784, "uuid": "a5ba2076-456c-47bb-9285-c6fb0fb7bd9c", "comment": "Malware payload (RemcosRAT)", "value": "19f163c02c6da435d545d8f558d886f648dfb2d4784b28b179df36bb8ecb91d9f70dfe79387d26ed9907f43f7d898b56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010784, "uuid": "b0204f35-2206-4412-a768-f28bdb15d40f", "value": "C1258D1DB6524833CD332BFDAD0B52A8583B3E513D64DD4A3BB939457E39381392A09B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010784, "uuid": "658d2a2d-d44a-4357-adbd-2f270f79e5db", "value": "2f23599b8bdd1ddfb668f4b1b06d241f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010784, "uuid": "65d073cd-fba0-413c-9ed4-b455848c77b6", "value": "12288:0Dz2Q7Q291DyIe5y+SKera8JzsP0XmoX/7TCOcbbkXbweFjqX0uNb+T0HXX+jBnD:0DyQ7h2y+SKS2Vy3Ibk8eZq/XQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624010784, "uuid": "285aca5a-329c-47bd-9e75-bd1c4a3f13e3", "value": 1027224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624010784, "uuid": "6cb507bf-a162-4c19-a32d-a08161959bda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010784, "uuid": "b848bf67-76f6-48a4-83c8-d6bf75fae032", "value": "Urgent RFQAP65425652032421,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d741aaf8-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623976855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976855, "uuid": "f37b8fb8-651c-4741-97b3-1f6200709fd6", "comment": "Malware payload (RedLineStealer)", "value": "b65c052aa28a8b0f58d612cbcce96ecc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976855, "uuid": "89c14b44-5e75-4302-9d8b-ccb9b9ced4ad", "comment": "Malware payload (RedLineStealer)", "value": "befa65be19b121abebdfa1348514e2896ae96bf487f99d998b2a1d6f02983281", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976855, "uuid": "ce7153b2-f626-43fe-9cf8-b34732c7d897", "comment": "Malware payload (RedLineStealer)", "value": "e3d6c412f6d12a6c2825527c01a2c07934ffe0d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976855, "uuid": "c5260113-cc29-4be0-9b33-28e987fd0670", "comment": "Malware payload (RedLineStealer)", "value": "a731eb2ba9fc67a0862700ab8cbea604b1f7618b2aa05973c4921914fa6367237163f6d1004e42d024ee72138a8ebd9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976855, "uuid": "84d18880-292a-46d8-989f-76b5d1b40245", "value": "D4C40C2865BFC409C4ABEEB12DDC98BBD99994E3680E713701B8633B4B51784DE4F079", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976855, "uuid": "42e12d72-b66f-42b9-80cd-ffdb72a7f0ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976855, "uuid": "1cda8ac0-28a8-435d-acbb-41316127b570", "value": "12288:FSokMwXfWalveJZ2dv/c9fFU0JaLYWlqj8QR9mijSYIwOVtsyY8:0NZPL7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976855, "uuid": "bec8c8d9-ff7b-4b80-ac32-fbf030232e9d", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976855, "uuid": "65a65383-f6f5-412b-97e0-68402ef1a051", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976855, "uuid": "3bea5abf-60f6-47f9-b6fa-78bcd8221e74", "value": "B65C052AA28A8B0F58D612CBCCE96ECC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab5c6790-d023-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624013718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624013718, "uuid": "62c22364-8cbc-4be1-9806-1f8b1a3d457e", "comment": "Malware payload (Mirai)", "value": "da20544fac341a81877354590b76f011", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624013718, "uuid": "65c98457-373d-499f-bfd1-3aa213c59c27", "comment": "Malware payload (Mirai)", "value": "beffe707549c15834a84215f65f83ef855dcd6f4c2480d34e05cfe05cdb0caf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624013718, "uuid": "303ce4a4-53d3-47bf-92bb-e6745d956dd7", "comment": "Malware payload (Mirai)", "value": "75467fdebf7a51a8fb36806ebabcd5cf55dc976d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624013718, "uuid": "4b839ae2-2681-4a4d-b89a-c963dd12a719", "comment": "Malware payload (Mirai)", "value": "d0da235247a45a21867e33ea988a5d0849c47b1694e55419ec064f2534ca6c7fc41d63a1a826a8f6f4f5fd46c6b993a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624013718, "uuid": "2c492855-8ea1-45e5-9356-92f54e88eb0b", "value": "2BB392197F610FF7E8ABCC374AD92746248CA51A21A87BB1BD34D818F64B25F15E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624013718, "uuid": "f33ab38d-f4ec-43d5-92bf-544c9c662127", "value": "1536:jUnYnOpZxOH5qBRLQQrvz/wBsvZ5TieY11:jDnWZxC5qBRLCsvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624013718, "uuid": "bb959443-a9fa-4c32-be6f-8b7bbc4da4ff", "value": 108856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624013718, "uuid": "506347e2-c661-41ea-b50c-e5ba1cdb5dc8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624013718, "uuid": "c6095ecd-fc52-4c79-94de-be9719a00c8b", "value": "da20544fac341a81877354590b76f011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c4733c-d05a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624037463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037463, "uuid": "af853e9d-6510-40dd-8281-8f9f367c2b5e", "comment": "Malware payload (RedLineStealer)", "value": "a419b2217edf326f6d662638b705cd35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037463, "uuid": "3ccc7973-44f0-4200-9b5c-a2bc460b40a2", "comment": "Malware payload (RedLineStealer)", "value": "bf5748e2fac27911e430058312fc943d8d98538acede8c9d681c2c3076525c5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037463, "uuid": "6d7ac63a-08b8-4164-a077-af7c05c6fca1", "comment": "Malware payload (RedLineStealer)", "value": "43063a603531e1f53a5d9bbe07d82f1609547632", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037463, "uuid": "df85baed-669a-472d-a601-6c7c7b7101a6", "comment": "Malware payload (RedLineStealer)", "value": "3e76ce4520dfd851caa515f33419dfe0429a4388af32f89fa03ec9daa594872c8ba108aa4f801b4ce6e1b43b2b518092", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037463, "uuid": "66837d4f-7b44-48c1-9424-3a101479c83a", "value": "6484BE10FA90C035F5F612F85ABAD3B9A52D7AB19B3090CF52E526FA16346E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037463, "uuid": "1456674a-fb9c-41db-b3c2-5792da336b91", "value": "705a372c868b933d973ca642948b7012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037463, "uuid": "5b87e201-30aa-4561-9420-f9c3eb8d3222", "value": "6144:jGs6snYs7PwGWMCRZv2aH/a76amzcGTG+gnyUPogNkufFv0GVqK:H6sYs74GWMeZdg6amzja+oyRgNkuftJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624037463, "uuid": "71839764-f669-448a-838a-6bd4569e5257", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624037463, "uuid": "043f5796-4d7c-4df2-8d81-042e704e05dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037463, "uuid": "09d49493-0c3f-4b23-9167-0051132e4686", "value": "a419b2217edf326f6d662638b705cd35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41de9b1-d030-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624019370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019370, "uuid": "427bf41c-4d1b-47e5-adbc-43a85b7458fa", "comment": "Malware payload", "value": "07d8a7032e1da21e6787d25c44ec443b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019370, "uuid": "07ec64a6-d9bf-4c42-9ddb-db7ebd170290", "comment": "Malware payload", "value": "bfc667127c0a7ad16d4c27a62bce4ea51561d8c113f64eab8875b964c221306b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019370, "uuid": "121bd740-5bad-4ae9-b442-03dbc18a99a9", "comment": "Malware payload", "value": "f1578808af5181f61a39aad2a51c80602e517c3b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019370, "uuid": "be32c427-c855-4ca6-9a3e-ffc8b6c0e6ff", "comment": "Malware payload", "value": "e9886ca01d95f38be0135809df63710f08c77e0bdbdfbf7079e5fb5b3d226a88943584ee93f472497beff22fd1beec08", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019370, "uuid": "db54be71-88c1-441e-8945-0d97e816fc2e", "value": "D6C2E06CC4ED4D83F912E1F60AD09CF2FAC0CBFAFCD9E2416E914C521A451E9A854AD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019370, "uuid": "5416e228-1b56-49a7-a01a-8b1ef437b3de", "value": "384:sxS8rbcIDCyBz7fDA29GcdUCYnSlPNyS0EOv7e6GoFXcC+i96v8+uTUVScUk:sxSzInP9RdUnaQUOze6GYXMMj7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624019370, "uuid": "537417b0-3224-4e0c-9ad0-2625558dc96d", "value": 27126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624019370, "uuid": "9b8b5618-077e-48e4-b4a1-6beec469cf72", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019370, "uuid": "fd894df7-9863-4e5c-bcdb-0fc77794ce73", "value": "07d8a7032e1da21e6787d25c44ec443b.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bcd0e16-d071-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624047139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047139, "uuid": "b118cf9f-0531-4f94-97f9-f3ec25fde84e", "comment": "Malware payload", "value": "aa043913e02f124a4e7171fa40dfc9a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047139, "uuid": "3cc6c37b-0c46-4b30-a0e7-01e3bbd80d10", "comment": "Malware payload", "value": "bff9b75ae2eea49a765f79d9c67c997edb6c67a2cc720c6187dd2f67980acab7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047139, "uuid": "f19feadb-fb60-437a-b979-cb85b1accf10", "comment": "Malware payload", "value": "73338b8931a3c265e8b544fa17de3056a3e56b59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047139, "uuid": "dc40ceca-09f8-462a-9b03-0f37e4b6e351", "comment": "Malware payload", "value": "a5cec29a86a45ae5177a790986d6f157d8042c53f364ab4cc81ae7f484ee7618d3d8102aeaf4404b0d63003888eab88b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047139, "uuid": "0b8071c0-fa68-46be-9db9-06911f82ca95", "value": "3BB38E52B98590E1C9B694B0C265E667FAB9B432131157CF43A08DB10EB37E2FF39349", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047139, "uuid": "ac41a419-149f-4d20-95a7-1dd22fea790d", "value": "8dab5adbb7713839714005d50ba76bb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047139, "uuid": "5041dce8-bd18-4024-af09-1f3e7b38261c", "value": "1536:HL+3WXOQwi6wEBxmT33U/aNyq+4lRX6IHnsOVi7s:rOKOQwNOTH47q+4lAezi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624047139, "uuid": "e41483ee-bb3d-417c-a306-c002365bb88a", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624047139, "uuid": "9ca60acb-c0bb-4aea-bbbc-b6930119c3d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047139, "uuid": "73b003bc-439f-4dbe-9251-6241c5b5a94a", "value": "bff9b75ae2eea49a765f79d9c67c997edb6c67a2cc720c6187dd2f67980acab7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ddc117d-d072-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624047491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047491, "uuid": "26437541-91ff-4b9c-9db0-f5b1103c59bb", "comment": "Malware payload (Mirai)", "value": "ac833bc7126a65d60087e1fd6802a230", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047491, "uuid": "a13aabf6-86bf-44f6-9470-f6ad56752f82", "comment": "Malware payload (Mirai)", "value": "c0db799dde565584db44253db861461981e6a95b8b35a2660f6bb215ebf2e24e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047491, "uuid": "29029fff-0d73-4bba-bbca-6d9a37b3647e", "comment": "Malware payload (Mirai)", "value": "8d6bbd73380a87352113f534359c6e2bfe7fc1af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047491, "uuid": "842ae7b6-c90f-47b1-808c-98b210f56862", "comment": "Malware payload (Mirai)", "value": "7657efc9e1b25d980ec2f948a5fedb6928d0c0ee31bb92ffed381b90c81526a2ad9028ef3a7d6cc34355fe3690d67e73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047491, "uuid": "87cc68e2-2f4e-49b8-8b74-8c39093690a9", "value": "B93308C4FA8B89F5D90749304067F13FCF31D5B941B1C6ADEF9A9F35DA67502A20228A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047491, "uuid": "74ce6d1d-1e75-4c3b-8dfb-7c4e11b10a18", "value": "1536:nfyMY0q0Yv5qP69Dj0MGNLijBFtbL7YkOE1tP:fyMY6Yv5qP6BoNLiftbfYBE15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624047491, "uuid": "756cb75a-48e1-45d9-870c-ae446ef985f2", "value": 54032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624047491, "uuid": "599d8313-7a6d-4245-8772-e1f68706c809", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047491, "uuid": "18b17323-eebe-494e-862d-60f51e0f4784", "value": "ac833bc7126a65d60087e1fd6802a230", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f5b8aa-d008-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1624001946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001946, "uuid": "f0aca2f2-f0d4-4345-8930-ff8990f63b22", "comment": "Malware payload (GuLoader)", "value": "5cf27ec755267b1f7e443c9f2f45e627", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001946, "uuid": "20c600a8-942f-43da-a292-d513d6873ec9", "comment": "Malware payload (GuLoader)", "value": "c15809e8ecf7f049f4793bd618212fdc2077fce1a626b59e152fbc1bdad41485", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001946, "uuid": "ae19576a-1f14-4f15-afcd-7aee4242de6f", "comment": "Malware payload (GuLoader)", "value": "d85dbd318bcf14667a5feef9237db4f84a627f75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001946, "uuid": "0275e7e2-6738-4fd9-84a5-93a5ed43c0b5", "comment": "Malware payload (GuLoader)", "value": "2a5679bca20a6b2f7323da3a443e674ed223ad32743c0c78009958dc0bec2a19c5205842d7e1661d34494a68fcf5f7c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001946, "uuid": "3f66861f-ec47-4d03-8279-b3f6e19f08bc", "value": "5C24B71AB978A4EAF81190F8FC65E2CF12513F736D2B1D07F6C23B45A03955B95B0A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001946, "uuid": "95013d32-4907-4b6c-9980-f1bd970f61e6", "value": "736ed7b0c5ed5ff5a7eaab3e77ea63b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001946, "uuid": "399809a0-70da-46f4-a7d2-b50e375f4f8d", "value": "6144:8gHI97MiB6PZJH1SSgKNrl3mzF368zcQDPcuxf6SOX+3skfNdZu8faYVGoK28ZL0:Q97MiB6PZJH1SSgKtl3mzF368zcQDPcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624001946, "uuid": "02f5aaa8-e1fb-42d6-af17-c5f8e3a0f606", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624001946, "uuid": "ad7c8dae-c801-4bbc-a9c4-a9e769a52714", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001946, "uuid": "ae16e888-5970-4061-8b75-afc7136b0c4f", "value": "5cf27ec755267b1f7e443c9f2f45e627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7235607f-d049-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624029943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029943, "uuid": "3c9eb9f9-b18d-45ef-ae8e-b2d441b516f3", "comment": "Malware payload", "value": "c2a7a1ba8a9f68098496c35642adb86e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029943, "uuid": "e84b7df2-e3e4-4118-9fa2-1f97483e15b0", "comment": "Malware payload", "value": "c1d5a1f0d0093a4e3fb84efe92f413b389d16ec6f5113a05f6d48801a33d47cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029943, "uuid": "27d00823-af8b-414c-acbb-5d737ccfe87e", "comment": "Malware payload", "value": "15b864be5337dc6e3c5213a6b58a1b301651e718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029943, "uuid": "64dd536e-b8cd-4c20-bca3-d1966d97c5bb", "comment": "Malware payload", "value": "d6264f5779e08f3be8e6a924e6f141fa916df950d98ca5a357fe2563bf4390e51090d2bb66b774d1e100317318ade344", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029943, "uuid": "7cfbf4fb-f05b-41b9-803f-cc846b19cbc9", "value": "2344B3239ADCBCD6E075423033BB93E1EB2DEE706291C05FA6C01A95957C19772227E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029943, "uuid": "f6a79f04-5f5b-4ee2-b532-06e87086e05e", "value": "ee60dc6086fb4fce34e1e9ff4767a8b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029943, "uuid": "371e9fe8-a5f1-405d-9452-c97f2347514c", "value": "3072:b37rSUFPc3nnDBOYPKboJR4F4stNoP8zU0fx/0qvcpzprCHw0:HrSUFPMnDBOYdoNoP8v+pY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624029943, "uuid": "f568792a-7c15-44ee-9949-5237e82d95c2", "value": 278416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624029943, "uuid": "969cd8f5-79ad-4bc4-9495-aef2c5540c0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029943, "uuid": "8a7da7ee-bc6c-4616-9850-e90e0e6d47b2", "value": "c1d5a1f0d0093a4e3fb84efe92f413b389d16ec6f5113a05f6d48801a33d47cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b347943-d05d-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624038387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624038387, "uuid": "075a51da-d8b2-461e-b84f-589c57151043", "comment": "Malware payload (RedLineStealer)", "value": "51dea981aef9cb380dcd902d82ad27c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624038387, "uuid": "7382a046-b995-4bc3-9e14-15b1b8980a5e", "comment": "Malware payload (RedLineStealer)", "value": "c2896116c172b3df93bf203596ea38966c93239adeff82ad67ffd8d789f5f006", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624038387, "uuid": "a0e81f75-be35-4371-b7c7-bbe6a39dfe2d", "comment": "Malware payload (RedLineStealer)", "value": "79a6a06a13fc28477d7870bb620d8017f54b3f5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624038387, "uuid": "459b0b68-0793-4240-af04-c66bf02074ac", "comment": "Malware payload (RedLineStealer)", "value": "2b9fb3e125aa8c3517ef95f6b2188238b0f8c7da14e273896319dcf1f0d9fd46dc811550595a305551b90f817730b2ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624038387, "uuid": "c925016b-6179-40a7-be5e-2b96db1e0a6a", "value": "F305F1567214EF01E57D0533C8DF422293FCADC3A772E6193A95366E9881372AD086FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624038387, "uuid": "8c164bc7-d2f5-4148-a123-c4c58b9aa7b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624038387, "uuid": "863a1f29-60fc-46b3-b58a-c1624c03849d", "value": "12288:RadhVtHMpbZkd5rYADx5Cx47hOmhzbgnNQPC3gjKaqu6Ydb0FwBSA3GvYH:ce9kdWcCxoh1UNQ43aXNR0kDr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624038387, "uuid": "89ba0329-4992-4a8f-b02e-859b995fb381", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624038387, "uuid": "3185f603-4c64-4574-a238-c6504edf016c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624038387, "uuid": "52379acf-4b3c-4f77-bb43-1ec96d30322d", "value": "51dea981aef9cb380dcd902d82ad27c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4bb13d-d001-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623998929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998929, "uuid": "3a74c872-e0a7-45de-8410-9dd7346fd332", "comment": "Malware payload (Formbook)", "value": "a5be3df3a3d7f287984669c13b3aa8e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998929, "uuid": "0bf0565a-4f3b-4c68-a1b3-0bc604a6353d", "comment": "Malware payload (Formbook)", "value": "c308169a026be95a659f89ea08e71093a5376b00b2e9a444d0659b1c4a2c2432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998929, "uuid": "dca4c432-0126-4600-80c2-bdbffb4695de", "comment": "Malware payload (Formbook)", "value": "882b4df4609598d8442359d45ce2900c0acaac81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998929, "uuid": "397a4ba8-8aa3-4609-9106-9b64c7223a6a", "comment": "Malware payload (Formbook)", "value": "6364df338210738ba65904ec86c9b2e12b54e203e449985821ad542ffd465b111c87478b4037951f20222d4f90d703d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998929, "uuid": "b4acb95d-3e85-4043-8387-7819ae52284a", "value": "E93412E976C450FBE9B61B3001B7323CEB7763011A150AFF6B92CF05293964369E71A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998929, "uuid": "3486c4b2-cb24-46d3-9f7e-4d4475f7e65f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998929, "uuid": "7092a003-7be1-48c8-abe2-0dff1dd6582f", "value": "3072:cLk395hYXJcMn4dBRr/ATNNamd6mf74L+FEO1PMrD4J7xIUFurjyupyikqGgh44K:cQqLyr/EHD4LKvFesA/rjJy6haZdSUjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998929, "uuid": "b5a4d949-eed0-4815-9350-2546905b6b9d", "value": 239619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998929, "uuid": "ac928671-ad50-477e-910c-14a31efda806", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998929, "uuid": "28662257-7859-4784-9a20-634506ccde16", "value": "a5be3df3a3d7f287984669c13b3aa8e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18c4816-d01d-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011259, "uuid": "b55885b8-c5d1-475c-acaa-e4e6398982ff", "comment": "Malware payload (Mirai)", "value": "0f41cc0c470dd395d3a251d6e6ab969d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011259, "uuid": "035640b0-650a-4493-ae25-7657f3dec53e", "comment": "Malware payload (Mirai)", "value": "c388b465ab8633223dc634f90ea52c042efec072d29123f02852e591ac43ef05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011259, "uuid": "f4b3fe4e-e7e9-466e-a339-79be6ee75c45", "comment": "Malware payload (Mirai)", "value": "a2f186962f726a07e263f111630a646933044156", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011259, "uuid": "c14e36dc-486d-4d20-810c-dbf83305dfb5", "comment": "Malware payload (Mirai)", "value": "f2d10dec3e60a05838cd229a2e796f2786e87a541c1b2b374ff71544a817e805d60f98ff740806c0e63b338c92d71cfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011259, "uuid": "5de6ae01-c00c-481c-870c-56c1184c1a86", "value": "B34302C553706904CC5654BC8B90D7C361FFA578B53A25A2E370E5240ECE4815BFE2E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011259, "uuid": "2b339994-6787-4570-9e3a-ed434ec0fbf9", "value": "1536:qGpPbLHjAa6xPCVPyA/Sic+Ci7ay5WE/MLr0LhvwnXIXRS3:qGpT/T6xLAaF7jcMLgLhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011259, "uuid": "f90c93d7-411f-4159-aea0-6acbbf58ef39", "value": 55712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011259, "uuid": "1a9e750d-ac5c-4881-bfbb-e7424f10a255", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011259, "uuid": "e8a05573-d59b-4d38-a520-6adde67473a4", "value": "0f41cc0c470dd395d3a251d6e6ab969d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29d7d53-d002-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623999557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999557, "uuid": "178a3b65-7b49-42ca-ad5c-be02195bab0c", "comment": "Malware payload (AgentTesla)", "value": "5c6b740a2e30a101351cb84f75f9c6d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999557, "uuid": "27a2f446-cb5a-445a-9b20-b2ba81945f4d", "comment": "Malware payload (AgentTesla)", "value": "c4895ab5970a72feb57abe9377a9888d5ed3e680f6f168e3be2842ad4e1d5423", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999557, "uuid": "79a2c994-2ce9-4311-a803-c560e7f2954e", "comment": "Malware payload (AgentTesla)", "value": "fbf32c4bc1b58d7ad6408b5504131b8a421ca1cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999557, "uuid": "d9f0f959-29bf-4c9b-878e-45d2c2f674d9", "comment": "Malware payload (AgentTesla)", "value": "7601bd140ef9c98c21d177b2629bcfa52018d8316ccbb8ad96f29ef417b06e3708c3c5065def18fa59eab3ff5789e8fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999557, "uuid": "f9ea23d9-d747-4535-a898-a48805b452bc", "value": "7725AF221DCF422DF2764FB957B0BC8782B76EA63605E2153DC0329DCA33599C9DE522", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999557, "uuid": "073a63e0-c850-4407-ab3a-4bb2b990530d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999557, "uuid": "a20c305a-3018-448c-9105-313f489a1967", "value": "24576:qna9x0WIip6tkAPSGWMdJgqEF7ft0Ts6iyorG8ugC:qna94tXWMLgFbt0Ts6iyH8FC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623999557, "uuid": "47b2996a-7228-4b92-8cac-99f6a0b9d214", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623999557, "uuid": "e6a5cfd6-867c-4e0e-9b16-b4909d0a8f08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999557, "uuid": "2a9465a8-2e5b-4d63-8df0-a4dbd2eef49b", "value": "5c6b740a2e30a101351cb84f75f9c6d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01ca9a2-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623976870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976870, "uuid": "878320d5-4fe5-49dc-8de4-7d205f7019b9", "comment": "Malware payload (Loki)", "value": "a3ed01ecbae280c644d0cf6d684f5ce4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976870, "uuid": "39660ca5-f891-4f19-8953-39e00459374f", "comment": "Malware payload (Loki)", "value": "c5813383b5c2e76bc0ed53f80a440b3a612b5daa7f92a6f5748c841daa5aeee4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976870, "uuid": "179093ab-7020-4321-8734-80df2abd8b91", "comment": "Malware payload (Loki)", "value": "803dc65140fcff43c955a2b3effca9d9ef86848b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976870, "uuid": "669292ae-ada9-4c17-b2dc-57cc29dd0da3", "comment": "Malware payload (Loki)", "value": "03a505108005caa56e8d2d792f5b6690e9b8d06f4833aac78b1ca1589e21ddcfc399d1dd9bded875d179b67ba06ef9af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976870, "uuid": "dca73686-db78-479f-993a-5066df832beb", "value": "E3D4BF243AEAA129F177FF755AE475C6DAAEF7233707D40D2890038B0A13A41DDD163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976870, "uuid": "94b11162-9508-4163-9a9c-32d1a67cc57c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976870, "uuid": "4e4600d5-a336-4491-867c-651ac850a420", "value": "12288:U5nhlm4S4F3M9yQm2iNSc6SkPvaQnBc1SsXCE2E3qcPuvCZZc1:U7W01IfOKId2EFWv0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976870, "uuid": "24cc0ff3-fe6b-406a-bb82-8fd90d9f5af5", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976870, "uuid": "20517e3f-ebf3-4e75-9707-c223b39e46ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976870, "uuid": "7bf86787-8496-45b7-8591-60afc6e2927c", "value": "New order 201534 Ex-price USD11,730.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d4f910-d035-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624021245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021245, "uuid": "f8061a28-b95b-4b00-b937-7e2dfd55d923", "comment": "Malware payload (AsyncRAT)", "value": "65d745ba4bf9159d7f5e8e577b051abd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021245, "uuid": "80468239-0029-4b1d-979a-427d3d444de7", "comment": "Malware payload (AsyncRAT)", "value": "c5c25bc6655e1b18f0cd09f0fcb2ba2c16b071484839ecbbbaf27b1d76d5440c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021245, "uuid": "1aace9b4-2fbb-4c26-91b9-394e13afaa17", "comment": "Malware payload (AsyncRAT)", "value": "cb8f59e04f93cc010a2528fc78a29c8c2e43109d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624021245, "uuid": "ac422a13-4821-4c0f-8e19-59532acd06cc", "comment": "Malware payload (AsyncRAT)", "value": "604ff0aa79e375dc9aa50b6cd6a81ec6081aefd02cccc54e4b9bd0bac201de80f2deeb52c25ba8d46a8f38937ed70b0a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021245, "uuid": "cf0b1434-4b5f-4f73-9ace-862f8bce2e06", "value": "56A48D5072F61B69E5BDC7F5076462444BFA322E683EE5098CC370CF29B2F419952E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021245, "uuid": "6080e632-aef1-47c5-b06c-a6aa2afeda80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021245, "uuid": "5163120a-a315-49e5-a4e5-d43f65d277ac", "value": "6144:fixBsmqY7Q/5aup7sXV5OF4zkILW5B7H7Jq5oH9lS7axPEpsJhN7NUL5:fLLV7sXV5TMz7JbHrUaxPtzN7NI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624021245, "uuid": "40e12ddd-6f51-4b4f-8143-eb242fbd21a0", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624021245, "uuid": "8cf6b8b9-81b8-4506-bb2d-5fcc1741045a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624021245, "uuid": "0373575b-fcb6-4299-acb7-0d8634a8699c", "value": "DHLShipmentReceipt06182021pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d133e19-d006-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1624001212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001212, "uuid": "e55e5fa9-be6e-43a5-ae29-45e28ba1b06c", "comment": "Malware payload (Glupteba)", "value": "14471a353788bb6cdb6071d0e0a83004", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "Klingon RAT", "colour": "#B848F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001212, "uuid": "283d05f4-fdb2-4342-b791-6f14ef5325d6", "comment": "Malware payload (Glupteba)", "value": "c66544e5f49feda32c75e9f796681499bda314866e6ae1e11398be9b4bc89349", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "Klingon RAT", "colour": "#B848F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001212, "uuid": "e61108ab-46fc-42a0-9e0f-748d73df96f1", "comment": "Malware payload (Glupteba)", "value": "c90b5c534ce0d622547bc5b96075eb3d4212d660", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "Klingon RAT", "colour": "#B848F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001212, "uuid": "318c7c93-cd4c-4a5a-9efb-d67f9a06e641", "comment": "Malware payload (Glupteba)", "value": "25d3cadf26f4201f2d5b03d61dcd2a35f2f6ebd41970e5c5eed33c7971019c3e18125d514839217cf4cef012235f6e3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "Klingon RAT", "colour": "#B848F8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001212, "uuid": "f241730a-ded4-4623-a34d-f38b68cde4f5", "value": "E1E53388F1AF1A33F9C7BC7943991259B043A70DAD9E27AD19004E638DF54E194D0A7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001212, "uuid": "c7efe167-5202-4f63-a20b-773d660f36cf", "value": "57fb2a4e2420c685d93e6bb64037a5fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001212, "uuid": "bbf165ac-da4d-425c-bc07-d00bb8b42dc0", "value": "98304:epcZFzEA4DTxGkYU0rYx15LZTL1sDfmt:LZFAPhYIVTL1sT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624001212, "uuid": "e5d9467b-3858-424e-b51d-0887c2d6ec73", "value": 3299328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624001212, "uuid": "882eac0a-6c84-450b-bc0f-b6d07e6fb014", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001212, "uuid": "761f8a59-ba2a-4d17-b8db-83b1f947644a", "value": "c66544e5f49feda32c75e9f796681499bda314866e6ae1e11398be9b4bc89349", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a018da-cffd-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623997516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997516, "uuid": "ef964d01-9206-45de-81f7-ed93c851eece", "comment": "Malware payload (RemcosRAT)", "value": "fb0d2c73bfacda5ae909a6f1be81f52a", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997516, "uuid": "add4b8ca-74a8-40f4-89e0-7a50be51ab55", "comment": "Malware payload (RemcosRAT)", "value": "c820b91a97b6bd079f1c21e996d77461d7fb10789129fc03a8131d8a5c4bd505", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997516, "uuid": "d18d502f-c22d-483b-b4fd-841a782f48bd", "comment": "Malware payload (RemcosRAT)", "value": "ac38b98006efd1800687baf5f49ea9b074f690fd", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997516, "uuid": "9d521c33-22c0-4ee4-ae18-91ce90367250", "comment": "Malware payload (RemcosRAT)", "value": "7b418f15774962be42ae588dd85bd7679cf8047cacbcc56cbbc71326a1bd9777889b8e57997f2f1ba7b82c9d35a61b84", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997516, "uuid": "7b80c220-685a-47da-b443-c7d6314896d4", "value": "D57523087EC24BA7FCECA23823544D397597DD01B3BA951B662B37AD643062563FE60C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997516, "uuid": "5daa9ed5-3a6c-41f2-9726-b8fdfd89da21", "value": "24576:XiPeyFi6chm+jy+cHJDOHKq3pYupUmZ41J1cjC6JvJL+8VIJgmvTbg6xDnLGYffv:kFi9hm/p9OHV3pYsf49xMz8DiqgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997516, "uuid": "d8731ddb-89c5-4c15-bf89-3f3b1a724142", "value": 1577984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997516, "uuid": "ad3e3276-642e-47e3-9a6f-e324edf78e61", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997516, "uuid": "974743a3-0ca6-47c7-a3e7-58382f59f189", "value": "JPM Chase Remittance Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb41173b-cff7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623994847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994847, "uuid": "fe057b59-cb14-4456-bfd3-6c19d878c4f3", "comment": "Malware payload (AgentTesla)", "value": "1bf862edc68c6e664d41aa8b7cbb434d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994847, "uuid": "2a1532bc-3947-4030-a1e8-62d2caad6fbe", "comment": "Malware payload (AgentTesla)", "value": "c831c5bd72fe678827448b378fb51fe9a9445642579a39bbe8f36ed55b1441f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994847, "uuid": "e010f107-6a20-40ff-a316-f54c4a311c48", "comment": "Malware payload (AgentTesla)", "value": "2f33482678ece6e453ab47eee0769a56509fd7f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623994847, "uuid": "a60e4418-ca0e-44f2-9059-93beedd74496", "comment": "Malware payload (AgentTesla)", "value": "c09d60baf0f87f6b03d705048f19e66799671029c0db505a552a775e1d9cd365a6c6b6422b7a507f4334015ec749f742", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994847, "uuid": "677269d3-6dab-4321-8fe8-c5514d7d0c9d", "value": "E535AF221ECF422EE1768FB557B0BC8782B76E663605E2153DC0329DCA33599CDDE522", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994847, "uuid": "084e023e-2688-44b6-a3b0-6cb0ddabbe5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994847, "uuid": "deef0a86-4c0a-48f7-9dae-b7f5615cbe6a", "value": "12288:6Ehlm4S4F3M9yESMPQipP599kew2GLBurKIDJNwGevMm84zZEVhHQcSLQqf:xWkip6jRLBW38GevwSEXHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623994847, "uuid": "c5f7a803-e33d-4920-af51-8d3295bd70b7", "value": 1058304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623994847, "uuid": "f8088427-bdec-4797-94cf-465bc389918b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623994847, "uuid": "e4645654-86cb-4976-96e6-9ea37b8fc9e2", "value": "Price.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322dfc40-d05a-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1624037137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037137, "uuid": "fdc76d83-53ee-4584-9433-ba723db2d1e6", "comment": "Malware payload (TeamBot)", "value": "a5305f3f7edcf54c6cf16018534d729c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037137, "uuid": "b9dfca70-8e7d-4809-beba-3f86cdcfa508", "comment": "Malware payload (TeamBot)", "value": "c88a0ac92392894731bda7f7f4c00a5cac9f79ceafe465497124273fba1909e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037137, "uuid": "2af073ad-9b49-432e-8470-190648fcb7c2", "comment": "Malware payload (TeamBot)", "value": "96b6638ab2d18f56694c3859e01b81afad241d98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624037137, "uuid": "262a466e-5a48-44de-bf01-db666bbd4176", "comment": "Malware payload (TeamBot)", "value": "3b44339478786ee15f46e5996bb3c0292f91a131de87f0da4702857fd91e72943a523a392620c5d3fe568b9fb11433ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037137, "uuid": "95847a10-834e-48fd-a2c7-1df9f8ee815b", "value": "6C050200BA90C035F1B752FC597A936DA82D3AB26B6491CF53D61AFA5634AF0EC31707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037137, "uuid": "e610170f-b837-42ad-af86-6374390f0510", "value": "705a372c868b933d973ca642948b7012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037137, "uuid": "6dd74f4c-9ce5-42a8-ad36-3b40a5cfc58c", "value": "24576:13qLy3w8qRLbiufcijDms6HPkfbVFSaN:E8qRfffciDEvkzVFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624037137, "uuid": "f54c5132-ccc9-4b76-9060-43dbe975ad0c", "value": 849920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624037137, "uuid": "9a8269b4-a504-49cf-bcd3-de79e6d70664", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624037137, "uuid": "2e902955-a058-475e-8de9-370532de3566", "value": "a5305f3f7edcf54c6cf16018534d729c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84764fe3-d000-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623998620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998620, "uuid": "960aca4c-8dd4-442a-906e-1ee4fccd359a", "comment": "Malware payload (AgentTesla)", "value": "943d9d2c316f57f1bf818850e1f984d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998620, "uuid": "c0bbceec-0a4f-4573-aa4f-cbb23aef088c", "comment": "Malware payload (AgentTesla)", "value": "c8e239d667073d5f1c575a8b1bf2e580435a492deb302a6cd81489caddb337da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998620, "uuid": "8820a9b5-9cb9-4f1c-bbc2-06b886b24355", "comment": "Malware payload (AgentTesla)", "value": "bb31ad1c5876529a5e9824876606f331ae243294", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998620, "uuid": "0dee9e81-921d-40eb-a5da-398e0c808d7e", "comment": "Malware payload (AgentTesla)", "value": "be0bfa2f7116a9eacbc3b72882459e2d8630a3dd2d49f025c929bf7063083dd5f8380493b5fa3e8fec3d7fe4b8b81779", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998620, "uuid": "6820474e-e1a1-48f5-b0ba-394e2929e167", "value": "FB05C0212EEE5119F177EF785ED479958BAEFF237602E44E2891334B0633981CD9063A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998620, "uuid": "bddeda75-4983-405b-85bb-aee84d35889e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998620, "uuid": "329174a0-8b24-4957-9d91-77600f70c912", "value": "12288:liQJl+hlm4S4F3M9yVa/vmhLsGbLfZskjk0vfXyRjpmJeOIyVd0S1oVn9frjdio0:l/J4WSEvc/LfaGf8ghIGhWAo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998620, "uuid": "502ccc40-7dc9-4676-9445-ba7345272013", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998620, "uuid": "7cd5f68f-d9af-42f3-8c6e-1f34eda608be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998620, "uuid": "f0a76d15-930f-4e81-9066-9f807ca1e13f", "value": "943d9d2c316f57f1bf818850e1f984d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a85d5bb-d006-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1624001207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001207, "uuid": "0c69ea8b-db2b-4a7e-8b49-a43ca83c2fb3", "comment": "Malware payload (Glupteba)", "value": "327090cbddf94fc901662f0e863ba0cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "Klingon RAT", "colour": "#B848F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001207, "uuid": "f2c00d7d-9823-4890-96d5-e0330b9e5cb5", "comment": "Malware payload (Glupteba)", "value": "c9a2a966086a37276cc200c0f22f735d49df4e87f591fe806ca8d8597b9f60b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "Klingon RAT", "colour": "#B848F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001207, "uuid": "2c5e3c73-e645-4df5-9359-f4ab40e303a7", "comment": "Malware payload (Glupteba)", "value": "fd357aad2d5529127d90757987a2c5ce88ea2a76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "Klingon RAT", "colour": "#B848F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001207, "uuid": "e6c9e3c3-fbc5-4171-8e81-b80e418c8f5e", "comment": "Malware payload (Glupteba)", "value": "6ca1e0536641101bdc139591b50f7796a49c918b41d0fd7be023746d67aadb1c78cc870ec2d3387fdf29589a04e4472d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "Klingon RAT", "colour": "#B848F8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001207, "uuid": "a00a21fb-981b-4b0a-b7c4-7ff1291b47ee", "value": "48E533A0954F2E57F26B35B99E740DA3B0A1436BADCD95CC9141D0C70EBF722762B80E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001207, "uuid": "b0c4ac9f-4f9e-43d9-a797-217d062872d0", "value": "e9544cc459a9c925a509f5e1ad96d26b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001207, "uuid": "83ab2fc8-5a56-49a4-8945-1f658cceabed", "value": "98304:8AR8KVqs9CO8fNoQTv+3cjxSI3huEPuYvR9:8k8S9r8VoQb+ZIxuEWYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624001207, "uuid": "5f496917-9103-4554-ae94-87e8900e03c2", "value": 3232768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624001207, "uuid": "a1d2dbe1-4641-4ce8-9d54-b6d253553cd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001207, "uuid": "427c94b5-77fc-443b-8e2a-b78e5e79b90e", "value": "c9a2a966086a37276cc200c0f22f735d49df4e87f591fe806ca8d8597b9f60b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a1298d-d01d-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011270, "uuid": "ca1b5840-2d4f-448b-9e66-0f3a7df6e18a", "comment": "Malware payload (Mirai)", "value": "17fa0d42d6fe3fea47c6ec33afc50032", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011270, "uuid": "dbf9685f-9ee0-46de-8e13-49e5403b221f", "comment": "Malware payload (Mirai)", "value": "c9b782f919bc58db9fda8863bc519306c26ba1b10ec873244b72153323ea68e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011270, "uuid": "5173047b-5b0a-484a-a5f5-f54868ad21e6", "comment": "Malware payload (Mirai)", "value": "22c910e22f671f741ca352b9bde6e6277c99a86f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011270, "uuid": "89de568e-d13c-4ee6-bd34-45f0cf545622", "comment": "Malware payload (Mirai)", "value": "f827d1793f655ede14f02a4fc710aa05d019271bb9b67cb8b7b3ac3d2803df7870aef583ad81c51631ae76fc643599b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011270, "uuid": "681c6b80-1600-45d9-bb4a-b98fcec90b4a", "value": "93D2E1681A42145AEE7959F92FB04FC12E790A9B4711DC2E64DDF36336870F83862D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011270, "uuid": "2037a6fd-39be-4042-9cec-27abc8b44106", "value": "768:qexBaZqScHAjNKXdOY1fjIMiMvSvntvLgJgGlzDpbuR1JfK:1xQI8jNWbMxVDgVJutK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011270, "uuid": "fba4a656-f297-4307-88ac-0dbc2f73d444", "value": 29756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011270, "uuid": "f3275958-e407-4b79-ae6b-d400d02c8efc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011270, "uuid": "974d4408-ba30-4ba4-96d1-5ce2814d96a2", "value": "17fa0d42d6fe3fea47c6ec33afc50032", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a9a9ba-d077-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624049548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049548, "uuid": "81856a95-1123-4d87-8d04-6efa0fbb4140", "comment": "Malware payload (Formbook)", "value": "2460400bcab21bd98de65ab17d7aff4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049548, "uuid": "d924caf3-dab7-4c71-aeca-20999b58454d", "comment": "Malware payload (Formbook)", "value": "ca7655af1ba5f1a9a8886bb63aa6c2860e433f099aebb9b61ec04717711144f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049548, "uuid": "7d131df2-b494-4099-99de-542fa2506d88", "comment": "Malware payload (Formbook)", "value": "0acd3ea0bd3c4736f1d3ebe20427c393d4dc9660", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624049548, "uuid": "0f632802-b95b-4dc7-87cb-150c324285e6", "comment": "Malware payload (Formbook)", "value": "3e5cff73c4418d8479e5bcb297ea538be96d9ba94361bbb8dd91be3e1e47ea2c6bb9c17c6b0e447bf5b914ee3d139cd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049548, "uuid": "5da12102-5e3e-41fc-8343-b5aed330cf54", "value": "3BE4CF2439FA6519F177AF7A5AE474C6DAEEFA633703D41928A0038B0723F41CD9153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049548, "uuid": "ae6a0a59-6f9c-4df5-9bde-ad3cbd97e20a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049548, "uuid": "df5c5efe-4418-4ec4-a6df-e6d22be4d673", "value": "12288:HXrHI2iNuFBkGmm6HUwu3OAzteob9qGqs4hxgyKg5Jmldx+YhnR1C6c1pv4ONL4B:jI1IFiGmm6HhoZqGqth1d5ox+YhTcT09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624049548, "uuid": "5a7e0785-fd42-476c-a3bb-ad87181fe8da", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624049548, "uuid": "367c6f20-5a2b-4b40-ac52-e20ec59259f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624049548, "uuid": "2f4af2ad-0898-4ac2-a77d-0fb6e35a3cf6", "value": "57Hug3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37edcfe-d07a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624051205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051205, "uuid": "dacdb6da-4ba4-45ad-bdd9-d162230665ca", "comment": "Malware payload", "value": "400c1c6312f99e4640077994bbfaedde", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051205, "uuid": "924c7466-986e-4f3c-b9e8-cd772e6ceb73", "comment": "Malware payload", "value": "cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051205, "uuid": "de870c8d-3b94-4fba-8b37-544fec965b9d", "comment": "Malware payload", "value": "657a875554b075eb7f2d314bbbe967c789624b30", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051205, "uuid": "cb39af22-cfc2-4a5f-9311-6de6046d5d92", "comment": "Malware payload", "value": "e4e23b73199ff7b8d6f5350c00fb6b7082cf9ad7f3106e90f8e2fafd4f4dfc3b6eedc9c552dcb78b0a86c49342211455", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051205, "uuid": "04141139-803e-4f10-80ae-2a4b8f905146", "value": "3CB37C01B5C0C472E976293659B4DA714E3DF9300F50EEEB7388567A4F302C2DA29E7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051205, "uuid": "e735922e-a9e8-484c-936c-bae60889e192", "value": "abf3c9fa5452a2214a167cac8c6a73de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051205, "uuid": "57dc3b76-3c6b-4cb9-b59f-9b1c0b56c98b", "value": "3072:Y3Jlggn749TgxSGZxu7yb6BGCKKMA/2puQYdyf5z6QmtJVt7:Uys49kHIyb4KKMfpuQYGAnt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624051205, "uuid": "cf5797e1-1293-484d-90d9-c2d0d0d8051d", "value": 117168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624051205, "uuid": "e2fd0d2b-36d2-44ac-806c-7d8ba282e1ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051205, "uuid": "c6ae1186-2a47-402e-92f2-50c94611671c", "value": "cb8e536680732b474a5c26970ace2087667622caa3dd82c1c56731a7c5a1c8ce.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf02a81-d008-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1624001961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001961, "uuid": "254a5a56-b668-40ae-aaae-819c12a196e5", "comment": "Malware payload (RemcosRAT)", "value": "4ccbe3a8fa850367d5efde685a350d80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001961, "uuid": "5346ed0e-d787-4443-9100-7610d3edaa98", "comment": "Malware payload (RemcosRAT)", "value": "cd35cae0b96e7e0e19d837c418128aa3336fb5e714bc04fb2c1d90c46a7a2124", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001961, "uuid": "3e2ab8b5-48b2-4d0a-aa51-d0e5835448a0", "comment": "Malware payload (RemcosRAT)", "value": "b8adf28da2c33f19b09ca03463d9707aff15e362", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001961, "uuid": "ac847fd4-83f3-4670-b25e-a6b8f2f68efe", "comment": "Malware payload (RemcosRAT)", "value": "2296730f59790d3eb61f33af99a73987a17424726cfacb9ebe68e49b35b307ea952d427674564caa94c372d5d8af7ce3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001961, "uuid": "b2db9328-e885-4cca-8d4f-378c3ace6b38", "value": "8C357C2DB28154B3C93316BD6D0AB39865BE3E51769C9C8A37B439057F783843D390AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001961, "uuid": "258da993-9ae1-4add-9fdf-52bbae9ee594", "value": "44ae77ffd352712ced0978b5ee3ef88c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001961, "uuid": "14f9b978-e908-407b-b0b0-c35a73889c8a", "value": "24576:mt+Le+UAcIAJScTn9t884Wz7vxLdkHq/XQBy:mt+rOTn7R6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624001961, "uuid": "7c9a705f-f216-4432-aebc-8fd758e41763", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624001961, "uuid": "e56f8266-0f58-455e-8ae3-6cc0d66e049d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001961, "uuid": "b66de404-70dc-4495-91d5-1d61d71e57e6", "value": "4ccbe3a8fa850367d5efde685a350d80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227742ba-d041-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624026373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624026373, "uuid": "8b6ff031-65bf-485c-b5c0-f419ac3df037", "comment": "Malware payload (RedLineStealer)", "value": "297cab20923b44389eebccf8db0e953a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624026373, "uuid": "b4e538d5-374e-466c-a1a4-28691a9bbd51", "comment": "Malware payload (RedLineStealer)", "value": "ce9b2b4e076332f475d01260b8156ac784342eda701529578823f3e410577485", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624026373, "uuid": "97f5c0b0-311d-49cb-aa24-9e28bef0a664", "comment": "Malware payload (RedLineStealer)", "value": "619ed410b9250655bf1bc806da0a34af5bf7be61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624026373, "uuid": "6462c834-6995-4b96-9b17-1c636cc07878", "comment": "Malware payload (RedLineStealer)", "value": "6320f48198f8e39d42efbee0209d4f63f8e65f7b6394c6f4125885c18155917f95dee6273d6edaac1270a2b954cf5815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624026373, "uuid": "5f8ed71a-c102-4b49-9e78-ea0bcd24e6e4", "value": "1984BE10FF90C035F5F612F85AB693B8A92D7AB1572490CF62E51AEE56346E0EC32707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624026373, "uuid": "5ca7f0a9-8b67-406f-8c99-0906e9f08294", "value": "41601b6802e3e38dfaeac494532218f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624026373, "uuid": "3723db88-e4bc-4d37-966d-5a9239a7f46a", "value": "6144:121C2nrs4vZ2bMCVbH2aHzDW5+uupFyU/VGKJV8eqF3m4myhvbMBYvemPWo9Mv:cC2rs4R2bMKbZG+uupFD/YKJV8eqF2Lj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624026373, "uuid": "7fa29387-59c1-44f5-88fa-91ff78bbe405", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624026373, "uuid": "866d789c-5b2a-4a09-9240-773075c06d75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624026373, "uuid": "eef5b2dd-8183-45e8-b502-1248fc0f8920", "value": "297cab20923b44389eebccf8db0e953a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c886d2c8-d04a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624030517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624030517, "uuid": "e80269ed-9ee4-4d28-b04f-6c781353e42b", "comment": "Malware payload (Loki)", "value": "71445f051b3b8ef7757a4b5d5310e39f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624030517, "uuid": "1ca2b5aa-4be3-412a-a3c8-fe1afaa4b9c8", "comment": "Malware payload (Loki)", "value": "ced5590738ce4d32f26c917992c21656c60a5ed3a2fffb02beb5b09b1d5d626f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624030517, "uuid": "95373902-186f-4987-92e0-716cd1ca55ca", "comment": "Malware payload (Loki)", "value": "2080aeb7ff19b502ce32881857af425ae75ab7a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624030517, "uuid": "1b2bdc41-2c53-488f-8754-6ae905e6aceb", "comment": "Malware payload (Loki)", "value": "e1bf5be75022a0d6a2bac66a5b47bc9470d1f0bfe9866ff6ef19d72c420ffa7c583016f318072161b5b0d855a7d7c69a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624030517, "uuid": "51bb1cf5-b999-4b9e-836e-166269719c38", "value": "E584E00172EC0AE2D4BD83F95C6171402B72B83A5126EF1E2E8571D99E26B524B33F5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624030517, "uuid": "5cf432eb-d7c2-4c5f-9fdb-439969c6b842", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624030517, "uuid": "3eb4d6fa-97ce-43e0-8010-cb60d1413bb0", "value": "12288:LhcWUDZzAePzSd5BhSNjZh70CFUjhyS4Pb:LhcWUDZzAozSdMth70CFUlyS4Pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624030517, "uuid": "5ac524a5-c044-49b7-9c7f-7f75d66ece5d", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624030517, "uuid": "0afc6752-b3ed-4988-b09a-94f71abfbb84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624030517, "uuid": "ceeaebd9-7b4b-4553-8487-1b1be37f022e", "value": "TNT Receipt_AWB#879937664778.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05d40bb-d069-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1624043791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624043791, "uuid": "998f07b0-3f12-4bbb-93bc-9be9d361589e", "comment": "Malware payload (QuasarRAT)", "value": "5e8124a56573716b68d01d7829222099", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624043791, "uuid": "8f240949-d7a1-4ec8-88eb-c667a6224bf6", "comment": "Malware payload (QuasarRAT)", "value": "cf6b35a3db282f36cb1f6a32c4c4d15185c21960ec672e0716de24b40df8f48b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624043791, "uuid": "bd016389-f8a9-4637-be67-25adf9ad23ab", "comment": "Malware payload (QuasarRAT)", "value": "af0c2516dcd4c6d353969cf715f3769a364b6be5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624043791, "uuid": "85353826-79e4-4ea8-8d97-19b64f21b6a3", "comment": "Malware payload (QuasarRAT)", "value": "bf131e175d1da98ab01202da9b145344dfad5a47c64bc9f0810b060abf442aa5319f429207694af284ef562c6b7efbf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624043791, "uuid": "ac3b23b4-a351-4759-97ae-6c71bebf54de", "value": "4D35234536D0D0D1D222B5B992CA3E7324B8AD7413E146FB2B69AC9F5B39AD3857C303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624043791, "uuid": "2e16539a-2d60-41c7-ba9e-fe8f340f3a8a", "value": "b960c15baaf7aed95c4a7eb08f9ac0f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624043791, "uuid": "97ed4030-7a04-4023-886b-dd44e36b4d96", "value": "24576:i12HT37zMv9FEmcCiCHZdHJSLCaJTQSBYk6B9/KKQGG5D2uAG3Zv8p3r0pQ5sHjB:oAH8c7CH7HJSLCaJMSv6y9GKDs6Zv65C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624043791, "uuid": "92997535-75a8-4073-94b3-e03de9bfeca3", "value": 1140256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624043791, "uuid": "4b1085f9-e346-4f3e-9d99-b499a04260e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624043791, "uuid": "062973d5-37b7-4534-aafd-607402142c84", "value": "5E8124A56573716B68D01D7829222099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b32ba21-d030-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624019140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019140, "uuid": "43c00bb9-0ddd-480d-bfc2-40b3b5d35552", "comment": "Malware payload (AsyncRAT)", "value": "f3d028632a3d4f0956d4f7f62d0d11b2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019140, "uuid": "2e58026e-da1b-45e0-8f35-99e13166a0ac", "comment": "Malware payload (AsyncRAT)", "value": "d041638b087658b3c2265efd8cca328abd7764d2bab1fba4f4e0300b5ae61c51", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019140, "uuid": "137f82a4-25e0-4c2f-953b-b1841975ff1f", "comment": "Malware payload (AsyncRAT)", "value": "0c7f127770d78f6c0c2ab9b62643762e5a470205", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019140, "uuid": "6514e150-75fb-422d-8324-671ed3361c45", "comment": "Malware payload (AsyncRAT)", "value": "5f2373487cd5ba469ec26296251b2692dd9b0aec41cba6214cb0744365bea49d91c31bbc09f4f4811ee789e6f428c6fe", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019140, "uuid": "706a9517-18bd-4277-aa71-ebcae6870cdd", "value": "EAD022ACBA9CC90541072ABAC43B84AA8BC3097C23780211B10CCE7264380A60E269C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019140, "uuid": "6b9f2b0f-8c00-4c21-81da-ae9b4fe3e67c", "value": "6:LQcD8V4h87XaHnovf/lWuRIPyik9Me0Bo:LQxVGmaSVfaPNkGe0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624019140, "uuid": "57534209-5158-418c-9c31-aa05b5ab5654", "value": 210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624019140, "uuid": "563b95d0-933d-49af-972f-95234eaef19c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019140, "uuid": "97d5bc85-b76c-4339-aca8-e4502a112969", "value": "eBill-ID118109751400440.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73663730-d023-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1624013624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624013624, "uuid": "3c1ed2fe-2c72-4f4a-bb83-dffeb209b2d0", "comment": "Malware payload (GuLoader)", "value": "4e67d4dbdbc15578c1c7bf4decbd16b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624013624, "uuid": "cb383d62-c307-44de-b9ea-9d264b8db0f9", "comment": "Malware payload (GuLoader)", "value": "d09ca26d68b2115f99ce78bd689b58ad07b2f909c65344af5618ba6eb869392f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624013624, "uuid": "95c27975-8710-4d4b-ac2c-ea313d2ff493", "comment": "Malware payload (GuLoader)", "value": "2482c1abb35dac9415f4c89c45c978414cf6b43c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624013624, "uuid": "68c888fc-b304-4242-a1ef-23545f88d76b", "comment": "Malware payload (GuLoader)", "value": "1452a6a510a27c70532c0a2ed36e617909e069cad95db91f143c56c569e8044fca61f22bb211d7f893b2a0bef76f03c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624013624, "uuid": "5878bd31-c628-4851-995e-b431ec86ff7a", "value": "4AF3C921FD40F62BD4759CB12E1CC52E64613DF315769A22F741BA3EB1343EBA5A8E02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624013624, "uuid": "2ba38c9b-19f5-482b-bbbf-7b2ebe78673f", "value": "443dd2104fb7a1608682e7e980227edb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624013624, "uuid": "28f31728-18ba-4121-b72b-862e4f717404", "value": "3072:tt3WaKotHBx0H1GevYhvCWHoL8qxl8nM5CS:t4ahuHZvIvH6DE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624013624, "uuid": "0f440552-e923-4580-8617-71eedf8e645b", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624013624, "uuid": "10ab1248-02e0-4044-aebe-034e2360556e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624013624, "uuid": "4606d1f5-7bd5-4e57-af05-794342118b53", "value": "SecuriteInfo.com.Variant.Razy.877818.14215.11972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fa4054-d07b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624051231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051231, "uuid": "626281ab-e437-46be-a99f-16c791fd007d", "comment": "Malware payload", "value": "da6b25206a29c8ac9a8cbb4be5d3875c", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051231, "uuid": "0316e706-f287-4eed-952f-f8904fd43886", "comment": "Malware payload", "value": "d0a03a8905c4f695843bc4e9f2dd062b8fd7b0b00103236b5187ff3730750540", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051231, "uuid": "833aeb66-5951-41d7-8a1f-3f57bb667d42", "comment": "Malware payload", "value": "0e23cd5f100a035bd5ad521a6ad40454fda084c7", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051231, "uuid": "fbbee623-050a-4ca1-a8dd-19a78b5b6f7a", "comment": "Malware payload", "value": "59800d3701e81711414f0b9605bfe3953ad7f4df4addefc01eed0c3f5aa50a580d94ded3eb5974e9bed017fbbf3f4cf7", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051231, "uuid": "070db25e-cf5d-40e4-a907-e8ab10bb6982", "value": "429291979A81C9CEDB3E187242A4C772793792B1175488559604ADBC6CF3FCBE73830A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051231, "uuid": "34e0cbac-681d-4192-88ee-237fa54102a2", "value": "7de9cfe0bdee43624ca3dd090f8a405c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051231, "uuid": "1776093d-8596-4a8d-9954-b35eee30c2c6", "value": "384:rxNt/Iu30i3X2GjTJmlglwP74b14gHRN7aW0R1lnNfq:rxLIu3GIglNP749Ilfq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624051231, "uuid": "64d67ab7-811f-40e6-8cf1-2c4781a7454d", "value": 20864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624051231, "uuid": "50fdd308-c4bf-44d7-b5dd-2fd0cb481af3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051231, "uuid": "415d618e-341a-488a-95d9-7e73f04e7ba2", "value": "d0a03a8905c4f695843bc4e9f2dd062b8fd7b0b00103236b5187ff3730750540.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c82747d-d007-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624001560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001560, "uuid": "3d35f0d2-95c9-4c85-b1ae-c15892cfa236", "comment": "Malware payload (CobaltStrike)", "value": "8039a1938f3c6218bd0dc687c16ab82e", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001560, "uuid": "65ee5d7d-2093-4d93-b100-2e3b0f0b1228", "comment": "Malware payload (CobaltStrike)", "value": "d253b346f4f185e04ca0f00ad0d35f1cf8aeed52907371fbc24ef5078dab0629", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001560, "uuid": "42ee330d-c04b-462c-a569-d8d30a009488", "comment": "Malware payload (CobaltStrike)", "value": "511c46dcde3367001d579e0d5a39709534d9a6a3", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001560, "uuid": "ab5a16cb-b33f-4456-b759-1ca6ba29f8da", "comment": "Malware payload (CobaltStrike)", "value": "c075d1e14da0ef6b2e1fec43dde5b4c74ffb4be23c694e5772e3974ba7700efd8bc0c7bb2daad72e22988a9faebe01fb", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001560, "uuid": "62bf7009-e0c4-4a19-8d63-b1583087d3f0", "value": "E144BFA16184D036D0570434624BC77E5EFDFDF416719587BF841AAAAE723A3EB2A303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001560, "uuid": "612b7e83-75d7-47e2-b671-4eedf0b6d546", "value": "f2e0b7b9a08bd8dcaf133d9278ecdb47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001560, "uuid": "c9200e47-d09b-43c0-ba0d-f4296e3e157b", "value": "3072:Pjh9N4a1j712h9Td2+1lxvTeZna8xUhUbT15adYGtCmJPJJfv4SbOBiC3y6RhmK:PjdFKdoSxvixTxUAHS/TbOBnyyhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624001560, "uuid": "9a61b4cd-068c-470b-905f-b1cfebde7811", "value": 274048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624001560, "uuid": "b3f2c335-4039-414e-9d28-0843106a605d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001560, "uuid": "3ed7795d-6aa8-416e-a1ba-53703657c6d6", "value": "e9e9caf4-d992-4a08-9ace-0da28a043cb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72fa5d0-cffe-11eb-875b-42010a9c0053", "comment": "Malware payload (STRRAT)", "timestamp": 1623997954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997954, "uuid": "f64b9f07-8d64-4bb9-8f3e-214ee90c6ad1", "comment": "Malware payload (STRRAT)", "value": "38ee4415d007e6de95f8ad7b6bfb8ccd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997954, "uuid": "f24fa049-f4c0-4d42-b36d-2a1d443af190", "comment": "Malware payload (STRRAT)", "value": "d278e7dfe9a7b88ecbb42e0e352fe8f3edb7be9866ea9fecaeee9aee0f592d90", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997954, "uuid": "9fda6788-f6a4-46ab-83d2-2b8ccf7fb7bc", "comment": "Malware payload (STRRAT)", "value": "8eefdc8c681f80a917c8599435f88699a0f915ac", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997954, "uuid": "c91bbfed-6738-4dc1-ab89-4eab56795174", "comment": "Malware payload (STRRAT)", "value": "928cdbbaa693d153b5d2e36c4da882a7696adef1878b1f5b9ca209e33aa5d658e37f2c0c8f726c8e20f8238afd304c6a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997954, "uuid": "4753a885-048d-4b27-a429-3396b8eb2b81", "value": "E5A3D05FF99B98E4D02754B703068732EA4CD29CE01AA12F1DFC451A1C70DBD6B1AA9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997954, "uuid": "d10248d0-7a33-4b9d-9762-056cc492def5", "value": "3072:yA5G+rWDBvLF6VTJnQAXACBWhHLLtjR8Ui/WtUXu4CClhFlmrxRrU15DzCA3gkmt:Rke1VFwPq4ZXJ+6lsyPPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997954, "uuid": "d7111d8c-d4e8-4598-8a43-6eb01912aeb4", "value": 101159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997954, "uuid": "c9caca85-693e-4282-8ce4-34503853c34e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997954, "uuid": "60f36983-b2f0-42ee-9df6-6b1578f45fe2", "value": "IMAGE17062021.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2da981-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623976890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976890, "uuid": "249cc7c4-29c7-47b3-9782-35631d91d0a2", "comment": "Malware payload (Loki)", "value": "e50669d67367951aeb58d3aaff69125c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976890, "uuid": "2bd21f3e-1e59-4aad-9193-55cddb672d0c", "comment": "Malware payload (Loki)", "value": "d324d33233edf16f00bb4c9a06a14eee0ef15f8d90a3b9f62213e0ea9054312d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976890, "uuid": "515f68ae-7e1f-4b2c-8a94-59618c0e4817", "comment": "Malware payload (Loki)", "value": "3d754fcb9b66143664df7a12fc709471a29e4c39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976890, "uuid": "1b0bac9f-eac6-4538-9f76-5a11860d65a2", "comment": "Malware payload (Loki)", "value": "d2e8cb1f8993076fca7af39cef3ff27c72c72fefe6392fb3cdf89bc4e8a2600fe5581585999a0a449f0d81c69b34249c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976890, "uuid": "33dc7f05-538b-4f9a-a318-847e04e9abd0", "value": "E6055CE2A39B1476D19312748FEF85B8DCB5FD032925944326F22D29DE393C2971A393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976890, "uuid": "9f2f47c8-97c3-4c17-b968-7c8cf0024187", "value": "b126334c43a3b8f2e951f0ec1caca9f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976890, "uuid": "31c1281a-94dd-4269-8201-069594f5ebb5", "value": "12288:iJhmptoDU+KeU5UQ9m5tCt1b+BQckAH2z5OtNArniZpcM:elvPXC1biDHTNArMmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976890, "uuid": "f3ba9b8d-af51-4dce-ae37-ec10834ebb0a", "value": 825347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976890, "uuid": "26377b2a-f1ef-467d-829a-2aca20e82ba6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976890, "uuid": "ef63b5d4-273d-4de9-82dd-50365eea93f9", "value": "D324D33233EDF16F00BB4C9A06A14EEE0EF15F8D90A3B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7fa321-d011-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1624006125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624006125, "uuid": "68a50d57-e17b-4838-b793-9faaac14cb27", "comment": "Malware payload (SnakeKeylogger)", "value": "63e701517f119a37e2bfb0326f2f7851", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624006125, "uuid": "c9be09e4-a565-41fe-bf55-4b3ac1419dd9", "comment": "Malware payload (SnakeKeylogger)", "value": "d373c0339517c98ee8668e152f5e0987acb36409fb33026d0bab053b84ac6d89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624006125, "uuid": "50988652-0f33-43e7-b432-bc6d8655f581", "comment": "Malware payload (SnakeKeylogger)", "value": "aeccae0b7c91487fa9a403abd4afdc37653d88a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624006125, "uuid": "9bc83f2b-deca-4865-9ad3-278cbe924f26", "comment": "Malware payload (SnakeKeylogger)", "value": "2634fd6bc4efacc8290af9404e8231861a7f781d8924098fc508e561cf4f5070f2597c5a63ae820adeaf97af710bfa6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624006125, "uuid": "0bdd3d4c-73a8-4cc8-b277-0d7af866fbb7", "value": "A1D48E61D7F8ACF7EA4621355C77783534A79F28D4AC081A18AD39713A7638220BED1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624006125, "uuid": "ce588c74-798d-4207-bdc7-73cf50f633da", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624006125, "uuid": "ae5ff3a9-24a8-44b0-8af8-00a5b1cc0526", "value": "12288:98dhhhWiynHRBt/LRKSrs8zqr8pQHP55Th9sMWP/CD8stP3KY+L:idhhhWiynHRBt/LRKHLUylh9dWP/etfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624006125, "uuid": "0f5c7bed-ec41-46dc-bd0e-3bdf98fb45e4", "value": 646142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624006125, "uuid": "0f0d6f7b-628d-4106-beb6-11120c0e20b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624006125, "uuid": "767aa634-5a9b-4dff-8359-65443f66d856", "value": "WQ090090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e956b942-d026-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624015110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015110, "uuid": "e514c52e-0436-4d8d-a949-b590acbadd64", "comment": "Malware payload (Mirai)", "value": "e132131d980a03711efa55cf283edf1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015110, "uuid": "42ba1288-7268-4560-ab06-4861461e9b49", "comment": "Malware payload (Mirai)", "value": "d42d88a7bf34b6ad6a20ab8e8b138cefa88843ee67e42d0be7b0b0ca72c64fcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015110, "uuid": "5a0ee187-9576-4fd4-a527-552f5f21aae0", "comment": "Malware payload (Mirai)", "value": "c9716bc462623b3db33b1370ef353a51aa4f7aa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624015110, "uuid": "7f8a35f0-7128-4a4f-9402-e49973430a05", "comment": "Malware payload (Mirai)", "value": "14d1e8e20c99582c87473d2ffe4024b2ffbbba7c76834ba10533de2395d42b36b97232de1c3e4dc07c97233615fb40df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015110, "uuid": "d5ec2276-3211-454e-a5b1-cec39010a8a3", "value": "AE435C21BA352E27C0D1A4BA21F78B24B5B517DA26E4C61A7D720F8DFF142102513FF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015110, "uuid": "c27e63c3-6d95-4945-823a-cecda6464022", "value": "768:6lvorOA3gTKrdj0oMjfQZH8SnUV8/q2Ow/vhLD2V4g5yAO+EZrDJh+lV0UOYb:IvtA3mKrdjGjfQZHBnpobTYfiV0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624015110, "uuid": "ae87bdc1-999b-46af-8769-7d1c1f93ed5e", "value": 60516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624015110, "uuid": "f9b49098-9c6d-4b4c-add0-ee58b2373051", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624015110, "uuid": "73b2b8c1-b6c2-427c-96fb-4d8a0072dd9c", "value": "e132131d980a03711efa55cf283edf1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8c7e37-d067-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624042873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624042873, "uuid": "ea7c9c65-7064-45ba-a438-bba41dba0bf6", "comment": "Malware payload (RedLineStealer)", "value": "2dbf583e20a1714ebb7aaf9b61cd4e11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624042873, "uuid": "4664d7a1-7462-4399-8445-60f9305ecb70", "comment": "Malware payload (RedLineStealer)", "value": "d4fb12766874defc4d6a9dda8cd8aa956fdac4352d874c04f9828743247510df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624042873, "uuid": "87aba2c6-f6cc-4ae0-b0bf-12b0df5be77f", "comment": "Malware payload (RedLineStealer)", "value": "bb38de8320bfe3aa7dabe6946b9c039184a05bb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624042873, "uuid": "4f6eee9e-09ec-47ab-bb1c-bdd5ae28b631", "comment": "Malware payload (RedLineStealer)", "value": "ae2ac1351f6a52e41571b086cb05e1ac55eab0364421c79331a49256f1d0a1267ad9bca49b22acdcba6c0dc62c95c4bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624042873, "uuid": "03892b68-0180-4c0a-b004-1e7a6add8e5f", "value": "B0163341B6C4C8B2C47229769AB9A721967DBC301F3CCF9B539444ACCA746C0D736AB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624042873, "uuid": "6a9c8a4f-8d56-45d8-999c-00c8f681051f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624042873, "uuid": "e6327f6d-f097-4e26-a2a6-4a7ce852001b", "value": "98304:UboDpoD2hPvo5q9Hc9aqheNRN7Y1tUQrEGskyZ9Q7Ld2R01gD1:U9DC9Hc9aTHN7zpjQts01gD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624042873, "uuid": "0e32e9a0-1c28-401e-a5ff-b8e7f033f8f4", "value": 4152882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624042873, "uuid": "985744c8-5b94-45fc-a2b3-5c353363b123", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624042873, "uuid": "5aebec1c-ad5a-4f4a-91cc-3bd0be972451", "value": "2DBF583E20A1714EBB7AAF9B61CD4E11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2941d83d-d070-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624046571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624046571, "uuid": "b54b2ce5-0ca9-490e-87c3-3a71099a713f", "comment": "Malware payload", "value": "1c3db7002523e1acd621c90701c694ae", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624046571, "uuid": "1aeeeb90-8e5b-4a34-afd3-c8e0e32cbaab", "comment": "Malware payload", "value": "d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624046571, "uuid": "c81ffb14-14df-4337-88ac-403b621f3842", "comment": "Malware payload", "value": "aee092fd31772d33932a7a02dd2d73ede67f7db0", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624046571, "uuid": "76d4128e-93c0-4641-afdc-eb8aa4fdc2d5", "comment": "Malware payload", "value": "5037ba9f2880b4854a53d6150c6faf6b78a57712d5aab733c97e38e9b35a49c1dae4639a48081c1b44ac57edb8333f0d", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624046571, "uuid": "aa4ba25d-8ffe-4d0f-9718-248bab0e270c", "value": "C8B39E52B99590E1C9B694B0C1A5A766FAB9B432132153CF43A0CDB10EB37D1FF3934A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624046571, "uuid": "4eef1100-4730-4877-a0f1-251d842f27bc", "value": "8dab5adbb7713839714005d50ba76bb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624046571, "uuid": "ff57b5ed-9782-4dac-ab18-fb74e61ebae9", "value": "1536:HL9RWXOQwi6wEBxmTSp3EpoNyq+4lRX6IHOSyOVi77:rLKOQwNOT+eFq+4lAvOi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624046571, "uuid": "f84f09a2-62b5-42b4-b8b5-d567a1871277", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624046571, "uuid": "138351c0-ba2a-4c9c-ac23-f3df3f396f82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624046571, "uuid": "2b4f0ca0-3dce-4340-9720-3a49872030f0", "value": "d64f906376f21677d0585e93dae8b36248f94be7091b01fd1d4381916a326afe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaba8b85-cfe7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623987947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623987947, "uuid": "748a3d5b-e4cf-4ec8-86c9-8446120626c2", "comment": "Malware payload", "value": "1a599ac75899c32c3c28da853df4e18b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623987947, "uuid": "9b8ec0e9-ce7e-4a6a-81a0-9bbb2c0fd1b4", "comment": "Malware payload", "value": "d6c79c826b9c96713a50f0c5e4303a5564c4a2ff44a307b1a206f66b00c4d838", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623987947, "uuid": "93e6bd59-0746-4987-a8ca-b2168fe92002", "comment": "Malware payload", "value": "268763327dff467ad1433bf32c87f3581c24c769", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623987947, "uuid": "7c2cbafb-49ef-4d75-8dc5-805c6640df02", "comment": "Malware payload", "value": "4b71a5b2b19be332645a72ea7f3c9dd974de99928a777f9fc9f55309502670f5a85f78e30edc5b5c346b9f4b17555309", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623987947, "uuid": "17f05321-53cb-43d7-8413-f25d01747432", "value": "C6228F2CD143B81AC11A0CBDD26467F0F76D1256E622FC1B6045779C0BA12C38356EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623987947, "uuid": "ea0e93a6-b535-4d7a-817e-7ec0975b850b", "value": "192:ScIMmtP6KQG/bqIyoObcRyDxQ5hJg8SPd7rk:SPXiKHqIlObyMIvsd7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623987947, "uuid": "cb2694e2-7336-4f21-b72f-fb1697085662", "value": 10358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623987947, "uuid": "91054141-b3c5-40b3-8a1e-a584cad6e1c2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623987947, "uuid": "84dcdde8-6f6e-4451-952c-2a3f3de25a7f", "value": "Payment Swift Copy --Ref AE9519062021.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9afdba9-d071-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624047243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047243, "uuid": "8fb92fab-277a-4e69-842f-f44c0f89779c", "comment": "Malware payload (Mirai)", "value": "926c028d5b47b59acefcccd724df0205", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047243, "uuid": "fa2f3c60-b56a-47af-9ca8-4947c3966941", "comment": "Malware payload (Mirai)", "value": "d7f0c6c370e74a72edacdaf0ec48d78e9f8766ca2e6af78cdda223240e919541", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047243, "uuid": "9a543d11-785b-4faf-bd8d-9b317b07a575", "comment": "Malware payload (Mirai)", "value": "5a39476f6d42d701eb95c6bb1f4fb43f94340687", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047243, "uuid": "a9fab6d8-57fe-499c-bb17-7590e5345266", "comment": "Malware payload (Mirai)", "value": "493ae6cf0e39672965bc2650f89b1a05157bbdcd3a111c4117773176bdd829d1701380157b1f7abd29afae4d6a2820d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047243, "uuid": "eb048486-d90d-4edf-b99e-e26a2abb43d2", "value": "6663965D2E219FACFFA886344BB35E20924C33E626E1C945E15DEA011E7034E745FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047243, "uuid": "0057337b-d5a2-4f95-9dd2-7c26a99154df", "value": "1536:58B83DOpSxUzpP+vntvnCEvnNY8QYdMYCy2R9t0slveTeJqmT:qK3DUSq5s1p2vt0sdeTeJbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624047243, "uuid": "943e41ac-d355-48e2-8a65-e083b2cf04b2", "value": 67564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624047243, "uuid": "031001b2-c0e3-4239-b6b2-701ca5ead7e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047243, "uuid": "95fce64b-af3c-4b18-b706-8e329d206670", "value": "926c028d5b47b59acefcccd724df0205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580b3b6e-d072-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624047508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047508, "uuid": "eff20e26-03fc-44d8-a189-25877b07ce16", "comment": "Malware payload (Mirai)", "value": "f64abd886794b81668a0f326c565b8dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047508, "uuid": "ddb4a737-c772-4c5d-a18c-211696e8a72b", "comment": "Malware payload (Mirai)", "value": "d9b761822e0ac194cec3b44e1b87e9c5284e412b5a080300671b5014cdadca50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047508, "uuid": "239a6e3c-eb51-4117-a034-7ad409c29c17", "comment": "Malware payload (Mirai)", "value": "aaa6c7b80dfab952c570940b42245b974190eb8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047508, "uuid": "ed1f0795-045d-417b-9c25-cb5e3bfc6c8c", "comment": "Malware payload (Mirai)", "value": "418629c1a1f0bea0fd1b46d188c654e093cb67388298a889f4c05add21634353a800dd4a025053f316199552f19907ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047508, "uuid": "813ee770-958b-4a15-9c3c-921f80164e86", "value": "96235BC9A587D9F8FC060A342172EF326B76F93F1018EE87C7959933D942702E10A5AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047508, "uuid": "92ef1871-6dcc-4d8f-8718-ccf11c822c4f", "value": "768:53sPWVrWy7PBIedilokjFMdMh80otXznlxKU3141AaIK5pYim6Hls:/D9I8ilokjFMdMu0inLKO14SDKLrm6Fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624047508, "uuid": "49fb73b3-3568-4613-9027-9a0ca5647432", "value": 47024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624047508, "uuid": "aa25c190-4506-4313-a02d-0dc5d61b905a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047508, "uuid": "da1a1d63-9962-4585-addf-0fb7aaa4d831", "value": "f64abd886794b81668a0f326c565b8dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a354fb42-d070-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624046776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624046776, "uuid": "7c77bccb-788c-48bc-aae0-8ff20cae917e", "comment": "Malware payload (RedLineStealer)", "value": "6e3d822491546a00f0981eaa645485b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624046776, "uuid": "8f4d1132-b550-4cde-9001-39f6ccb8f8fa", "comment": "Malware payload (RedLineStealer)", "value": "d9dca18d298e7736a878cbfcaf2f024a73b3f9144c43886e795657a1559fa606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624046776, "uuid": "83e8f742-9245-42f7-8d9d-f739d761e67c", "comment": "Malware payload (RedLineStealer)", "value": "486c9313c79cacef4a986f3d05b5e2ab8e0c49b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624046776, "uuid": "74b1f254-82cd-47f7-b1ea-36dd19c69c04", "comment": "Malware payload (RedLineStealer)", "value": "95f6d4f454075b9e4b178bd82cd3c88e5c6034909ddff57c118d8c428b7cd3a3c0048bfdde5f96bdecb370ba1c8c7045", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624046776, "uuid": "0891cfb5-3039-4bfb-8684-9849905874ce", "value": "70E35B2033A8871AD3EF4B7EF470441582F1E34B6262EB5A5E5476DE2B23B45A2117B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624046776, "uuid": "a841be23-2f26-4435-9bfd-e4c28728773b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624046776, "uuid": "1e13dc8a-a260-4582-9f04-15522dcd465b", "value": "3072:K0q1JmOTM9hVgZ+rbZexpAP6Y2sSJqoD2X7BpGGoMTb3R35dINX9rd6x4:KiOI9s0r1exGoJqoDC1pGGoMTb3RDINN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624046776, "uuid": "d145b1f2-971c-4753-8ff7-10be64a82c5f", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624046776, "uuid": "b1559687-cd31-42f7-b24a-b6c3d70d1590", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624046776, "uuid": "fd9445c8-d85d-4450-ad11-f66c20e442dd", "value": "6E3D822491546A00F0981EAA645485B7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58e07c1-cff8-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623995266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995266, "uuid": "39db4523-f4bb-4810-8e60-a374ee64a23f", "comment": "Malware payload (SnakeKeylogger)", "value": "044de8acb8b415cf3ba5ce8d33471bf5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995266, "uuid": "01112a30-13ec-43a7-bee9-ca16d9fb5073", "comment": "Malware payload (SnakeKeylogger)", "value": "db8ae92feb34e825ebfae00f75e27bbb5cb914533f45cc11799fc4d96f93e69a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995266, "uuid": "364c8f0d-8ce3-47fc-93a0-3fae5fd610e7", "comment": "Malware payload (SnakeKeylogger)", "value": "e392f710bb523b493475b889df57e3cb1d18cb32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995266, "uuid": "1d40a4d5-e0c4-41f2-aee6-082c3587605e", "comment": "Malware payload (SnakeKeylogger)", "value": "a5cb9c69ac3f8ed4e2371625788b39271f043ba95b66bc2eeeafc5ebdbaae7478679f26abb1d0f062f5778e4f6d936ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995266, "uuid": "7dd754e3-1373-43a8-a0c0-cff45e746c48", "value": "7C25AF221ECF422AE2764FB55BB0BC87C276AD663705E2153DC0329DCA335D9C8DE526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995266, "uuid": "2571e72f-e27a-4951-bcf3-e50f61369193", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995266, "uuid": "7f312d4a-b413-4e75-9e84-a8ef4054e1fc", "value": "12288:jfhlm4S4F3M9ywSMPQipP599kR36yxAP8K+Kiwiaz4M4TRYgbmpPCBPqZ32+Kv:j5Wwip6RqqAkneTklX8WqZ3tK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623995266, "uuid": "0b76dd17-c843-433b-a551-2ae97aa61190", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623995266, "uuid": "a06dfb15-80e3-494b-a48f-81f452e8aec3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995266, "uuid": "ca3f3ce0-ff2e-432c-80b6-c6c58fb87ea1", "value": "Minutes Of Meeting.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7cd911-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623976920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976920, "uuid": "687312ad-fa8d-47f3-8fd2-bcc7a9a46537", "comment": "Malware payload (RemcosRAT)", "value": "4aa4270cb372efe48abfb4ec1b6dbbb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976920, "uuid": "e1765fa8-798e-4a26-8ea7-ab93a1e49fed", "comment": "Malware payload (RemcosRAT)", "value": "dc2e0df15f7f02466eb06fd8691336a2b9e958fa0c2cd2a129d47a9231b0ca03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976920, "uuid": "5004fcd1-9ce9-4199-bb8d-f203f3bf1aeb", "comment": "Malware payload (RemcosRAT)", "value": "c51acaf9fa7ac0482ccbe9fb6788930f19f640fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976920, "uuid": "955a35db-9c4a-405c-985f-81bcb57a2bad", "comment": "Malware payload (RemcosRAT)", "value": "f42abd8268c7e10c020cb0bd3ea1e6eb2caed38cbc690546237f17ced52bea90ee1059fb1214a8f4857362589856a6e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976920, "uuid": "42638131-3bd0-446c-b7f1-870694286fed", "value": "44359F56B3915873CC3326BC5D06A698A67A7D4176ACDC4A37B67C483F38341783A0EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976920, "uuid": "10dade11-bec6-4d69-8b8e-d658f5476110", "value": "44ae77ffd352712ced0978b5ee3ef88c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976920, "uuid": "62dac628-700a-4712-b01f-c80e907b6e9f", "value": "24576:qt+Le+UAcIAJScTn9t884Wz7vxLdkOq/XQBSR:qt+rOTn7R6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976920, "uuid": "90d22cfa-14a8-4849-81b1-07d2d1fa29a9", "value": 1092760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976920, "uuid": "5239637b-6ffd-4352-b40d-8d45261374cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976920, "uuid": "a3305d2d-ca6e-4064-8e6c-871bcf4be744", "value": "DHL1207110474 de recepci\u00f3n,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a775a9-d01e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011618, "uuid": "d9851ba2-f460-4c2c-8c23-abe355139c17", "comment": "Malware payload (Mirai)", "value": "cd82fffb1ca68f7b00e645912f625073", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011618, "uuid": "c9e9a1b1-a4ae-4415-9731-b853adbbc3cc", "comment": "Malware payload (Mirai)", "value": "dc877b78f87aaeb348869534508d418c1f6b2919d68c3f90ad45f137eb120ed7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011618, "uuid": "9e0c3c5e-7632-4359-8699-6691efb9ed32", "comment": "Malware payload (Mirai)", "value": "c067ca28585e4e05d96389eac0b0b132e1df8778", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011618, "uuid": "ac89d64c-5db8-495d-b18c-d8e67454eb7b", "comment": "Malware payload (Mirai)", "value": "1094aee0928d061cdd7239449ea21c4ba0cdabdf13623d816a4f86d89c8eaafd99174b5e7638679f0eb0d83a6a80a65f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011618, "uuid": "7fa68a7a-d841-44cd-b7ce-9a15e14a7a2d", "value": "84638DB9E1795E54D35105787D108838C723F00AA6DA2EF2DE86868FF99BEE8F005771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011618, "uuid": "e4410c36-51dc-4a47-acfd-b61744039fb3", "value": "1536:h/9tdVPQQaUwt+9f6qgVN1pkCmDQHvH3fs3UvrCN5Divw8C8a:hltnPtL1d6qmmDQHff+4k5Wvw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011618, "uuid": "b2f48345-5b24-4622-8395-50ce584ce5fb", "value": 71852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011618, "uuid": "449edf37-32d9-43ab-bbb5-934e996395e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011618, "uuid": "3576dbe4-d33a-46ba-b48b-70df2c150eb3", "value": "cd82fffb1ca68f7b00e645912f625073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65bd4ba3-d039-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1624023050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624023050, "uuid": "b469a43b-3a7e-4c31-bc8c-0b03ab80c5cd", "comment": "Malware payload (AsyncRAT)", "value": "43ba66a58fed0fd1cb1b114bd33ac732", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624023050, "uuid": "16eab111-431e-449a-b110-5cf9d81e0f31", "comment": "Malware payload (AsyncRAT)", "value": "dcc2f16449920c4807a2f1acf0e4d653c2fa25c663f90e76726cc1117fe050aa", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624023050, "uuid": "d8f6cf4f-a283-40fc-a160-c19bbf087535", "comment": "Malware payload (AsyncRAT)", "value": "d5a97a70c03e63368a20c386321bf10666f2869f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624023050, "uuid": "86d1f96f-9b48-4d2e-b085-c990cdc45fbb", "comment": "Malware payload (AsyncRAT)", "value": "72927d637bce96399110cfe4b15aff61364a46e1708aebad7c07cf1fce6541da5201c7b14926e1b7faacd44249492787", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624023050, "uuid": "1bb502bd-fd02-497e-985a-47e114a345c8", "value": "72A47C1076F61B69E5BDC7F50768624847FA352E6C2EE2184DC770CF28A2F409A52F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624023050, "uuid": "d42f2500-6fb2-4dbe-91e2-b1d0b39b8057", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624023050, "uuid": "e279ab50-3e42-47fe-8502-54a7a474aa26", "value": "12288:ke7k4CFV7sXXoTKJXOQAjv/ywaSYd/1p7:jXomwvh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624023050, "uuid": "402769a2-5119-48d3-a0d6-81d7c5afcee3", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624023050, "uuid": "99934167-d178-4e4d-8866-687a58a438d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624023050, "uuid": "2ed2ed7c-3b6a-48f0-8bbc-ab1cd5437a66", "value": "DHLShipmentDocument06182021pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a6d438-d01e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011562, "uuid": "ddd37168-6e87-4824-8381-1be8ad85d3c5", "comment": "Malware payload (Mirai)", "value": "5fcb69e4165bfd91e6875e3166682714", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011562, "uuid": "810e681b-60ad-47f7-8ed4-b54be65edb95", "comment": "Malware payload (Mirai)", "value": "dd9d3b39d4a05ad52328a057979b32536301850060d4c4ae35c3454f63cfc25c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011562, "uuid": "33c33be7-43f5-4874-b0a2-119c0dd1da90", "comment": "Malware payload (Mirai)", "value": "4004832734d82ae725e6e02eecfb10ee23bbbef7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011562, "uuid": "1e134391-5f62-40bd-9a0a-f7e4d6843fd9", "comment": "Malware payload (Mirai)", "value": "ec9554df66d82bd94a54eada455df618e29e21bd9e2fd612f6bb9f5bdbe45f8b8189e8a2a6554b50eba0bf9fb02269a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011562, "uuid": "5a274900-d144-453e-93ab-ee4ab818b68e", "value": "11D2F19ED1DA580AC9FECCB5B3CE1A505CE46BD0366D475DEB1128C8A124C17BE4647C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011562, "uuid": "180343ff-02ec-4d93-9a52-ab27c4beb81a", "value": "768:i8YLSCd9ZLiPRcOvSqKOJGGjYZ2O/a4130HzcZJWS:i6U9BiPRcOvS1GjYB/a41304z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011562, "uuid": "a6a27c8e-c6c6-4be3-bdf4-855a67e63bff", "value": 31008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011562, "uuid": "463afded-05e7-4761-b1b9-0b375c9947f3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011562, "uuid": "e9838add-6713-46aa-8602-be082f792119", "value": "5fcb69e4165bfd91e6875e3166682714", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e52c6192-cffc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623997064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997064, "uuid": "a0ec1d73-3130-41ef-8b30-add6c285b908", "comment": "Malware payload", "value": "c4b5eb90f7f8fe889be31080efbff209", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997064, "uuid": "25b75151-7938-42c9-99c7-ffe848c77094", "comment": "Malware payload", "value": "dda36d276bdad174ac5057cd825734f7e23c78a6b0ecff6803f76827aeed35ea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997064, "uuid": "5358203b-a5b4-4ee2-bdf3-254ed82b724e", "comment": "Malware payload", "value": "e35642e9c19523bc31fe71be8056f9b0d135fbe2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997064, "uuid": "fbbf47e9-79c1-4fe0-87e8-9db5e495faab", "comment": "Malware payload", "value": "dbfc309bd9f86896324faa0937ce0af11aec84a8ce2f3d31f7f68527b01aa01c1ed4a6da37a6742b0a94d761397c3c97", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997064, "uuid": "b91ec5f3-9218-4add-9cee-b00fbc3d7b96", "value": "1485AB36F89532A2E84EC5B406B01DA403F66DB0126F97C43276749FC237F6D9A78A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997064, "uuid": "3b5b0efd-bf22-42f6-8177-9db1d9bd14fe", "value": "24576:IOe32CfTPovQoFSDp9KqMDv3xy3YBrGoixkNDULaXJ:IO42CfTwvwIqM9gOhBULI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997064, "uuid": "a0410b8f-1903-4554-80a0-27278420e385", "value": 1765090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997064, "uuid": "f1c00ed6-359f-4a88-86af-e5abf6952aef", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997064, "uuid": "6e65b792-6f87-4448-b90f-0ccb46db018d", "value": "StarBurn.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46101b30-d020-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624012259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624012259, "uuid": "6a674bb5-f9bb-4a18-a3d1-8da01b5ee967", "comment": "Malware payload (Loki)", "value": "a88e55dc1ff60754a07693abe159cc23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624012259, "uuid": "d41ffea7-849e-4e16-b748-b8c59321b048", "comment": "Malware payload (Loki)", "value": "defd4619ffb8cde9f007f7a33ffda97fb9f1d7db127fe6019e43d945d62a2f9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624012259, "uuid": "99583151-d9a7-4420-a82f-39210aae4e91", "comment": "Malware payload (Loki)", "value": "a1360af848bc9d6b62152a66985586aeaf068657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624012259, "uuid": "20738b79-df75-4cc1-94b1-b8714fc26e8a", "comment": "Malware payload (Loki)", "value": "054ee5aba11206a94d6882ac0b32ec5038f3caedfa7ec827a23763752a2d512591aee63e8801a6e8a651e48e67edd3cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624012259, "uuid": "ca54682e-ac25-451f-81a6-7e5609a85220", "value": "45156A9D722072EEC85BD4729EA81C64EB506C7B931F5203902335EDAA7D897CF245F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624012259, "uuid": "09138166-f2dd-4455-8f59-e59c4cf9ed15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624012259, "uuid": "abd48273-5104-4ef7-81ea-9f8660b00c88", "value": "12288:YO7Tw32ZzUFBp9kLY4+Xsjl01J3thdPt+Eww/jUtswIfK/wxSAq5pSUevKlgpMsp:r70GZUrfXolCtN7UG3CYx7q5p2agp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624012259, "uuid": "2a65ade9-1e36-4ab7-bf59-cd98f1daf8e7", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624012259, "uuid": "f37d193d-c633-455b-a62a-c10057aa5504", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624012259, "uuid": "054e70ed-9e65-4b26-a9ea-6171c8ba67bb", "value": "Purchase Order.pdf.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11174e0f-d07e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624052543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624052543, "uuid": "0ee81f81-2edf-4a60-8f0f-066836cf1ef7", "comment": "Malware payload", "value": "3d74e02ec873c57ef72db44f32b33b04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624052543, "uuid": "2ef7db9d-1fa9-4496-938c-5f05a14adc29", "comment": "Malware payload", "value": "e084dd63e194fc150dfa439ab805ed2efc631397a40741cfcc789180c42b0515", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624052543, "uuid": "787f28d0-9579-4303-81a2-5a50a6b68cc8", "comment": "Malware payload", "value": "c6f55eedaac4a8e64454706bdb0738e681951580", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624052543, "uuid": "8871ec85-d20d-4d02-8c93-868c41c03cd9", "comment": "Malware payload", "value": "bc3cc662548fd22474814e9cfe2827b17316e6fc8fd0dbfcc175e260eb4c0bd997e2c085807f943c4a1b51a5689327b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624052543, "uuid": "ae79012c-dcec-4d9b-bd44-d9c647f7f6f8", "value": "67351210B6A1D031F5BA11F8A47A9368B73D7BB1D72454CB92D51AEB1738AE0EC3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624052543, "uuid": "09199774-6b69-4a2e-9a81-109dbb0912e6", "value": "ab2fb56fc05bfc607ada1283b4f9a600", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624052543, "uuid": "52f64c31-f224-40de-9a5e-9d1167c29d04", "value": "24576:6XNq6UeABiDshChOaqvw6cqRVSfBDKEtua2a3V:0bc/vw6VR2eaus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624052543, "uuid": "6d6b3e2e-ca3c-4f72-8acf-73681d25549d", "value": 1136640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624052543, "uuid": "1d8e18d0-9f63-4181-be3f-46f9cc4eea1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624052543, "uuid": "edd645db-76b8-4a4e-9b28-ba12a1787cd0", "value": "3d74e02ec873c57ef72db44f32b33b04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b4e0b3-d07b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624051259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051259, "uuid": "9622c0c7-a32f-4da4-9d71-7c3ff2c990c9", "comment": "Malware payload", "value": "cb34374f1b5fb771076872c6b14b7501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051259, "uuid": "f54514fb-dd73-4069-9f7d-b66915b4b331", "comment": "Malware payload", "value": "e0afb8b937a5907fbe55a1d1cc7574e9304007ef33fa80ff3896e997a1beaf37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051259, "uuid": "c2617dae-513e-4d56-b69a-bc21055c71d3", "comment": "Malware payload", "value": "118f688c30a2f6c2d1feb955f53ce4acf3086b3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624051259, "uuid": "7234b271-c9aa-46d5-999f-4d839bf43d61", "comment": "Malware payload", "value": "cdc577ae32d739275cebce50cac54efddefa1c733ee5735a93a196fc171bbd93c685eea8db0d0e728c4edf2334fb2f2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051259, "uuid": "a5053fd7-6917-4cae-8952-6500bf43c7cf", "value": "7F336D22B945A1B2D9F198F095A8B7A6E87DA533172170D3D3A0CDB11DA13D3BF3814E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051259, "uuid": "9752e502-931d-4754-a850-e6ec60c98cbd", "value": "b5403fb8687d7afd40fd8cf3b4dfe29b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051259, "uuid": "b750b8a6-bf84-486c-8411-7843e5ee4d4f", "value": "768:8WetQRPOQaniqkpY0O5w8dBxmT9yWU3jSPyyihNfVARbpn:8WXOQwi6wEBxmTSp3Epn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624051259, "uuid": "e195b151-4587-4964-b81a-9518747945a0", "value": 50592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624051259, "uuid": "49dac1a5-16d8-4f85-af6e-1a548eead27a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624051259, "uuid": "0f8adc87-c275-4e05-bb9e-b85747b471d1", "value": "e0afb8b937a5907fbe55a1d1cc7574e9304007ef33fa80ff3896e997a1beaf37.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b327390-d01b-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1624010228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010228, "uuid": "75410801-f045-447a-afff-e14146fffd97", "comment": "Malware payload (Formbook)", "value": "e51bf99f44cca1f9bdc56877b8614afd", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010228, "uuid": "5103b067-73d9-4f7b-947d-2d0e8bb2fcb7", "comment": "Malware payload (Formbook)", "value": "e111e9e9334a405bf7596e196d0199bd70595122b0922824f9e0f32f07189fa8", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010228, "uuid": "766f31a5-4426-44b4-9649-68eb918ed1e7", "comment": "Malware payload (Formbook)", "value": "f46828b5b9590d4018d5ee9f99d4f6f24252dc83", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010228, "uuid": "124daf6f-a696-4a0f-b9e4-4539d2cfc849", "comment": "Malware payload (Formbook)", "value": "76da5944dc6657c7781772d784b7e0a04aa38c31fb7e26e535b75c95e216329ecea1537726819d75b4de954a2920fa8d", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010228, "uuid": "94621d65-b480-4119-9acd-20f45a147fb9", "value": "E99423F74C13CE4DEB13A384B9C9B8E09572CD329D0AD2D1AB95DAFA55C7414A6B8CC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010228, "uuid": "83df69ac-45ef-4b3f-8d65-701342c31bbe", "value": "12288:6JHgJUO7LExMmd0FY5Wub5u3M3JGlcmD5xiwQQu:6J+7aPd0YbspcmDLLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624010228, "uuid": "97ded146-972f-487b-9dce-debd4035fd8d", "value": 439876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624010228, "uuid": "08084a96-a465-40d0-ac8f-6a7fd228dcf3", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010228, "uuid": "4fde02eb-ecba-45e1-9368-21fdf6261be2", "value": "Remittance_Form.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdafd7a-cff8-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623995257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995257, "uuid": "a25e07e6-8083-45ec-9ac8-65e2c5da37ad", "comment": "Malware payload (SnakeKeylogger)", "value": "28891ba7490527715a00e3d65d931645", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995257, "uuid": "e1cb5f2c-7617-4444-a21c-d734b09ae3a9", "comment": "Malware payload (SnakeKeylogger)", "value": "e15286e4dbca6cd8c52c3966e69c9bd0aae4490112dcedfea10d8f4067f3d52e", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995257, "uuid": "9b295097-9617-4aa0-9d2e-887c957b9ce0", "comment": "Malware payload (SnakeKeylogger)", "value": "491f79c98a357e9f6d778ea53b54bc000fff2391", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995257, "uuid": "9d6ad11e-aff9-4ed8-9804-0d165df7ee4a", "comment": "Malware payload (SnakeKeylogger)", "value": "9ae7e361cebbe87eecd13238fb060413b6af85ade929aefc8f7e81f44a86ae2ebb7dccfa912048d196030dd1e65eea80", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995257, "uuid": "38786202-676d-4f09-bfcd-3d2dcba72919", "value": "93D423CD12D5F691C723BDA55ABFBA0C93BEC2C70B53D43119638A16E06109A7BE253C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995257, "uuid": "a1ecb4d8-3b69-4725-b49f-ccbb4d112a48", "value": "12288:y5nhV6fI2mmM93euoJrb8Nn8MVjS8yOzRqkyyrOdRuIkx50BA/kQ:a+g9mMdVNa8yOzRlyuoRvkx5x/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623995257, "uuid": "1769bb01-1f3c-45bc-8885-81c984dc7bca", "value": 601207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623995257, "uuid": "800e46c4-51c7-4891-9bae-c0c96dfe0d06", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995257, "uuid": "33a81d6c-997f-4968-97df-60f7812756b2", "value": "Minutes Of Meeting.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5e786b-d071-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624047005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047005, "uuid": "eab41cab-94d4-4400-9563-aa2b6e37342a", "comment": "Malware payload", "value": "690c5851e18114339101a92b77775749", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047005, "uuid": "8f6bb8c7-270e-471f-94b8-10fdbe6c1a7b", "comment": "Malware payload", "value": "e15ea1dc92dd31517334886dba17d7022c73d258096bf77f897ef60c1b8302b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047005, "uuid": "63b43812-22c4-4aea-be3a-4f8ed4508786", "comment": "Malware payload", "value": "f584406c46d0875253a01ec222ffadf9d52dd831", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047005, "uuid": "2f71032a-5286-469e-b82a-cf9e204d3282", "comment": "Malware payload", "value": "99b93c17f34b4bcc5d1984c7632a6fba7dfc338dbb9188056af092464708145e3cd3a17407647f51a9057dd58eea3fa1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047005, "uuid": "bdda7c61-e173-4cd5-93c4-b8e48ba7384b", "value": "2BE53340FDD0D672D6B209364869AA52643DBD311B28DE8B63E0291FEC761C1F7327A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047005, "uuid": "a932f7a4-f5d8-4de0-8691-ab18b8b7b5f2", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047005, "uuid": "54a71501-762f-4714-8d7f-76408bb792ac", "value": "49152:C3dhTgIFAyR8WMdDinwv+P3db4S5ccT/mU9ZREaMVvFQS/UR3uvxZVxPZTuS:CnTqyWWWWwv8db42ZREjvFvUMvxZVtRf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624047005, "uuid": "84703817-acfe-4cad-97ef-233b97900e96", "value": 3253071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624047005, "uuid": "398c3378-54c4-404d-a080-007c4fe1dafd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047005, "uuid": "344a3cc7-d4cc-4332-a541-ae401e7f32d8", "value": "690c5851e18114339101a92b77775749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2194a8eb-d06b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624044410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624044410, "uuid": "56cf7f70-7710-4324-8883-6d4c844c7837", "comment": "Malware payload", "value": "a7eb6a0b8d8dbce375adc25117fc6637", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624044410, "uuid": "7a300fa1-4561-41a7-b774-6a4a5fa6c404", "comment": "Malware payload", "value": "e1862530047d9530658f32c4f54f09f2fbb75ec1f3b4788208460d24f324cf30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624044410, "uuid": "42c0987c-edac-4a99-ba23-7b9703555d56", "comment": "Malware payload", "value": "61e19ddc375a09c01c48c3eb5a40318d3f841fb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624044410, "uuid": "02c0ef18-f6eb-4793-a5f6-75ab1ae58a5e", "comment": "Malware payload", "value": "d5d04c4e533b6603fc888439b04cd7ceeb348de25165e73321bf1b36838d95ad7881d1f93d0455b868873cc6c09dd58e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624044410, "uuid": "afdef28b-6948-4ca9-968e-bef605cb0419", "value": "03958DA077214037D5032A707C0FE9F06C91FF7D2D407AA7AF76BC4888AB6956666363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624044410, "uuid": "4116715e-ef5b-4117-9e8b-6b2e72736b47", "value": "7be4c98eebb39d282cdffc1cea8fb470", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624044410, "uuid": "46a237be-d809-48ed-9cc1-1ac8c525f389", "value": "12288:c99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSG9dA7W2FeDSIGVH/KIDgW:o1gg4CppEI6GGfWDkMQDbGV6eH8tkD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624044410, "uuid": "29bf4fc2-404b-4fb3-83f9-d2fce44198ca", "value": 1931166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624044410, "uuid": "fc48a9d0-053f-4121-ab48-99c20558dd16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624044410, "uuid": "40bef52b-523b-4a54-b60b-9cdeb30e5dd9", "value": "sinners_and_saints", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692cee1e-d049-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624029928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029928, "uuid": "4496ed0a-2892-49a4-a0f4-b4c9777bd67b", "comment": "Malware payload", "value": "4d7d34dad04f64e411e8a22c0b6915b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029928, "uuid": "2a3b351f-0df1-4246-be71-3fb561981b8b", "comment": "Malware payload", "value": "e22a60d71e23f295a0470c6a302e7dc0c09afe31380539de9841871da18e74a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029928, "uuid": "2c40df81-f34f-473d-b719-097efeac0bf7", "comment": "Malware payload", "value": "bb1635ae9e293ef8ca0276301df0513c2978d617", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029928, "uuid": "1a22c10f-eafe-4e1c-bada-3496c8d8a0cf", "comment": "Malware payload", "value": "af7b3972c0163be44ca1b0f5fad23611d0795cf0957ab789ab0610e321f2d55dd8c8e8b720c8798fe018715ee89d7bbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029928, "uuid": "55e75f8d-9434-4ea8-9dbc-647a240a7eab", "value": "A244B3239ADCBCD6E075423033BB93E1EB2DEE706291C05FA6C01A95957C19772227E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029928, "uuid": "670352ed-d846-4b0b-8ec8-050e66d79c3d", "value": "ee60dc6086fb4fce34e1e9ff4767a8b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029928, "uuid": "56ed970f-bfcc-4153-9245-b270a92f2514", "value": "3072:b37rSUFPc3nnDBOYPKboJR4F4stNoP8zU0fx/0qvcpzprCHw0P:HrSUFPMnDBOYdoNoP8v+pY5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624029928, "uuid": "33ba142d-406a-46b2-a476-78473bee15db", "value": 278535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624029928, "uuid": "28829b81-1f35-40ab-b15c-7e576bbbe82d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029928, "uuid": "be142258-2d59-4aaa-85c3-2177f14dd498", "value": "e22a60d71e23f295a0470c6a302e7dc0c09afe31380539de9841871da18e74a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7987557d-cffa-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623996025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996025, "uuid": "c7a39132-6321-4936-b5ed-87889d88a74d", "comment": "Malware payload (Formbook)", "value": "1d1549966880c4a69b14bb2fcb07120a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996025, "uuid": "b85e35bd-75cb-4e85-8e77-57c2fa0ca627", "comment": "Malware payload (Formbook)", "value": "e242d70710f47daf819f4dec74264d265efd80a1aa12eec27c0ac20715670923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996025, "uuid": "8663019e-1519-447e-8e96-1d9bc7a82646", "comment": "Malware payload (Formbook)", "value": "e05300e8abc84d84ffdd790e5ad52e3531e5d178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623996025, "uuid": "e568720e-74af-4d86-b980-1f09c5d85f8c", "comment": "Malware payload (Formbook)", "value": "55d89967b1e0447dc42f9613c5e6f2d19b6f0674c35ab3595383d9a9c8d1df6cbf6c4abab0420fa0944c8e0eca424bcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996025, "uuid": "9080ab7f-b703-4f1e-9f78-34ecb4992a4a", "value": "A2341223BA869873E1CF47F30D748677D2A89D1126108EEB03B0BF7B6A759C69C0B155", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996025, "uuid": "b071211c-a9c3-4d73-be39-83a4f327bc2b", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996025, "uuid": "e62c62e9-e062-483a-8c7e-d01a41aee795", "value": "6144:ABlL/Jk89icXurK6JCXamDGZJqOVmu9LcY0/L9DK6o44wTs+X:yrFicXspjQ2muxgz926bJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623996025, "uuid": "2e8bee93-4dba-4f9b-b19f-0933da366e63", "value": 243867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623996025, "uuid": "ccf768d3-31e3-4f8c-9eb2-2808d2f8e293", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623996025, "uuid": "ac38505f-e1ac-4de8-a84b-7ee8f7101762", "value": "DOC98760147.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad014bf-d002-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623999517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999517, "uuid": "3c7210e5-b6d9-4608-9f9b-236f7ea2add4", "comment": "Malware payload", "value": "b6a4bffe319b2346d1a1b3e84bbc5895", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999517, "uuid": "9b1ed276-6fc0-4acb-8da8-0373d03b9d2f", "comment": "Malware payload", "value": "e30bdcbd03ad51de624464903d420166d91bd43c01f334fcb008124df14c815d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999517, "uuid": "d55df7b1-6cc3-4165-9c46-309165d9540b", "comment": "Malware payload", "value": "77d455c97b46838ee5bb17f1ad7afacf2f78a787", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999517, "uuid": "91ade285-d41b-4a1c-8340-bad1ed11e270", "comment": "Malware payload", "value": "b7145ae4fe31a0bec6cac08366192180e1acc3556e0427c55c8ac23ce43ffb641fe75439d2412e89784ac6e4224c5aa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999517, "uuid": "bfbf7ce7-6a96-42fd-8bf3-7f9d30adb974", "value": "61C42352FAD69460E7E50AF02D70C5B905DAFC111E72DB2F32A97ECD7931480AA34B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999517, "uuid": "b1ca4e3e-89b0-4c08-9b3e-d008c5603828", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999517, "uuid": "5f5988e4-e160-4b32-8b82-5e18d8929665", "value": "12288:e0g0yfdyZTg1J3rRHeMe6f5w8Ec8JUWghsLKwC9mW2d:Zk1Zrr9eMe6BNEjus+wNpd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623999517, "uuid": "c5c47408-3aef-442c-9c1c-65d960669546", "value": 555259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623999517, "uuid": "19876d3e-cc91-42e3-b65e-c78a962351db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999517, "uuid": "850b5bca-b236-4e58-846e-efe2b50267a8", "value": "b6a4bffe319b2346d1a1b3e84bbc5895.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c45e84-cffd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623997334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997334, "uuid": "b23892db-b64e-4ed1-8f50-ac70d3b43725", "comment": "Malware payload (AgentTesla)", "value": "83e96cc4313ffc6108e7149690952921", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997334, "uuid": "8e948b7c-7ea2-423e-a7d4-c8dfd3e4955e", "comment": "Malware payload (AgentTesla)", "value": "e30e10523919983aa4bc82122bd2ad2d1697dd6e2df3495127dc65d043e08f9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997334, "uuid": "07daeffc-0daa-4ce7-88e7-325495a4e41f", "comment": "Malware payload (AgentTesla)", "value": "b9e4f34c9ca035cce7c83852e6893fab107a16e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997334, "uuid": "4c523dcc-4d5a-476e-aa96-344039debd39", "comment": "Malware payload (AgentTesla)", "value": "61b7e506c31871cd5c1a3844194992961ff97c7afcd5328ad42a96694a61319f7e3d804f649591d9c15be871ad239544", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997334, "uuid": "0fb52971-6dd7-4320-b207-3d849efbde33", "value": "6A841250B3D8CB53D24721B5CCC2C3DEF621FD26AB45C7873694BB2DA9363584AA6348", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997334, "uuid": "d6309813-0662-4fbe-8b72-3c1d2b5fde76", "value": "12288:etOMzOH8ZoFzUOcFvwX9eepPZm4c9Tia:eUMWRFzUwFpPe9Tia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997334, "uuid": "d7c337ad-ac39-485e-9139-a1de3c5cb129", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997334, "uuid": "c7b1455e-d231-4258-bfe3-c65d86ff7763", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997334, "uuid": "373fad21-d384-4ed8-9697-6e9878d2ff94", "value": "Bill of Lading.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4120818-cff8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623995291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995291, "uuid": "9b98dd0b-11b7-4a93-96d5-d6742a866f93", "comment": "Malware payload (AgentTesla)", "value": "7d89cc96825b503c52114b22a3e3f8a3", "object_relation": "md5", "Tag": [ { "name": "r04", "colour": "#B270B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995291, "uuid": "c57c6dca-c4aa-444b-823d-106cf89c7cd2", "comment": "Malware payload (AgentTesla)", "value": "e411b668208ee3dd78c63631ae14d3a344d89e2e6c0584194490be9722e16b87", "object_relation": "sha256", "Tag": [ { "name": "r04", "colour": "#B270B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995291, "uuid": "360c2d16-8a37-4a7d-b461-c45092fcec51", "comment": "Malware payload (AgentTesla)", "value": "7beaa61bc7052fdeddb34587f32e36c16ba3adf4", "object_relation": "sha1", "Tag": [ { "name": "r04", "colour": "#B270B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995291, "uuid": "2515f65c-49b3-4864-a4ed-b464219d6bd4", "comment": "Malware payload (AgentTesla)", "value": "7ef653abdbac1de9ff6863fb591202d8298456a5ee0bfb2f12931a06efc468bf48d25406b6e531464d459f83928a7756", "object_relation": "sha3-384", "Tag": [ { "name": "r04", "colour": "#B270B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995291, "uuid": "b8962d5f-cee6-4a23-a5a5-648a5f1a303d", "value": "0FC423F3D4DF16A9A6C70E15135FAF5D462EEAF50A8981E5AA08C643B75383C4322C73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995291, "uuid": "664828bb-c99d-4f2e-a7aa-bda1366246b8", "value": "12288:F4fWm82xbfXmnAyRLlJLqh5DkGXQZ4FAsebwbj1TLbOC+IMh:obf/WH85jXQeafwbj1vt+IA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623995291, "uuid": "8302c1b3-c3dc-4dd1-b7a1-a9576b1e1a9b", "value": 567449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623995291, "uuid": "fb910193-54a8-4d5d-ae8e-79c57a9ca219", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995291, "uuid": "acb50a3d-046b-4f89-96b3-31734ac4e967", "value": "Order.pdf.r04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714c9522-cff8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623995152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995152, "uuid": "9f3e4dd4-c73e-48a1-b08d-8e73c642c6ef", "comment": "Malware payload (AgentTesla)", "value": "e0b830e26acf33f4bb40a09330f7302a", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995152, "uuid": "bc52fa05-d7b9-4925-aef0-c25150c0fe24", "comment": "Malware payload (AgentTesla)", "value": "e4bb885674f142f06943ebac7bc26c17d21634a4f407b5adca78651f9cbc5fe9", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995152, "uuid": "fefbd871-158c-4a27-83fc-e4530cdc7f52", "comment": "Malware payload (AgentTesla)", "value": "6033b5943a243d4e552d45410a916c77cd4b8a3c", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995152, "uuid": "c118db8a-d1a5-434c-a917-be8c0491d922", "comment": "Malware payload (AgentTesla)", "value": "b858e25ac11d3d9b089d1d4d235dd5e21eacb8471552a2e7ef75c57996cf743269ad35b75fea7f897bcf5d7f62c9f8e2", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995152, "uuid": "10071966-6f5f-4955-9408-9bd5d354acf3", "value": "0AB4233A700EFB44F77F00F742D428D6A8045A65AE972BCA96B90B3351B2218B7DF751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995152, "uuid": "53700f96-15f2-4884-93c4-608e829d259b", "value": "12288:5y/wpjxH4Aps68/5e1siT1yBqDBDVus9CbK+wwTQZ:5VpxH926D7T1pDp9weh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623995152, "uuid": "38cf3820-9b00-49cc-8f1f-3e65626c9d84", "value": 503874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623995152, "uuid": "af27f57c-22c3-4061-b2ef-d350737865e9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995152, "uuid": "c04d7f82-08a9-4d6c-af85-d96b31611fad", "value": "MX-2310U_20210616_225343.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55074c4a-cfff-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623998111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998111, "uuid": "1bce7441-28c2-4b4a-8df9-c75da8a77e3b", "comment": "Malware payload (AsyncRAT)", "value": "da729a88e61a7d40dab00c0408cf1708", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998111, "uuid": "dc9bee08-50a7-44ec-a3d9-3544760142fe", "comment": "Malware payload (AsyncRAT)", "value": "e4ccb1557172583109a26c368b237a5f89051ba5b013c5e57bab0eac4b67ced1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998111, "uuid": "54ecbccf-a17a-4a99-b8b9-63cb4e297a6f", "comment": "Malware payload (AsyncRAT)", "value": "734a3ae48be1a79af986f1e491e6c79402990f00", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998111, "uuid": "441969bd-cf57-425c-93e0-5bcce5d2bc82", "comment": "Malware payload (AsyncRAT)", "value": "02ceb59b1c636ef11b5e27a642eddfbe67466f250366595f77b6d2207f8bf0befd82b3cbe1c064bbe8a323d16b9600ca", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998111, "uuid": "280504cf-01b5-47c5-b600-de418edb5286", "value": "BAD0226F7904CC0722CE19EE0A0D02DAE0E3432C3AB5D0203A90CBEC31400629D2A0D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998111, "uuid": "fffcc050-a0d3-4102-a543-72baf5ff5ce9", "value": "3:WzOp83wXnxFyuoLWi5gfgHnovVdi2XfoVRmMZSxL6WQ6R74mYNesSaIn:WzpM4WgHovVdDXJHQA7RruI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998111, "uuid": "cc38ccff-1e03-4830-b30e-57489237ca67", "value": 210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998111, "uuid": "03eb784f-45d9-4cf8-83d4-dbf564d0de71", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998111, "uuid": "b8a85913-f7a0-4f8a-a098-19b1f6007833", "value": "eBill-ID073000693213929.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ecf0de-d031-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1624019472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019472, "uuid": "5a7ac6ee-b77a-47da-a5f2-7d6db653131e", "comment": "Malware payload (Stop)", "value": "ca00ac2f589b40d6c27bfbdc3d4d40ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019472, "uuid": "b61a49e5-3c66-4633-b750-e647e8a891a6", "comment": "Malware payload (Stop)", "value": "e4e337f7321f5dce05d1bd2628be0b8561196afa2d660f2dbf857d006b5dbeac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019472, "uuid": "5c540d1c-7c82-45ad-99fe-404b1d7d2287", "comment": "Malware payload (Stop)", "value": "fdbdc2ed03784fa0c46da2c1d7443c3f65c9eb9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019472, "uuid": "18fb8458-4182-402d-8361-be467b6b7b03", "comment": "Malware payload (Stop)", "value": "471782f457ee6b75a8f5be75d6cc8a463efd01693bc47f28656428cf9356e476b9b2277abd02c78c8590b5f5e5e2565a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019472, "uuid": "f0479d2d-6ba3-49ec-8d68-a4fc6ebeb321", "value": "DD05F100BA50C035F1F712F969BA8369A52D7A734B7451CF62E91AEDA6386F0EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019472, "uuid": "be998153-87ad-488f-b929-74ca98e3ae4a", "value": "866e8b0fa01ec6fd81db7579c1be52ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019472, "uuid": "f3ba9612-c7ac-4101-a7be-d311f6013fa8", "value": "12288:KYxbpb34HZAMnziMErFJrsvP9ZJ8v3eertizHtwI7KxeFh3odh46ZKVABYVtfRpt:KgbiZX0rsHzJurtizHtruAFlodbsCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624019472, "uuid": "462a7b21-ea54-41a9-b2cf-e76a77045347", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624019472, "uuid": "e2ed73b7-cfa8-4386-afcf-dfe625923cd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019472, "uuid": "9aaf9afc-b58a-4b38-8bb1-c3f53a52e55e", "value": "ca00ac2f589b40d6c27bfbdc3d4d40ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3bc2903-cffe-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623997921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997921, "uuid": "6f2defbe-2ba8-4989-9cc0-fb4ca05bbbfc", "comment": "Malware payload", "value": "75825a67d46fd3dffa72cbb4a302585f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997921, "uuid": "40610dae-8591-492d-8a6c-9f8d5e291198", "comment": "Malware payload", "value": "e560220ebfd39998194ce5af3bacf632e1c1d18ee4bdcb2fb59f9fc483a00d3e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997921, "uuid": "db333c11-4fa7-4ae2-8df5-b40864441404", "comment": "Malware payload", "value": "2436c5770bf47d9e73927ecb342915b82c9e54d0", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997921, "uuid": "5c2fc3f1-6ee8-494c-b685-70446ec30e80", "comment": "Malware payload", "value": "bfdab1b56b6820c177ddfb5aab26c7e77c05fe6c77ecc204796d37e0b46b502875df9f5effccb9e638c10281c73a6b2b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997921, "uuid": "fac05212-5b60-4ce5-8a0a-74329a08a639", "value": "FE2149044FE20320E6F79739AC7AB310CD767C52EE624FCD025051486821610F8B4F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997921, "uuid": "d3ce21cf-5159-4e7b-9850-0ac0e05ec2dd", "value": "12:80m/++VSXvk44X3ojsqzKtnWNN5UcCsvXbjQL6H/sfECEpHCiN33YqlPcr+9m:8JpHYVKVWB/CWA+7NH/dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997921, "uuid": "c40e4c09-0386-4a1c-bd0d-ad25397ff7c6", "value": 1114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997921, "uuid": "01811b2a-3210-43f0-a11d-52e82664b7a5", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997921, "uuid": "4a0f65d8-7fdc-45a5-a5d9-22879d43979e", "value": "NewPurchaseOrderJune.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d058bd-d03c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624024575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624024575, "uuid": "91bfccc8-1b40-4d81-8cfb-2c59a25a6387", "comment": "Malware payload (RedLineStealer)", "value": "75b23a1587997b79f9c7a15c52e842bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624024575, "uuid": "f58eec9c-7a79-4ea9-a181-a06230752054", "comment": "Malware payload (RedLineStealer)", "value": "e62d1affc9dfd08ff03c48084d6d693dd57c2c4675944a17c4999de4f2073fb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624024575, "uuid": "15973f77-f7bd-4bfd-b0c2-c6767e9f3c34", "comment": "Malware payload (RedLineStealer)", "value": "3c0408234ef71d62012b65b85dd4b883d43931a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624024575, "uuid": "da1b0919-6e5a-4cc5-a053-2f6b5039e4c8", "comment": "Malware payload (RedLineStealer)", "value": "a0ad6c46559fee92f76cbd0d8c8abea3147ae4d2b540dedfed0268c6edbc398392d6583796864499657809039461c0a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624024575, "uuid": "6ad3aef1-5e7e-4174-a73b-9aeb426f538a", "value": "8A84AE10FB90C035F5F612F85AB6C3B9A93C7AB1576490CF62D51AEA5634AE0EC3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624024575, "uuid": "cd804a6d-df61-4dfe-92bd-5dbf0982d8a7", "value": "41601b6802e3e38dfaeac494532218f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624024575, "uuid": "8e5d378b-5679-4d97-a337-7af6531fe5d0", "value": "6144:J21C2nrs4vZ2bMCVbH2aHzPeTguf+a1U7W766uO83Xaavempio9DH:AC2rs4R2bMKbZPecuGp7466ujaavdUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624024575, "uuid": "bd1a12a8-9702-428c-b946-d15a24c6cbca", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624024575, "uuid": "e688c38d-d98c-431e-94a8-f8008bb0b326", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624024575, "uuid": "a41512e8-b542-44d0-8058-57854d8b2874", "value": "75b23a1587997b79f9c7a15c52e842bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f6a849-d026-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624014782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014782, "uuid": "2a74aee5-eb4d-4f91-85a7-7f7e0beb22ac", "comment": "Malware payload (Mirai)", "value": "eb59ef4b935cdcbd3048c224321e4871", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014782, "uuid": "31301a00-9ff0-4153-9c54-460c57f00bde", "comment": "Malware payload (Mirai)", "value": "e71e38b9932613b2f37e531848bde395557cad80cbff3bb8bfde093a60144e00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014782, "uuid": "95d0b6f6-83fd-481d-b0e9-f1e91d6acded", "comment": "Malware payload (Mirai)", "value": "54a8add3ca0662c069a5d73139df11c8c342192d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014782, "uuid": "8cd86427-ebc1-47aa-9a24-a9ed1b34c77a", "comment": "Malware payload (Mirai)", "value": "694e733a4d7ac0a7fade9811d3785bdfb960495e24e7a500d65787979e2ac846a8ed94e4f5626a72d5aca312de50de3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014782, "uuid": "99002e43-db7e-46ef-b47b-bc9d5df393a3", "value": "68232A96F8829B2AC5D022BAF57F995C376467E4D3CB3227CC601B207A8650F1E63F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014782, "uuid": "23b173f6-c046-462d-babb-b22f85fefa38", "value": "768:FGg7wgy62tyWWEUgpdYNlciq5HtfA/iEQQHpYPf+QskU41JpXJxhoajXqZY10U45:326EUgdYNlGS/iEZHpwD5Rj6a10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624014782, "uuid": "2139d48a-cc5f-414a-b3a5-284f716bc8aa", "value": 47728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624014782, "uuid": "b1e53288-6f64-4eb1-af6f-df309defa462", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014782, "uuid": "fe9eaa72-f4b3-4cef-ad4e-6b3b24b8ec82", "value": "eb59ef4b935cdcbd3048c224321e4871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5fc611-d047-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624029240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029240, "uuid": "c9678661-c79d-4203-83a3-f4d0a6bff55e", "comment": "Malware payload (AgentTesla)", "value": "1ed2f336f8999aee6a9a4608d4ce12f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029240, "uuid": "6307fbb3-b3dd-49fc-89e0-e5ee2cb6bffd", "comment": "Malware payload (AgentTesla)", "value": "e760efcf956cf894cad3ef31de4120a29c486343fdafaad816dfae9863b2e4f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029240, "uuid": "fd9db81e-087a-4754-8b7a-f041ceca8790", "comment": "Malware payload (AgentTesla)", "value": "85072ccd6d3864934c329345d0dc7e65c35d59f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624029240, "uuid": "bb7b9f48-1aac-443a-a229-1e1277f2a6f1", "comment": "Malware payload (AgentTesla)", "value": "af47f426a57b2254d57568c454cdc25d4478ecd081f266d71af08e9f557d98e6104f33c0ba426f0d1c51b5b3a888dc10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029240, "uuid": "ec3c0128-77ff-47c5-8814-e947a1a12547", "value": "D10523493C18A63A537FB0B2C7E3D08EFD6328595DE6BEDAD6C451A80FD4661A60C0D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029240, "uuid": "a0994fae-24fb-4544-8c72-ebd189e8ec3b", "value": "24576:aciiT8JjlZL4q0zCPcDyMbedoMZkmyHnhHIYtbWyX:aciTJqq0ciyMbeCM2lhIY57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624029240, "uuid": "bf2159d6-c96b-4e21-8bb6-13a0ca0b76ef", "value": 857208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624029240, "uuid": "7d7f1298-cb64-4001-929a-b28a3b6efe3a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624029240, "uuid": "3d19233c-a36f-4027-b621-a56ee49dfd6b", "value": "NEW ORDER \ufffd121120.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783c6d03-d045-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624028235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624028235, "uuid": "286d218c-288f-4d0b-b051-f3895858aa81", "comment": "Malware payload (AgentTesla)", "value": "d6f8b4eb1bc65eb2b7ee4c116d9f86da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624028235, "uuid": "b4a21b82-20d9-4087-8522-fda075cc11e6", "comment": "Malware payload (AgentTesla)", "value": "e78679c174a35f19fc3692d57bf88660505caef2df84710bdaca7800e6cf519e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624028235, "uuid": "bf62260e-9c20-4ba6-b807-cc402c259a42", "comment": "Malware payload (AgentTesla)", "value": "e4d7424274f9b401e02f17fbb5bf80694840581d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624028235, "uuid": "c22fca56-2624-4538-9173-1be71e95ca4c", "comment": "Malware payload (AgentTesla)", "value": "f76524c1f206f0019e7f101c06646565491bc96cfc1dc4650a6cb5c4ac319db4da2025b55983e6615409c30792804684", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624028235, "uuid": "9bb88a8f-c2bf-46ef-9ef6-81237f8d431e", "value": "B625AE2476E95B18F03B9B3941B0A5619BFBBD22A331D45D3CD5368B2A33F81CA50637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624028235, "uuid": "2c0b7ac0-bf8c-46bc-93dc-7793f7821657", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624028235, "uuid": "d0b986ba-29c8-4474-88e2-4fa9a0ddb1d9", "value": "24576:L3DD2/qWMR2X2X2X2n2X2X2M6jrJULvZGIVazLP16ATj5nSoD:Lzv4mmm2mmPj1ULvZxVazIAn5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624028235, "uuid": "b0cb73ac-cfc5-4313-85b4-00999f4bd7fa", "value": 1017344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624028235, "uuid": "f157bd41-ce83-4789-b9d3-32785e8b2839", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624028235, "uuid": "fae3118f-2aaa-4e53-b938-faa0e251113f", "value": "Payment Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8473c489-d025-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624014511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014511, "uuid": "9dff06ae-b4bb-458e-a402-785c2b74f495", "comment": "Malware payload (Mirai)", "value": "57e968270e627d85118bf3b65251b4d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014511, "uuid": "d1589de9-df86-4ea2-afe8-a52a93671d65", "comment": "Malware payload (Mirai)", "value": "e7e86d32640f228746ff795acf618fc63731f69c4b37d71517b2e6021e0c08dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014511, "uuid": "6b81ad64-10c0-49cc-96fb-2d4230c30a6b", "comment": "Malware payload (Mirai)", "value": "302c26f032466fff5b5cc49eb0529a58d90a9972", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014511, "uuid": "f6240547-6d1d-400b-bb00-ce5b93686490", "comment": "Malware payload (Mirai)", "value": "62eec2e8e91a54165771eb4f359bc1cfa8b564b128233fa0271a5d2ed2dfcd51fdeb735305aa556c394ae371d2cf2845", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014511, "uuid": "e424dc3f-3bba-431f-bc26-92a3c74b247b", "value": "C1736DD5B8019E7CFD4FDABD81224A08F62162044FA30F27A667FC932DB2195BE47D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014511, "uuid": "2a298f4c-bc3e-4f7c-b3ef-cad9e4da7434", "value": "1536:N57NlmXuoShuGzMciq5vfCkA66Ch1JiozjP6JIucfAOre8EK/1:N9ruG1XNaozfyeAC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624014511, "uuid": "58bc6f92-06e3-47d6-bbd1-b7b60b189ecc", "value": 80304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624014511, "uuid": "20181b4c-2bcc-40b2-a17f-3d30611c489a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014511, "uuid": "76af2bd2-af6a-4329-83ad-c932f72e5f30", "value": "57e968270e627d85118bf3b65251b4d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817d923e-d045-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624028250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624028250, "uuid": "e24ccf45-2af3-4e9f-ad0c-8e2c2699ba0b", "comment": "Malware payload", "value": "b90f568aae8a78f64ae1c66e237d1806", "object_relation": "md5", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "tag3", "colour": "#B2ECFA", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624028250, "uuid": "78c9b9c5-7727-4110-a377-aa467739f6e9", "comment": "Malware payload", "value": "e853d9c82d49a6002c2604162132d1971ce7ddedeb7ece40c5d1630b058dc843", "object_relation": "sha256", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "tag3", "colour": "#B2ECFA", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624028250, "uuid": "ce95f4c4-4e17-4a61-a1df-2f219ba38362", "comment": "Malware payload", "value": "b31423f7498be29e05c359b6b2e2309b23d98771", "object_relation": "sha1", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "tag3", "colour": "#B2ECFA", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624028250, "uuid": "a3966d0c-0e68-418b-bfad-d2f6fd07f51f", "comment": "Malware payload", "value": "55b4545b1f0ba531f7346086b150eb4e1d6011f4b110849cf96e6d6c20b43aa5790f83f2b7b9a3ef0968654811473203", "object_relation": "sha3-384", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "tag3", "colour": "#B2ECFA", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624028250, "uuid": "ef04c217-2deb-4301-8926-bb169a4b4222", "value": "3:YrtzW2tNTv:YFrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624028250, "uuid": "cb72641c-a7a0-4e45-876e-0e6aa973c32a", "value": 24, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624028250, "uuid": "1e5f3e5c-940f-4340-831f-613562f7e828", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624028250, "uuid": "87c9ac44-3b9c-4290-ab3b-66d098499c3a", "value": "malbot2.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899e586e-d006-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1624001206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001206, "uuid": "e0dd6a48-8fcc-4967-817a-dd7fc14fcdbf", "comment": "Malware payload (Glupteba)", "value": "39d550fd902ca4c1461961d01ad1aeb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "Klingon RAT", "colour": "#B848F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001206, "uuid": "4e195fae-436e-416d-b206-912782716b90", "comment": "Malware payload (Glupteba)", "value": "e8eea442e148c81f116de31b4fc3d0aa725c5dbbbd840b446a3fb9793d0b9f26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "Klingon RAT", "colour": "#B848F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001206, "uuid": "d05ad690-70f7-4e85-bf9a-849f48b6231d", "comment": "Malware payload (Glupteba)", "value": "cae1d0d39e4341c924c21509007852d093c57c91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "Klingon RAT", "colour": "#B848F8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624001206, "uuid": "7e707c70-556c-40b1-b5af-3ba34347d3ea", "comment": "Malware payload (Glupteba)", "value": "c0d700a2c43013665d3df4bcc5c76ce3e325fe3f253a00207bb691720697ed78a36793648c35aaf4b3376aca6279233c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "Klingon RAT", "colour": "#B848F8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001206, "uuid": "def46a75-2087-48ea-93f3-93897c07d902", "value": "F0868E43FCA514F9C6FDF13082659322BA7178654732BB831F9496AA1A66FD4BF2D300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001206, "uuid": "2c4a7dec-3ddb-4916-84d4-4019b40c7afe", "value": "91802a615b3a5c4bcc05bc5f66a5b219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001206, "uuid": "c8e703a9-6193-43f7-b424-9355781c3adb", "value": "98304:XR7s2d+ls5zFL9VPwkCou0+W4DN55JyO7yICuUpjamDWt:XFs2d+ls9FL9VP1CoqDN5yOrWaHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624001206, "uuid": "fd795706-2e35-4b84-8d5a-dc8b7c9f58d8", "value": 8182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624001206, "uuid": "b1a40b19-2388-4d3e-9b6d-6e6f62c9be07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624001206, "uuid": "4bf4632f-3420-42c9-8124-9aa5486333de", "value": "e8eea442e148c81f116de31b4fc3d0aa725c5dbbbd840b446a3fb9793d0b9f26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08eab671-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623976938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976938, "uuid": "c3860e2f-9a0d-4500-aa4d-cebbb11beaf7", "comment": "Malware payload (RedLineStealer)", "value": "4828c0dd532520a0178ef12e11ad2a2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976938, "uuid": "dff486a5-b365-494d-afe8-24bcbc0f5dd5", "comment": "Malware payload (RedLineStealer)", "value": "e9f1bfdfb6c8229f57b9bec5149d4dc3af2c148ffb694d8ae32ceeca1530d1fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976938, "uuid": "bdb3bd63-c7ee-42df-b764-b3b63decc7fa", "comment": "Malware payload (RedLineStealer)", "value": "fd903bf1e4cd25a375c8509b77bf477d3f010211", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976938, "uuid": "1f867bc4-dc76-4754-a4ac-d6efcfd90fd0", "comment": "Malware payload (RedLineStealer)", "value": "568ea53ba8150f7583f37cb47a226b581b3f9775287a1e1b7f3deae5f8a19721a36cad9719a7be55de1f05ef7062585b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976938, "uuid": "cc056cc0-66b7-4a95-829c-6a8e67e0829b", "value": "48F53380FB4092A2F9F421741E4E7B749EBB4DD669A2E4468FC02F0CBF91D64D962F05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976938, "uuid": "9b367c41-dfaf-4586-b82f-566640e179a9", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976938, "uuid": "3814afa2-1f5a-48bf-aef6-e506436613ec", "value": "98304:JTnGDH+SH8W07onTOSZqS09hb2d3z9E1Hnl0iXQJi2OXX14:JTUHTcWFniYR09Ez9E1FFgJiVH14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976938, "uuid": "e3afb275-418a-49dc-aeb6-5034bd5990e7", "value": 3525723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976938, "uuid": "4109b5c5-d387-44c5-8c35-03be9ac3ac32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976938, "uuid": "c0cc9a15-ea71-4e5c-8ff8-13082b769b2f", "value": "4828C0DD532520A0178EF12E11AD2A2C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab6a56b-d018-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1624008992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624008992, "uuid": "3f8b81d9-56a5-4ac4-b63f-42e1729d2fa2", "comment": "Malware payload (Stop)", "value": "3da4bcc864bfb475b0900696ec7a7bda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624008992, "uuid": "1bd7ac02-0b4b-4fae-bf82-001c1ee49525", "comment": "Malware payload (Stop)", "value": "e9fea91bdee139be2c6e16c0ffad9d58287af364f5db381cc6cf6cd43f0426c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624008992, "uuid": "5cdc640b-11ad-4c6f-b491-e49b19ba49a1", "comment": "Malware payload (Stop)", "value": "a42d7274128eac9ccd1511d4b514dc268127439f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624008992, "uuid": "10e7083d-87cd-472f-a6cd-82337bf51666", "comment": "Malware payload (Stop)", "value": "21aefbf0e017eb62ad5fa5350b92a6f32fae06fb91f7d9ce88df030aae700b406c47e71ed0460c755e758f0e819b9565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624008992, "uuid": "409f3725-42ab-4ed6-a699-41e9b58ae921", "value": "15050110E750C036F5B711F816B69368A52D7AB35B6851CF62EA1AEEA7346F0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624008992, "uuid": "7777949a-2ea1-4a3b-b499-614d3df6dd28", "value": "866e8b0fa01ec6fd81db7579c1be52ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624008992, "uuid": "a80e069b-a456-4985-8efc-162d882c7404", "value": "12288:sY0+pb34nZQMnppF9wfage5Oi6+/sHV17vI7aRs+DxBUoOD8kARpYDzSnjcLffBo:skbCZjCoO/7vI7As+DcoOQEim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624008992, "uuid": "c9aff21b-ae13-417c-9a19-1b8fa770ac77", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624008992, "uuid": "b01f2791-65e7-44d2-8819-b98fe8efb143", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624008992, "uuid": "e2beac08-f723-4dc8-a526-9a43eaaadae1", "value": "3da4bcc864bfb475b0900696ec7a7bda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9747fea9-cffd-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623997363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997363, "uuid": "a64c2f07-726b-4ebd-95c9-db1164df4957", "comment": "Malware payload (SnakeKeylogger)", "value": "21ebc4527aecb50fc3adc65b610d3653", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997363, "uuid": "15bf8103-8d33-4379-8ba8-a779a8534dc8", "comment": "Malware payload (SnakeKeylogger)", "value": "ea26039022e9c98e3d40700610f8c28f7d2b1d5f11394e0e22f2a40bf876ea31", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997363, "uuid": "2da01e6c-23f9-4e2c-99b8-9b8cb37c9f83", "comment": "Malware payload (SnakeKeylogger)", "value": "3cf5df8b2e1e670ea2c85eec6f048d0c889bd715", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997363, "uuid": "1ad361bd-9938-4b19-96e0-b9d67fbd416b", "comment": "Malware payload (SnakeKeylogger)", "value": "eca152fb23b2dd3b50db6322ce4750236497dbc11267f70ce56789b373ad203ea9a5826951558ac9242dea8917ec2754", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997363, "uuid": "63e9030d-13e2-4cdf-bd98-e3a0f937f3a9", "value": "1F841254B3D8CB53D2472175CCC2C2DDF621FD22AB86C7873794BB2DA9363584AA6344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997363, "uuid": "4f188c58-1940-4e80-a795-b702b3b3fb48", "value": "12288:QtOMzOH8ZoFzUOcFvwX9eepPZm4c9Tia:QUMWRFzUwFpPe9Tia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997363, "uuid": "37ab2f93-9aea-433d-af7a-f3fe9eb8280d", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997363, "uuid": "572e93d2-8e68-467a-9b18-30f6c4100489", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997363, "uuid": "3210e9bd-8d0d-4087-b95a-9052132ed34a", "value": "EFI_01037508200.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad92220-d072-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624047513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047513, "uuid": "b9fc3f3e-7003-4a6d-abd6-8f63c7dc27e0", "comment": "Malware payload (Mirai)", "value": "3fb629873c93967dbb8031fe54d29ad3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047513, "uuid": "d082821e-9f36-426b-9176-11edac6e9e8a", "comment": "Malware payload (Mirai)", "value": "eaab60b4a2a2299df34db2c4b100f14f52eeec0601d1f3facc5d85d8f872746a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047513, "uuid": "430bf083-ab76-477a-b2c2-2d6cf1843212", "comment": "Malware payload (Mirai)", "value": "07734b8052f9396c4a700947c66cc3458c7ac0cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047513, "uuid": "c066f4d6-f451-40ee-a914-adfd4159e3b2", "comment": "Malware payload (Mirai)", "value": "017c273a65fac51cfa689483d4fadd3b97c02b96b9087a44669766d15fc1347d8111566a58b8afc3df6f57937681800c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047513, "uuid": "b35ead16-d9c8-4c11-8401-b5e670921cdc", "value": "F4C34C46EB808A13C4D51775BADF424A3323E755D3DB33068918AFB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047513, "uuid": "b6b93ee2-6b20-461e-bb32-de334d3e98b7", "value": "3072:+KhtPUfCBPF49iuFcpQe8ZVu6W+WLwM/9TGyz:+KgfqPFSiuFcpQTVa+WkM/9Vz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624047513, "uuid": "41db506e-c3b3-42b0-94aa-0ebe488c1f52", "value": 125754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624047513, "uuid": "47dd9fd5-5cc4-464f-b4c4-cf2a05a1c92a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047513, "uuid": "bf5c2c09-ad09-44b8-b870-7633ff614157", "value": "3fb629873c93967dbb8031fe54d29ad3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372460e0-d00f-11eb-875b-42010a9c0053", "comment": "Malware payload (ServHelper)", "timestamp": 1624004933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004933, "uuid": "8f3f9df4-4e44-423b-a60f-ea5f8d6c5b18", "comment": "Malware payload (ServHelper)", "value": "6774f8a7d95a58ddab16d1c792ec846c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004933, "uuid": "099a027b-f19f-4be9-a782-2facd83bb052", "comment": "Malware payload (ServHelper)", "value": "eb02c967fb3feaf5504a78de8a7e0513c2c4e52ddf2243bfbcb10e83954baaad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004933, "uuid": "60ded24a-8191-49cc-aaa4-b07d168c2427", "comment": "Malware payload (ServHelper)", "value": "562b99cee396d3d22dde68d9de09214dc32a0dd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624004933, "uuid": "51394985-38ce-4486-939b-8b87c12b3792", "comment": "Malware payload (ServHelper)", "value": "246233043a2aaa7baf1def2d76cb02ce98928de143d041d00f5619f7c391a1d18fe0dc3cadcbdf31b6ca1be01546fdc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004933, "uuid": "503f8f63-f53c-441b-b598-e015517a4bce", "value": "8C26DF12B8E214FAC57EE178845293617AB23C6643323BDB2E94B5691E74FD42F3E314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004933, "uuid": "3cb1469e-5742-47a7-9295-a6ee16880837", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004933, "uuid": "66f5844d-e2e1-492e-a343-3758692a6b59", "value": "49152:K8OPYhMTEK3T5eIZCfc2g1KIqspYiB10v03Q3R5j3f/XPxFsfk96U1:K89MTEs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624004933, "uuid": "b48eab7e-1386-46a8-94eb-9d287a0461a0", "value": 4767744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624004933, "uuid": "5d30adcb-edbb-4770-bdad-444853c77cfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624004933, "uuid": "9512da80-879d-46a1-b62b-f8f2a763473a", "value": "6774f8a7d95a58ddab16d1c792ec846c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0697fd3-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623976843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976843, "uuid": "fb3cc83e-f35e-48bd-b1f6-bebc269fb083", "comment": "Malware payload (NanoCore)", "value": "0ee2926b361737508ab8a6b2062eb729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976843, "uuid": "975719c8-1632-46dd-abd7-ad332715d225", "comment": "Malware payload (NanoCore)", "value": "ec0159d5e52a2ec19ae752dbf586cfc66e06f865bb276ca94c401d8f042e40c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976843, "uuid": "93828202-ad8e-49a0-b472-fe676099b5e2", "comment": "Malware payload (NanoCore)", "value": "c0b375cafa971830f9c37b8f265ea618f7ff5355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976843, "uuid": "5a7a6e31-9ae9-48a9-a4c8-fe53e86c469c", "comment": "Malware payload (NanoCore)", "value": "aefa552561a5233b83d7d46939861cf12a3ee6738b3d9d13054b3313571e8fb54801921b9d1b566aec3b89564091f1ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976843, "uuid": "e1378f8c-7538-4b74-8504-cadd0d3611c1", "value": "8264BF92F2C4D893F10319F0D17A5AF5C22B9D3FD8B1158F515C7E38B9B224A10AAE79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976843, "uuid": "0276c65d-2e02-44fa-9300-4a13cd85cd1c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976843, "uuid": "085557df-d8ad-4259-b805-b82f7be12ba4", "value": "6144:cQqCn7MUINx4xgoZLcHKx/wUTkE8PRRtsPcpKZox80TkM1+t:vMHKmKpTkx1tKZolLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976843, "uuid": "26ed8bdd-d155-4e38-9686-75cad4c0d168", "value": 328088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976843, "uuid": "d1050731-88a1-46b8-aa7a-fdb8c2be48fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976843, "uuid": "d2272491-8929-4e3a-a5df-282460473a56", "value": "551231009876500pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d778ad80-d04f-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624032690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624032690, "uuid": "d9bc054b-141a-47e8-b4fd-310d74f24325", "comment": "Malware payload (Loki)", "value": "a2a900d4a2dfb45782fa41541b13255e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624032690, "uuid": "3fadaf63-bac9-428e-98cc-09b09015ef8f", "comment": "Malware payload (Loki)", "value": "ec66715880d356dd24d4a5e4b9b5b4ffebc2784ffe38870ec2da03fe226be33b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624032690, "uuid": "6209d6f2-d1d7-44b8-93a8-6772644774a8", "comment": "Malware payload (Loki)", "value": "aff4250c24d5a1f89ca8cec551175791a064d53f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624032690, "uuid": "32f83094-40b6-4f1b-9b97-fa13fe0d01f8", "comment": "Malware payload (Loki)", "value": "03c867ad22cd662f8803aab0b540eaa841aa4829cb164962d06abdfb4de860426456061c333d1b8cb701de7c7d9251d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624032690, "uuid": "4c13e551-505d-4c3b-ae88-0cef3bba9f7f", "value": "56B4BC327112D22EC637C5BE6811E489BE230E270DF6562E27C477FD197B621B631B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624032690, "uuid": "c7d49715-9003-4689-aa27-bce72243a5d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624032690, "uuid": "adcdf317-8d07-471c-b5f2-454a9c033a51", "value": "12288:Uk4uDEynAPLtEJIHVk13AzCCW1zRnWaI2i2:f4BPBEgCAzC518aI2i2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624032690, "uuid": "f7198d6c-ecde-4c9b-8d29-f52b4088accf", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624032690, "uuid": "baa19bdf-4f4b-4a16-8b93-6e0d1d9ff0b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624032690, "uuid": "a1267f87-a7d6-4015-81b3-47ff8f485b71", "value": "Master cash denomination & doc.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff8d264-cffe-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623997915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997915, "uuid": "34d24c01-c116-47e9-b810-0065876b4b9f", "comment": "Malware payload (AgentTesla)", "value": "617e57239803d0a401c349e7bc6fdcc5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997915, "uuid": "e8fe9e50-ff40-4cb9-9164-16340bdb4137", "comment": "Malware payload (AgentTesla)", "value": "ed009316b371031d55361c07a79ccdcadb0c4377da38e330c614f1c27aa73432", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997915, "uuid": "0e76b30f-c623-4143-90be-2d1a523c5e37", "comment": "Malware payload (AgentTesla)", "value": "a906bf6502a670e7edc8bc9f1806df78dd10734d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997915, "uuid": "7aebedfd-e94d-4049-a5e7-6cd0ca69bf90", "comment": "Malware payload (AgentTesla)", "value": "90702caf4ddd6c3b47c244ad5dbe74df35b18b5e9052fe5bbc97723286c77c088a419d88f6893af85ebb45beff460923", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997915, "uuid": "6b2276d4-2d5f-49d5-960e-6f82b0a3a65f", "value": "D045BF122DCE855AE1735EF60BB9FC5182767DAA2204D21D3EC1322EC573386D8DF61A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997915, "uuid": "7d3bb646-ddd1-479f-b6ab-f3ef505a2755", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997915, "uuid": "811bfb2c-7830-4767-951d-2f26adc57227", "value": "12288:Hsehlm4S4F3M9ynSMPQipP599krhsd0nu1ViHsPlQHUXnFBof0NYCXakEjSiyyjK:HsqWdip6NI0u1ViHsPRXn0f0Na7jd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997915, "uuid": "ed27fee6-0b7f-4fd2-9df2-6fa2b97e694e", "value": 1262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997915, "uuid": "f6304677-ec3b-4215-917c-69c04af2342c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997915, "uuid": "191ba869-a9b4-463a-8502-c9d3ba82d5b3", "value": "NewPurchaseOrderJune.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c7df76-cff8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623995299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995299, "uuid": "6d42c2ba-5000-48be-8d8c-9649efd3d33b", "comment": "Malware payload (AgentTesla)", "value": "d433a5ea0c5fdf9aedb081120cc40788", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995299, "uuid": "6f400d97-5f47-44a9-a879-1376924cc4bb", "comment": "Malware payload (AgentTesla)", "value": "ed5763662cab2ac5ba8c629f7962bafce36798a1eb84c5859cf57a4c27b413ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995299, "uuid": "7405dace-eb12-4fd2-8f63-f06c2d70b222", "comment": "Malware payload (AgentTesla)", "value": "f085e477d9a3981270fa2f55ff672a709c2d272a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623995299, "uuid": "17b7311c-efee-4393-a4c1-cbaed1482812", "comment": "Malware payload (AgentTesla)", "value": "a99f590e81894554b8fe6954787203c7c219caf7ca4adfc682394faa4ab8b43d34cc22bf33f3c0514b823c80e7f8a416", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995299, "uuid": "98963b70-b7d2-48e6-a32b-e203f02c66eb", "value": "9025AF221ECF4229F2769FB557B0BC8782B66E663705E2153DC0329DCA33599CCDE621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995299, "uuid": "985b19f8-34fe-4931-ad3b-a0f2f5160466", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995299, "uuid": "4684d28a-8161-4292-8ec3-8bc229815d7f", "value": "12288:s4hlm4S4F3M9yHSMPQipP599k9Ge2IrqWxRvC5AN5NWbSct/gaIA:sQWBip69GZZWzCwYPt/gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623995299, "uuid": "63f0a105-0dec-4a1b-888f-41655beb82ab", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623995299, "uuid": "f7e0c404-02a4-4d6c-b7be-5e50c3106ce0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623995299, "uuid": "791a5b33-cab6-4878-b751-c5c2f5f9ccbf", "value": "Order.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1252056-cffd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623997407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997407, "uuid": "360331a9-d6f9-43c7-a79a-e83c78b43864", "comment": "Malware payload", "value": "09727593446a5003a833fb6ad80fff68", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997407, "uuid": "eb3cfece-eecf-4533-b524-9f71b7812a05", "comment": "Malware payload", "value": "efa78d9ed272969fb2ac62b355f0b9532d20d26ed47d87e3c2d5f1e4b67bbad3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997407, "uuid": "61094110-231a-4c09-b098-49577a52d005", "comment": "Malware payload", "value": "ec07a60874477f99a7ca4c9e704fbb9a82e72aa0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997407, "uuid": "e50a345b-06fd-4a09-a522-1f312d6238b7", "comment": "Malware payload", "value": "8e8648f0eea920bff85350bfd61ba9b3d0978163e762defb146c0ecda87c542658086d368c09a9ad43ec81cd27cdfbd4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997407, "uuid": "6a148708-8399-4e18-8a0d-464999f4796c", "value": "78D25D03B3D9DE96F65245B24DD3C286762ABC6D9E16C20F33407F0EBCB46718A22795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997407, "uuid": "ffb03090-65b6-41f5-b37c-f7cf78a295b0", "value": "192:wDYl3VKM6/6rX3mSBqEvS+ay7JJRIgw7TT50jAIBMtZRa:wDU1iSX3mSBqEIydggIT50jAIet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997407, "uuid": "ed31ab2b-fe38-4662-8096-6533e244f324", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997407, "uuid": "108a46ee-942c-44f5-9d14-7526fc26428b", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997407, "uuid": "2cc1737b-efee-4e67-b596-c3fb44189593", "value": "Facture_17062021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ff8f664-d014-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1624007176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624007176, "uuid": "8b085923-6204-4d17-917a-64d604a78606", "comment": "Malware payload (Stop)", "value": "e8547fc2e60d569e6eb845af8e466db1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624007176, "uuid": "60d24adc-ab09-48fd-a59c-113fd81b2983", "comment": "Malware payload (Stop)", "value": "efea143be3ceab5b1dd8f0ddbc1c9ed6718e0fb50d6afb344410943ede43c562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624007176, "uuid": "44328844-fc09-40b2-ba93-8966593a013d", "comment": "Malware payload (Stop)", "value": "cae29c3a373b58e92d9e83572b5b7763e61789d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624007176, "uuid": "d27b09e4-1e51-4cf3-a3cb-dde15cc73e9f", "comment": "Malware payload (Stop)", "value": "c60367161341eba4c48c8dd0639d45d929514003af208c9393984c0f77071c29da5aac0a9fbd2358f3fa9545f97ccca1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624007176, "uuid": "634cd105-1669-43c9-b34d-8cd6d87e180d", "value": "E9050100B690C034F6FA11F929B6C368AA3D7A725B2851CF52D956EE67386F0EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624007176, "uuid": "a5c941bf-2fa0-4f62-980a-86450b8cab03", "value": "2eafeef859f65494b1ac6742c31dc4b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624007176, "uuid": "735d5fe5-3ac8-47da-bd14-8a44f097687d", "value": "24576:nxbxJJeSmANq9nkSt//6N3mcMlDzyMXaAE+E6W:nzDm68//6NWcMlyMXU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624007176, "uuid": "2d7d921f-bf77-4802-ab35-4285a99d58b6", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624007176, "uuid": "99978e96-2dfe-450e-8270-c35ead05d5fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624007176, "uuid": "00dbf2e7-a3f9-4200-a8ac-c391e2a1b90b", "value": "e8547fc2e60d569e6eb845af8e466db1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca1809a-cfff-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623998204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998204, "uuid": "8b2b7813-81b2-4367-bdf0-8ae008015bc1", "comment": "Malware payload", "value": "af2dc3e8cf4bc123330702fa51684fe0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998204, "uuid": "48dab6bf-828b-4e88-bd87-4187371b21c2", "comment": "Malware payload", "value": "f1258dd6c77b95289aa79739395372a7640878b12acdbda66c3c58338a19e9ad", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998204, "uuid": "45e98e28-8c60-4169-a555-47da3d68228a", "comment": "Malware payload", "value": "826495aff83857ab5317f2c99d3e3dcfb5351838", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998204, "uuid": "624b681b-8503-4bd9-91a6-4e43317621ff", "comment": "Malware payload", "value": "f22966f9509c5b185d70c8a47e8ad062f3173f41107475ac0905af5d85e6c073655914a31b1a44622c238d39b349b936", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998204, "uuid": "960ddb0f-d89f-4f8e-b7bd-21f03930b807", "value": "33C4078539BD7527D372E924CA019E65A864FC131C9713E26B863F46DE7DCC01AEAE30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998204, "uuid": "77fa8474-1fd9-46b1-8b74-2caba820481c", "value": "6144:Lg9B1n730P/PxYe1MqNP8FRoCRTWq/wS3jZDJHimRzEqvpucvmaqfceb5:rfceb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998204, "uuid": "0a888dea-2864-49b6-9112-7d7a02489a5f", "value": 566279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998204, "uuid": "d08edf5c-5b06-4fe5-97f8-c1b2ee240e4b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998204, "uuid": "3ed351b8-adb5-4ef5-a2ec-c9a81b2a67e4", "value": "Solicitud.PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b42b42d-cff4-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1623993370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623993370, "uuid": "f1878054-49a0-4ae7-ae9a-cd0c56700683", "comment": "Malware payload (Vjw0rm)", "value": "9962eb28b9bc0bbc9352716673d2475b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623993370, "uuid": "5caecc72-1f55-481e-a407-9672ab09f997", "comment": "Malware payload (Vjw0rm)", "value": "f22945e84a4a8dc6ec66734fe9028884f8929fd6a862b1f65eb6de5d96ba8119", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623993370, "uuid": "a749ca14-95d9-484b-a822-44a8f4ca98db", "comment": "Malware payload (Vjw0rm)", "value": "bd13e8fba4a7d087df8cdc51da3d1f185c25fe40", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623993370, "uuid": "1b56d186-acbe-4a3d-bf66-22245def7194", "comment": "Malware payload (Vjw0rm)", "value": "20d10ba8b65f58adca529fc3b9c0cd80310edceb26f0ca62ee913d2d2a6294292ef86558ff9623d7b67a86fbee0967e2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623993370, "uuid": "bcbe60b0-49da-4aba-87e4-6b9a5e8f6671", "value": "9174DB458ED04C1BB7B1C20794E90D52CD1365F2CB6EB54BD0C5D6BEBE9A223730BA1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623993370, "uuid": "88889674-76cb-40d8-9910-9178676234d7", "value": "768:inaFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFTKu4crJd01LdUy1t:inL9S+BZ1XsOyolaRw6iVP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623993370, "uuid": "74b2ea65-0947-4f42-9078-7e6a3172e9a2", "value": 343832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623993370, "uuid": "2af9fa47-89a2-4be6-b5b9-157f702c29c4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623993370, "uuid": "7fc899ac-67f1-472a-a1c7-22078f01f267", "value": "ColisFR512562J01201.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd4ac37-cfeb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623989512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623989512, "uuid": "dfdc0384-9914-4b32-b532-04fea66bebf5", "comment": "Malware payload", "value": "b6ba52508561cfb5fe75d151ffd3c7cc", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623989512, "uuid": "d01dfa39-fb02-4e84-982f-f708680bb727", "comment": "Malware payload", "value": "f22ee649e4377d819c87af15623076bc6a28aac49e6d99cf10c9a81d9df766b4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623989512, "uuid": "b0b3e72b-40a6-434d-b4f7-eb682f030cf7", "comment": "Malware payload", "value": "6419e4544e2679e183bf0b5820423b41a0571cba", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623989512, "uuid": "eb92ea13-515d-4424-9109-eded4471f52d", "comment": "Malware payload", "value": "2cc50897a734b258e8c3fa7d136aed38b9fc278ffc2c6edf593bdc4d238dd35c44afe80b9fefdb1e40f0b36bb3bc5d52", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Vivo Chegou", "colour": "#8F6522", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623989512, "uuid": "bd9d1e87-aa41-41ef-9480-e0df457ecdee", "value": "E206E211D37279DCEA67A27FA19D0FC08511E4F4A519EA2B233C2BA59FD020A71F3953", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623989512, "uuid": "a427d1d3-29dc-4d4e-af6e-565fa670baea", "value": "49152:hlNvY5AgxTG7Eva9Hme/qYt3wwZi63P3sHZI/5mG+K0tL0crKj40EfJJT:1Y5AgxaEvYGQqYtnP3P3sHS/Sh0HA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623989512, "uuid": "b00bd0c6-0242-4bf1-a5de-5ab394cfd437", "value": 3939328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623989512, "uuid": "b64afb50-3c3e-437f-8ceb-bad645c272ee", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623989512, "uuid": "784a931d-d77a-4ee7-a3df-4fcc37243bb7", "value": "seudebito9896642cqyrs9th nmbofm.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d563c94e-d002-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623999615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999615, "uuid": "0cdca8cf-f842-4879-9c4e-02f9f23f6341", "comment": "Malware payload (Formbook)", "value": "459c59759b4434de04f7bda083ae2a9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999615, "uuid": "48d75af6-fa3e-4e76-b1df-8f46f52d51a5", "comment": "Malware payload (Formbook)", "value": "f4ceea0a1881800f657906368b21c25ebee2c6ac3c7ae210548b1dea0ccd420c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999615, "uuid": "696415c8-325c-465e-91ae-8d80d61501d7", "comment": "Malware payload (Formbook)", "value": "ab97294020b47573bdfab4739d00544d7be504f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623999615, "uuid": "106e404b-052b-4940-af15-32286a979aa4", "comment": "Malware payload (Formbook)", "value": "89e32502b0b4205ef03fdf41ecbda6ca14c9664ce3c9d12c2c5f025c7ca31259973056ff09a61289bce26e87cffc7d4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999615, "uuid": "2f815157-26a4-421e-9244-0b6d66d05b8c", "value": "6D2412278AC4E4BBE255423113B39B7AC7BBB7115630382F33699FB89D262439F27141", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999615, "uuid": "318c1613-79bf-4133-96b1-fcba95e6762f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999615, "uuid": "b6b05813-19f1-4285-96cc-fa74f053f803", "value": "6144:cQqLKGhfSrLjrOir6uJZVfL/r6T5IFMQ6f1H+2it:KRAvrO8Bg5oMQ6f1H+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623999615, "uuid": "b83a279f-cf4d-45f9-a68c-647df7644b30", "value": 218976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623999615, "uuid": "8dbede40-bfc9-4f65-ada7-29044d8ad6f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623999615, "uuid": "56faaf5d-6930-4b71-b815-acaf8ed716b5", "value": "459c59759b4434de04f7bda083ae2a9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db019a40-d02b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624017234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017234, "uuid": "f47dea54-4ec7-4b89-b7a0-e506bbaf281e", "comment": "Malware payload", "value": "568048d4054000db4e9121ff6e92ef0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017234, "uuid": "05a06885-5a74-409b-b7bb-df4a6ae2c11b", "comment": "Malware payload", "value": "f59cb970f5a2f336ee8da0abc8eb81f4236e1282cafeb3ec7026808b415164fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017234, "uuid": "a72b1b91-f317-4b4c-9d66-37702d4e8c12", "comment": "Malware payload", "value": "cac9bc3de3b3d6a6b4124ae7d4bfc3f10af46b8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624017234, "uuid": "f82c6e8b-909f-4866-9a10-da519c3ad231", "comment": "Malware payload", "value": "7ea3898bf266377eeb6d93b827de93d81a4e8bc50705a1e6d3ded7e975fe3a0214740b81dc45a22dd0b1fc890d1f16a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017234, "uuid": "64258171-3c6f-4897-abef-97cd24e2e7b0", "value": "C782BF2551E65B35C7F4AC7D8E3C8482A2960F7462FA33A21A5006ACF26911E2AF91C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017234, "uuid": "3d2b5f79-9d68-46a8-aac4-ee7da1fe4190", "value": "384:GfHsxnVTGahxArWfpKiPELiBrqdJbXIKOtps7/ilaqGhymdGUop5hC:YHqnVaSxArWRVnBk5lF/YfGs3UozY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624017234, "uuid": "06b625ac-9344-4665-b4dc-e7ca8509a957", "value": 18092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624017234, "uuid": "067b039f-e88f-4c42-ba6e-ddc0827f9e16", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624017234, "uuid": "ca9e5733-7b7d-4505-9595-d55f9dba6cb7", "value": "Samael.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a7c15d-cfff-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623998164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998164, "uuid": "72dc681b-87b8-4b99-804a-1802e2211c5f", "comment": "Malware payload", "value": "3520b7cccb287be20a11b3606a2a2150", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998164, "uuid": "0d432ce6-a8d1-4be4-b696-6ffabb49facc", "comment": "Malware payload", "value": "f6654a97a908ce8fc42f3b6dbcd5820a66c63d57c78fc1e2b3f18546da76ae0d", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998164, "uuid": "2fd0d6d2-baed-41a6-acf2-a181467054a3", "comment": "Malware payload", "value": "7c34b9a7b2b700fb3cfc1c5e0b96e65e629d0b03", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998164, "uuid": "a15db614-a186-46d1-b401-86db506f534e", "comment": "Malware payload", "value": "8190b144e9c03f79039b128c003c878ac822f4b35f4cb5a6e6cfce85a673649cf9389492f2f52077c4cdfce9c5955752", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike_Beacon", "colour": "#7221DB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998164, "uuid": "fed0c80f-a034-4d11-8ebf-45576ce6d4d6", "value": "CC24CFDF4876742D40F0A56392AE66C1BADF8E98D400C559F7A8E58F9C024C3CEAFD64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998164, "uuid": "b322e1e9-cfb5-4a12-900b-9b3b954d03c0", "value": "6144:tVDbn5Z5hLp1UfgmSY0o7hpF+7Tw0LLLL54SLCz:/D75L+YmS9qh23ESLCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998164, "uuid": "c6ac39f7-160d-4ccb-b579-c79e11e66ff1", "value": 210001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998164, "uuid": "d6873475-4648-44df-b4ca-645305ba48c0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998164, "uuid": "c38f7c1f-a9d2-4ca4-baec-bb7dacda07cc", "value": "ba0b0bcb-0e95-4b06-8936-351fb479395f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec4c77d-cfff-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623998396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998396, "uuid": "b6e1bfa3-610b-4499-abf7-d172977e1aec", "comment": "Malware payload", "value": "316090355c0387c90455d902c703c817", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998396, "uuid": "7b788612-a9e5-4ac3-8943-46f0cc823565", "comment": "Malware payload", "value": "f6e3d1e06bd21bb6f68c5c4ecb6996d54a92f96ccb404adb7a9449223a248e0a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998396, "uuid": "afb328e4-0c42-4351-86dc-e55c9619b5d1", "comment": "Malware payload", "value": "f7238706c2bed1befce66c18bcf17936b1849c75", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623998396, "uuid": "cf95580f-1be8-4cad-95ff-2789ed0dd173", "comment": "Malware payload", "value": "40bd09be8a91844e6611fd1eb5aff46f17e9809d68a9208d55ff652bf0e092129a12fe6312ca44cc0a95662f28bfae9b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998396, "uuid": "ca283b79-5c9f-42fc-974e-f4ae94432405", "value": "FBA556F0AD01D4C1F57E5B6AF2FD3A48A1343217EBC94A4A00E7E6551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998396, "uuid": "ce72ddee-e0e6-4e5d-9d2d-41029f6c067c", "value": "12288:j9FUHnrtIJBa/BtfOLaZQWrS+H8UErBQLeugD72F5XIAQwP3mhzi:j9CGJSfOLTmwrOgD45XIAQwPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623998396, "uuid": "b124f2b5-b07e-42e1-81c3-3ec36311ff2b", "value": 2118097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623998396, "uuid": "77faa290-3c9c-4fe5-b92a-20d0e85153ca", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623998396, "uuid": "a0f5963d-bc01-40ff-8af8-0d615f63fb34", "value": "document-0798.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef02612b-cfcd-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623976895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976895, "uuid": "60485f20-25e4-4d0e-b6cb-2d8bda0aba17", "comment": "Malware payload (AsyncRAT)", "value": "f0dfa0409d6c8e321ae87c618523615c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976895, "uuid": "db962893-1946-47a2-b8f1-64b0e07ffde7", "comment": "Malware payload (AsyncRAT)", "value": "f822a951f06c56d5b907aa500c60a832faccbcb603a38a330cd53ad683a7adda", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976895, "uuid": "d21b198d-911d-4d5e-99f6-072c5d03c442", "comment": "Malware payload (AsyncRAT)", "value": "21274a9c2814e7c3407fde7ddc2032cb5f3f61a4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976895, "uuid": "39ebddc8-f053-48d4-baa1-acd74d632ad3", "comment": "Malware payload (AsyncRAT)", "value": "92890950507488a6b8e138c33c9b13d639764f93e1295cf6702165c2d5ff260acb0685ea4962438ce6bf8fd102d04bbe", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976895, "uuid": "2742eb33-9691-4838-b988-a85a1a3cdc7f", "value": "594623336320119EC4D1C8378937FED175F912BF9E82E8B4A5E9ADC166168E5E307893", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976895, "uuid": "df8c5df3-f995-498b-b9c6-7c13134022d2", "value": "0f95a431ac4033f952fb4eecc31cf15d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976895, "uuid": "b5795ad6-56a9-4b3b-abb4-f360a02bb348", "value": "98304:LoZ0bfGCcfG53MEzNwpaJ0kvq/x3lIKbihkUJ90RiS:LoZ0buC+GtMaJJ0BlKKbihrJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976895, "uuid": "30b109c1-0a06-47e0-9b78-dca01c9c336b", "value": 5410816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976895, "uuid": "73451b71-f23a-42fd-ab8a-0829266b2b87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976895, "uuid": "d7cd3608-ed7f-4a76-87b1-6b551167829a", "value": "F0DFA0409D6C8E321AE87C618523615C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880eba7c-d071-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624047159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047159, "uuid": "bf8dc18b-2052-45e1-b0dc-20d1aa01f5d0", "comment": "Malware payload", "value": "a57e4e3a3fa46bbdbc9d803283af3479", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047159, "uuid": "eb8c692f-ea95-492b-b968-c5fa35ba1ae7", "comment": "Malware payload", "value": "f83c357106a7d1d055b5cb75c8414aa3219354deb16ae9ee7efe8ee4c8c670ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047159, "uuid": "b38cdc38-aebe-4f62-b709-447a1f9c02e5", "comment": "Malware payload", "value": "4ede7f018c317ddc6a5f8f935f917621668cb1ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624047159, "uuid": "9a3429ea-49ad-489a-bb3d-0b152101e395", "comment": "Malware payload", "value": "7c292375229bf305cc176d6899310e1dc8a6f08a3c8dd702ac7868d10cd735bc61b47159e54a7ef8b43324039b03a533", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "netfilter", "colour": "#387F15", "exportable": true, "hide_tag": false }, { "name": "rootkit", "colour": "#815EC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047159, "uuid": "9c5a2d2b-968a-4d81-b3e4-20495f3c70fb", "value": "33437E8666A914E9C967E1B4C262961BFBF47452232183CF03B1C5950F733E0EF3A791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047159, "uuid": "a7862606-ac94-4dea-87d3-eb97e470c2d0", "value": "d252001e327cf09463aba69fb4de2125", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047159, "uuid": "925120a4-2b6f-41c7-86c6-7662b5d9e88e", "value": "768:y1ZqCQKy8IYdfWiUelR36ihR6nmRYs5ZjSyrNi7fb:yNyq+4lRX6IH5vi7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624047159, "uuid": "5f3ace6e-6b5d-4e21-af0a-ead55712df5b", "value": 57232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624047159, "uuid": "937c2aeb-3f6b-4160-a093-78bb6bf7ce56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624047159, "uuid": "bd6d7a66-1738-450a-9e6c-9a9e495996e6", "value": "f83c357106a7d1d055b5cb75c8414aa3219354deb16ae9ee7efe8ee4c8c670ca.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0368901-d01e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011578, "uuid": "d227f39a-db8b-4d36-aa38-a0a5d95eb052", "comment": "Malware payload (Mirai)", "value": "d72d0da18d287392736a38dc8ec6aa81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011578, "uuid": "ec602dd7-624f-4c40-bc56-cf161a473cfc", "comment": "Malware payload (Mirai)", "value": "f8d4bfe6f3d38cdbe66a7432e3cd76c34b0938294f94c7247844327f5edad7dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011578, "uuid": "12815016-ff67-4f92-90aa-e568490f388e", "comment": "Malware payload (Mirai)", "value": "d1cfd4f9cfa76c9cae21ab069b98bcae1ad37740", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011578, "uuid": "331d8c3f-df68-423b-b4bf-830dd478f9e2", "comment": "Malware payload (Mirai)", "value": "bd920f0145adfb9a34de67849a566fdeb0fed46dc1fa5da7b50c6d97312d0d8ab490ac39d46cb4d9deaf7e87c5638c09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011578, "uuid": "e1f3e815-820d-4556-b2de-f61f509395dd", "value": "B1C2F165490A6E68C23CC5F4F8174BC327B380BA53EA7101252163BEDD46A1B1BBF8D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011578, "uuid": "f2d5f07a-1e52-419b-bc31-92bd741aa590", "value": "768:mfsZRg6KxWCqpdCpZgoZ7JSX7ni+s3Uoz9GG:mfh6KxWZdCpNHqDijzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011578, "uuid": "26837fc2-da18-4995-88c8-cb7fda438529", "value": 28240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011578, "uuid": "2a5af73d-d4be-4b8f-b969-b7794884cb2a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011578, "uuid": "3fa433cc-67ea-4e99-9ef0-0f99b2e957ec", "value": "d72d0da18d287392736a38dc8ec6aa81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fbb6c7-d037-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1624022169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624022169, "uuid": "7fccdd97-bbf4-4202-8840-0d6fae3023c5", "comment": "Malware payload (BitRAT)", "value": "7a1af81b7398690f33412dbd0eddf38c", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624022169, "uuid": "3fbf18c9-b218-4323-817f-1d85c9adee71", "comment": "Malware payload (BitRAT)", "value": "f8d662b4793a6e20b625f25c0df829dc36162715e6bf99358f937eee8a1e8215", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624022169, "uuid": "73260d69-a796-4454-a844-489045736fac", "comment": "Malware payload (BitRAT)", "value": "b62cc40aea3670a98ce3932fc6155155d9db0f5a", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624022169, "uuid": "564261f6-fc3d-4528-a29b-ca4b75ce8309", "comment": "Malware payload (BitRAT)", "value": "e93d2d8e852e1baa37e080f9311c5cbd56eb0b0ceea0c76ecfe74cf2c7598903f3cb59210c6690a85d455d7b98af238c", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624022169, "uuid": "3c964d9a-05d0-4109-8795-fada27fc9f65", "value": "B6E5225076F51B6AE4B9C7F4076422454BFA352A783EF6084CC7B0DB68A2F419E12F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624022169, "uuid": "557cf4ee-dd69-4fe6-a0a2-25b91efa5a19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624022169, "uuid": "e7b87f74-7637-4fa8-bcf0-dd1ba01ee402", "value": "98304:qXZggawGty/th4xUc6TFlCWe6kjhexhwmybFR/jy:WKgawGtyDHc6yD6Ah6CmyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624022169, "uuid": "ad3298fb-6296-4bce-bdcd-0b5174700ba7", "value": 3266560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624022169, "uuid": "45e0951e-7cd5-45a8-82fe-33750a214d90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624022169, "uuid": "433e3c46-cdb5-40fb-aae7-81453679f650", "value": "Scan.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd453af0-d01a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1624009882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624009882, "uuid": "62d09f3c-0aa1-4a4b-8208-246bd8053c3d", "comment": "Malware payload (RedLineStealer)", "value": "5198060cfe649431d96aefcfd37993dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624009882, "uuid": "54e93e23-c146-463e-af72-e23c48304479", "comment": "Malware payload (RedLineStealer)", "value": "f8ff6367b045148e2c179c8ea5605ffd70f118aa6a8a5dee019599c2a8f78308", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624009882, "uuid": "92083b55-2702-488d-ad7b-153b22b8a04d", "comment": "Malware payload (RedLineStealer)", "value": "b072919b33b235be7d526df38809e266ca5da92b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624009882, "uuid": "966a2aa0-08b9-477e-a1f9-a0027fa7fbbd", "comment": "Malware payload (RedLineStealer)", "value": "34fcc920d7f62cbd51481f7cc6c4b7cfc8c10fa90ca02393958a1ad679c6ba2960b80a50698f72b53680df6a03d1d463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624009882, "uuid": "a08a78c0-972a-44ab-983c-dd306268681a", "value": "A234E0037A7059AFEEED9D72949616F00A316D3349E2E64A31A8731F0EF77004997B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624009882, "uuid": "16a23e3b-9da4-44a7-90a3-cc12e851deaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624009882, "uuid": "e8d612f8-2f19-428f-a018-e733bf833cd4", "value": "3072:d0sPpWsBwAVntEfKKCywFmb4dBK52ZB3Yb85b6+JSZIqGgeeaHbl6iyigO9y/pEu:dpPsHEtI2Z+II5Yu6651CPbgWy/pDbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624009882, "uuid": "fe22c4cd-ab31-4454-b08d-0159e6cd1098", "value": 246424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624009882, "uuid": "a24502fc-cdb8-44eb-b7e4-f65a6d050994", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624009882, "uuid": "3cd931b1-2e67-4cba-92ac-a6b6e8d267f2", "value": "5198060cfe649431d96aefcfd37993dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f0e399-d01e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011586, "uuid": "bd7b75b0-85b7-421d-8264-dcedf32309cb", "comment": "Malware payload (Mirai)", "value": "ff7f026374092e7980c2f14f5ac39df4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011586, "uuid": "1524289b-ce27-488d-b41f-061836d10b1f", "comment": "Malware payload (Mirai)", "value": "f9071834ea6337ad082e8e21427a0424d192d3bf9234189a56aacd8f1e2d2f3d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011586, "uuid": "62f123f4-c0e0-4bcd-a6cd-96a8acc71311", "comment": "Malware payload (Mirai)", "value": "093ce5c53a05e5933e7cceed606017d45217456d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011586, "uuid": "849a7f84-b0b2-4185-9de0-8d0667715217", "comment": "Malware payload (Mirai)", "value": "b292214af1362f11d235168a07c7cb354cf84f4a8a8ac810515b77693418eb92ca1108a79b11f89e89d492b3719c6fd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011586, "uuid": "ce05dd44-34fe-4ee5-bb01-3e3517341cd4", "value": "32E2F15DE2687895C19C1EB2B0CC72BA16D4A280B2CB3F7D23D61DD8632FB5634584E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011586, "uuid": "8ed65036-d10c-4d5c-a083-9366f1983a97", "value": "768:5ved35HQ23CSHF2b/MjeafD1LfiwFzAFH9sHB8WkLWVz:gRQ23SMjxGocW8Wkuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011586, "uuid": "69c0329e-b5ba-4ac0-b7c9-e03f6b96094a", "value": 34064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011586, "uuid": "3bc941f9-2ea9-4449-8891-f14457fe5763", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011586, "uuid": "00721b08-0dfa-4d5b-ad67-b23e528bb84e", "value": "ff7f026374092e7980c2f14f5ac39df4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d4ef24-d046-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1624028466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624028466, "uuid": "b56e8058-12e4-461a-8feb-ec756af8243e", "comment": "Malware payload (Vjw0rm)", "value": "3035bdee68c6e1bb1eafa8bcf6509971", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624028466, "uuid": "c12f10dc-097a-41a6-aafb-885d3aa844a3", "comment": "Malware payload (Vjw0rm)", "value": "f92c0c05477e65b58a98076e65c7d0ff486486c6965f311f387fee950908695d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624028466, "uuid": "32aa6512-7797-477f-a525-9b436adffe8a", "comment": "Malware payload (Vjw0rm)", "value": "7bc78682fe79104c4f8dc4cf5353f572b5957cb2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624028466, "uuid": "7d32f36d-8f82-44b1-908e-be2a1da36bbb", "comment": "Malware payload (Vjw0rm)", "value": "20f55d95116ba9c0ac2fe2b137c841db8670eeab3dbc7c0827f2d2d4f737ce75c1d38910d00ceff4ca9b5e857ab57360", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624028466, "uuid": "58f6ab7e-d9e5-4ee8-b6fe-4587923c3897", "value": "A581209C2C4B823C43D67B8A802DD14DCDF548B47F28D2B6148DDAC5360E9B987B69BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624028466, "uuid": "fce27307-5d09-4a3b-8e6a-1ee0090ef315", "value": "96:SABNo5DAk2c24ZRMHXE6/BIt+Ys+fJgDdQqR7bJyKh/OS4UK:zSp2c24ZRMlBIoYs+fJmfRfgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624028466, "uuid": "d1b3a82f-0f8b-4c07-9c42-7a6530d66ba3", "value": 3877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624028466, "uuid": "d7f41fc1-16de-4e13-9f7e-e7a5a2e53d0b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624028466, "uuid": "1ea4a2e7-a36f-43be-ba97-d510b02962a6", "value": "INVOICE ADP#06172.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aab065a8-d04a-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1624030467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624030467, "uuid": "e359d0c9-6e8a-4953-bcec-ad748d2cce0b", "comment": "Malware payload (Loki)", "value": "c9f5052319c31577f4b26fbcaf3e409b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624030467, "uuid": "09dc134a-8b87-4d9d-9f67-453c4de79d0c", "comment": "Malware payload (Loki)", "value": "f98a75fd01c7f14fced46ece4df5e4eea63780a73c8804d0d9eaebf466b9debe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624030467, "uuid": "9f876212-13d4-480d-baae-276c8f68494d", "comment": "Malware payload (Loki)", "value": "4239bdded62a85d1f916369c381e49eec89e8331", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624030467, "uuid": "da72b658-44e1-47cf-b99b-b38a2e12c5d7", "comment": "Malware payload (Loki)", "value": "332e97ad670edc0ba8471b25b8156954eae6efa094f09b94288f47fe9de36bff8b0e410d1ab4e7540be2ed9bcca20a35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624030467, "uuid": "c86b045d-acb2-4d4c-8643-9be1ac4d0fad", "value": "D4F4BF213AEA5119F177EF785FD075959BAEFF237602E44E289133870633A81CD9063A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624030467, "uuid": "85458c9f-73c2-4007-af85-a21949a5366c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624030467, "uuid": "9a0760ff-8816-4344-8ae6-335ba9b37281", "value": "12288:OpkoMhlm4S4F3M9yna/vmhLsGbLfZsW3TMWty8rOix1aJ3U26XhyrmbfNCXD:O4W0Evc/LfaovtAeUk2+emb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624030467, "uuid": "2154970b-e4e1-48f4-991d-5c9e6bfc8422", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624030467, "uuid": "decbe664-6b78-4916-ab51-15f1c7aa5a38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624030467, "uuid": "51d0697d-1e1b-4bb4-846e-cf03c76aacc0", "value": "proforma ivoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6e7946-d009-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1624002311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002311, "uuid": "9043c0e8-025e-4f11-8351-bcefd3432048", "comment": "Malware payload (AgentTesla)", "value": "7aa1962ebd8bfadc1f0a02eba48d98f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002311, "uuid": "36805bf9-0a9d-428f-97fe-5c7848019504", "comment": "Malware payload (AgentTesla)", "value": "fab051e10bf27f0873b97e0231f58d378aa59c2b44ec6f90b9c396973bcbdd4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002311, "uuid": "9d69324c-d80d-496c-9384-ca4ba93579fa", "comment": "Malware payload (AgentTesla)", "value": "f3300184fa035cc64cd7beed1e20269c57230301", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624002311, "uuid": "70ea9fff-50e3-4fe3-8eb8-7796f03aedd7", "comment": "Malware payload (AgentTesla)", "value": "6abed4bcaf01d68f322f15e989e3b9fa7a6282717243812d5469527a16d27b6d166047978499316df3625efe87f6c36a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002311, "uuid": "0ebea93c-d079-4a91-94b8-2e706ec96ecd", "value": "51E4CF243AEA6229F133EF755AE475D69BAFF6233703E44D2891038B0613E41DED153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002311, "uuid": "394bc4e2-a597-4c64-8fda-0fbcab2b0f81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002311, "uuid": "7373979e-3083-498e-be38-95616eeae956", "value": "12288:6o/hlm4S4F3M9yjm2iNz6yFd6L66SI+2KFnY/sX7UChHzMDQZ/hoc1:6IW31RTWG0zKZccZwDQgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624002311, "uuid": "42d8ce90-e2da-4172-ac03-104597b122b9", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624002311, "uuid": "9802d2c6-f9c4-4857-a18a-44de2c335b4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624002311, "uuid": "8bac7ca6-133c-4a1e-8e2f-2d07d5d9b1ed", "value": "7aa1962ebd8bfadc1f0a02eba48d98f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23aceb3d-d026-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624014779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014779, "uuid": "e85297d6-0697-4cf1-8879-77fad0468247", "comment": "Malware payload (Mirai)", "value": "94fdf544b3b89fdec811a4d9a795d587", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014779, "uuid": "d0585cb9-3922-4e6f-a77a-4ee990c3e9d8", "comment": "Malware payload (Mirai)", "value": "fac943c6173cf183e53bea76d4f6b07dbb455ec3dc98dda71164267fc7e1dbb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014779, "uuid": "e61d6293-9c7e-4072-a6e1-97e856668581", "comment": "Malware payload (Mirai)", "value": "2485ead8f4250efc6013a1ca4f87215013dbbb9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624014779, "uuid": "558bca09-7069-47b4-9cca-b35a6469502d", "comment": "Malware payload (Mirai)", "value": "becbb6f203a0628fcc8cd6434e8fd8479d4130584f45644091d42852ca0c46d7ef8d15b031eaf1ad032bd6eb21acf4f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014779, "uuid": "061c7c11-dec9-4a68-9bd2-bef2730c1475", "value": "BBC34C46F7404F13C4D6177ABAEF42453322A795A3DB730699285FB43F8676B0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014779, "uuid": "7fa4de18-9016-4a95-b44a-8c41ca318e91", "value": "3072:qmrw4nxM1eT27VwKyVDYS60t6LfCM/92ENmWXpAsV:qmrw4nhT27VwZVT6LKM/9XNmWXpAsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624014779, "uuid": "ee89f7f8-6f13-4657-b9e7-eb533a5189bb", "value": 129380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624014779, "uuid": "94d5173f-a12f-43b8-b52e-d21e98d28e26", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624014779, "uuid": "bf98db50-510a-412f-a0a0-4fcbe444299e", "value": "94fdf544b3b89fdec811a4d9a795d587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a20edb-d031-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1624019728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019728, "uuid": "f33c9e0d-4e1f-4d21-9a7a-c07fa7e20122", "comment": "Malware payload (CobaltStrike)", "value": "dc23368a35267205be67641e64c98e3d", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019728, "uuid": "e728ccc8-5a7b-4be8-a52a-d4f001e67dd9", "comment": "Malware payload (CobaltStrike)", "value": "fae7f3543def745069c296f4ee81a1f9308227884e1edda8f6e65dba805aa6aa", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019728, "uuid": "9c83e3b4-d1ad-4e08-b659-193f69df00af", "comment": "Malware payload (CobaltStrike)", "value": "f27896349c825dec85edecc5b1113d4cdbb78f76", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624019728, "uuid": "0b94a309-29bb-4697-8282-7fa364a5d8ea", "comment": "Malware payload (CobaltStrike)", "value": "8d210f33cf3244ec92300612dac123d3ce549eec9719a2cf6425752f0e15cbaf71577f70b02e612f3e4d72f9a0f4dc75", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019728, "uuid": "dd8e7100-3556-4398-a259-e945a59f4b25", "value": "B254CF65FC04CF08D00079FB9319D651392B365E78204ABE7BBA86C22AC737BB2575E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019728, "uuid": "e21c1791-e29f-4289-a983-98e474d6faf0", "value": "db502765cff159e5db66145a73cb6cd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019728, "uuid": "09489503-3399-446a-b662-8b5c54b1a592", "value": "3072:xSEQw/mIOfSAAmLGGxR1pB0lxZ0J9FIRKmj8q2Jclf3tcw:xSEQ8IXqOR3B0lxqJ9oK08q2+pCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624019728, "uuid": "76ba6d0a-7b59-4ef5-85f2-946184327d46", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624019728, "uuid": "2249c581-974a-4447-9c61-fcc256200125", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624019728, "uuid": "a1217e42-8589-4584-a26a-012854eb3c67", "value": "dc23368a35267205be67641e64c98e3d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14693b6a-d010-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1624005304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005304, "uuid": "67cdc187-c34b-4d4b-8c27-28b4c5384926", "comment": "Malware payload (TeamBot)", "value": "e87ad34c8d77dee881677303ada76747", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005304, "uuid": "80038cc1-87e9-4dbb-bbd9-75745013ef84", "comment": "Malware payload (TeamBot)", "value": "fbdf0d4c6278e3f4d3d3d4be4be3bac22f47cc63bace161aa26a44677bddb744", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005304, "uuid": "1a4d8a67-8dec-4d21-8ae5-0dccab9cc537", "comment": "Malware payload (TeamBot)", "value": "2797b0c1f938130ccbf739fd857d5350252bac41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624005304, "uuid": "d134302e-42c8-4b99-a3d5-bf43daca4f05", "comment": "Malware payload (TeamBot)", "value": "4b43ba9552b941e28d17df0ae5d9ac0c5d2f1ade2603ed484c657f9cd4ade19e55633c3283cc1f2d611eac93133dc04e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005304, "uuid": "20e384a9-d13e-4b3c-abb3-d6cec8cf9350", "value": "22050200FA50C035F2FB12F926B983A8A52D7A729B6444CF52E966EE67346F0DC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005304, "uuid": "e930f899-50a1-4d02-ac1c-affc7264e5b4", "value": "2eafeef859f65494b1ac6742c31dc4b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005304, "uuid": "909528b6-1dfc-4ab1-8d7a-596505beb1ad", "value": "24576:rbAJzChjoIF35DN8YvzHQBsgZMD5b6QW:XJNVvMSwM1dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624005304, "uuid": "c79a1fd7-b027-48b2-9f26-21c98a3877f9", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624005304, "uuid": "0c8cde7b-3c6b-4023-811c-333fc9826685", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624005304, "uuid": "858597f8-ce20-4dd6-b5a9-25a08ab50579", "value": "e87ad34c8d77dee881677303ada76747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bd5490f-cfce-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623976943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976943, "uuid": "00b8fe8f-7f78-48ff-ad30-3bdf68cbd32b", "comment": "Malware payload (RedLineStealer)", "value": "1d51f73c1070464f54a0af686b38ecd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976943, "uuid": "328dc5cd-6b86-417c-85c7-b713b5085c37", "comment": "Malware payload (RedLineStealer)", "value": "fbe0c5aab0d98f9b21b4a71dee73f37df653919ad7490966f5180eaf968780ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976943, "uuid": "27cc429a-3eeb-44e3-b5d1-bbfa8edc236b", "comment": "Malware payload (RedLineStealer)", "value": "2c364a153831573ca5b18ce38f874969a07f06a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623976943, "uuid": "fb5f0db8-4af7-4062-8762-4c12a7e0d958", "comment": "Malware payload (RedLineStealer)", "value": "c85a0657eb4e9e9bff02b26ea9035d4ac77f42a60aef4bbf6a84a30c064d8af1782121ed724d4dcbeb514b768b32ce5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976943, "uuid": "ae5b9a45-173e-442f-82db-d0d4c1807904", "value": "D0852311B9C645B2E2322D315628DB356539BD201F24DECFA3D8AD1FBE324D09A347A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976943, "uuid": "5e0b55a7-aec2-4f99-8f9d-73f952bb388c", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976943, "uuid": "1d603266-0f83-43ce-b770-c0e34558fb70", "value": "24576:fhvJVJdMPTDKBECsO3+V2gYQ03yFjja56hp1gfQD5dN4BzcXCBTrejGvcsroOXg0:v3d3kaQQ6hp3bN4BzfRk8cs1w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623976943, "uuid": "1a02b5fb-7444-4386-b1be-95bf47238c73", "value": 1764174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623976943, "uuid": "bb18e833-db03-411e-8257-c35424c12e55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623976943, "uuid": "9d799f06-1249-4c35-8efe-9c292dd5960e", "value": "1D51F73C1070464F54A0AF686B38ECD1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e33701b-cffe-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623997616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997616, "uuid": "c704a44c-315a-4faf-a932-6da9de0ca989", "comment": "Malware payload", "value": "d30983128ec5601b2a1622d31ca0d0a6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997616, "uuid": "f8ffec54-3650-4117-bd44-6d4e05dfc595", "comment": "Malware payload", "value": "fbfb4bcb97baad25166a48e34aa31c4dc7740dded1eab9a95d37d6510f8328f0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997616, "uuid": "0e8317de-3d11-47bd-bd66-51525c719b63", "comment": "Malware payload", "value": "751d1421d3ce4bee92c2dac61fe810958ce718ee", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623997616, "uuid": "32f59345-3662-4bf3-b71f-ba93258cc763", "comment": "Malware payload", "value": "3ecd3e9a7b45bc034e887a87f007ada94eeda14e6e38450d31f09550d1f11cc5253269cdf5e355a269969e966572c768", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997616, "uuid": "baefac28-4434-4021-b752-9d9d18bc5290", "value": "9C8557F0AD01D4C1F5BE5B6AF2FD3A48A1343217EBC94A4A00E7E5551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997616, "uuid": "8b6291d4-5284-4b1a-878a-eae23cc334df", "value": "12288:Miu90qHW31Hk3zVcIJMDLnmhGGEuAYSb3jPsVsRQPVIQ7mlZueEjR:Mi3qHMkDWIJMDLnmgGEuebjkuWPxYweg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623997616, "uuid": "e77cde2d-7853-4e4a-b729-74b2d0ec4c4b", "value": 1761650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623997616, "uuid": "ebb91b6a-4717-434c-bf72-f03dde69a42b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623997616, "uuid": "2d5c38a8-28db-44ff-a96e-f3fab5a5f0ba", "value": "Document0798.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9dfe530-d01e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624011595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011595, "uuid": "688b5ee1-8b79-426f-b491-e461c0becf72", "comment": "Malware payload (Mirai)", "value": "d026afbc872f02d56710ccde31d0c598", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011595, "uuid": "21171d20-8971-4998-a76d-5bb98611084d", "comment": "Malware payload (Mirai)", "value": "fc0862884ba5d00610f43a6e6508c5d9e464e806f1dcd863f9f8bc8d092f3d79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011595, "uuid": "6aaf0999-90d5-4249-9eab-ef9e05cf247d", "comment": "Malware payload (Mirai)", "value": "91bf56cac67a1ae58d26cbb8739ebd33f91d587f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624011595, "uuid": "6e21f647-cb10-4b9f-9dc6-45ce7b2bdcba", "comment": "Malware payload (Mirai)", "value": "959112ef1524daf53b33890494ae69e898e70f44f21e315220a59ae7ba32d1bdb975df0a9841a5ea4d228649ddec2f97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011595, "uuid": "a52f8db4-570a-4ef0-8312-0e3728ba8841", "value": "5B632935AD792E26C1C4A57E21F78315F1E2174E26B8C62D3CB20E4EEF18B8065177B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011595, "uuid": "7d37b35f-c59b-4cdb-8622-f4388433ec38", "value": "1536:itps3SEBL7g20NCxynEq8aQYb9H7bhaH48v4m:Oxmfv4NaYlbwHMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624011595, "uuid": "1f93819f-509e-4bdf-8152-7c1d568a7e6c", "value": 71368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624011595, "uuid": "f3d05782-e280-41ba-b8d0-b94be11214be", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624011595, "uuid": "fb2add68-5732-46d3-bdf3-eaa9e749a917", "value": "d026afbc872f02d56710ccde31d0c598", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5e5011-d080-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1624053606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624053606, "uuid": "9000d88c-b613-4551-9efc-8a8e1b8f088a", "comment": "Malware payload", "value": "c39a8b99780439147a021cc5bcfe4702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624053606, "uuid": "89ffd978-c6f0-4250-87dd-aa7df8076bed", "comment": "Malware payload", "value": "fdc92c2f55c2d75500a2fd3c428f8ffc0b3f060240a70e51c31ed33f5912e611", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624053606, "uuid": "6d31e89f-da6d-48c6-8fec-9e5ea048db22", "comment": "Malware payload", "value": "4b9045d61ff16c624c585ce9be868438d2e672bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624053606, "uuid": "f78d805f-e865-442c-8916-3690e7286c2d", "comment": "Malware payload", "value": "a3ca3b52ef5a2a111e43ada1a6cebb4c71e9d9449b77502edaf409e8969e65c27d85ca370d47e49c5fdc87c372f5291e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624053606, "uuid": "a6492b00-0853-441a-8b4f-f4c19cb58315", "value": "EFE533123CF54177FAC14872A8646ED4E0F8E6280FB14DE7375E8A2D7F3925192287E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1624053606, "uuid": "3de07be4-35a1-4581-9598-ae8999848402", "value": "e00de6e48b9b06aceb12a81e7bf494c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624053606, "uuid": "b12b85db-0dfb-4396-b22e-5b15d36a3c60", "value": "98304:UG5QgxEwE6X/foVF2OjVvgxyJWiD+aS2OSrTc:UG5pjq2c8yYiD++fU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624053606, "uuid": "bf3a76d0-3c64-475e-9f02-6bd9f1eebfb0", "value": 3176424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624053606, "uuid": "98e87ecc-523e-473f-bcdf-3da39d6948d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624053606, "uuid": "3e4e14cd-c532-4369-a9dd-0f19d1681f28", "value": "script_hack_412.zip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc000151-d01b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1624010417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010417, "uuid": "9d1b19eb-3e7b-4871-af9d-7b93520c2ae5", "comment": "Malware payload (Mirai)", "value": "92662ad86bc92c6dd3d8b906e08a6ee4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010417, "uuid": "49cb7592-24bc-4199-9c57-e40bb506860d", "comment": "Malware payload (Mirai)", "value": "ffc38298a16bc5e56e1114d6038d9e57e1ddfbaeb6a35f482fca3577f55776ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010417, "uuid": "2d3f3570-2727-45e3-8df6-7e467bcf70e4", "comment": "Malware payload (Mirai)", "value": "fbd4bbb209e1f609e5048fc1fbf86d986738ba04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1624010417, "uuid": "95ba2662-fee5-49ab-9f6c-5be17e5c18fd", "comment": "Malware payload (Mirai)", "value": "f35370bbea9abaeadfd244aef5dcd46f7a568232ddc458ed97b611141a88d673d42abb9f558f9784abd6abe160d37b86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010417, "uuid": "59d84e58-7dfe-48cb-869b-19cf64e32d67", "value": "0BC2E1294E597F47D4C51BB30BEC01A50C56F997AE26CA5BE0C1B9F07246FEE36B2480", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010417, "uuid": "8bebdddf-49c1-42b1-aed0-f64f983cd2ca", "value": "768:aXXnPkRA593CZc7s70HI+MR+CyKST7OwM7aM6Pk8:aX3cAWc7Ez+CST7O3qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1624010417, "uuid": "70be8d21-d124-412d-8fbe-7b3af4842997", "value": 28060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1624010417, "uuid": "1741626d-6cd2-4411-b27c-4edc695c3ed3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1624010417, "uuid": "432328ec-8ff0-40a2-abc3-3d10fe642a2d", "value": "92662ad86bc92c6dd3d8b906e08a6ee4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }