{ "Event": { "published": true, "date": "2021-06-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-06-09", "timestamp": 1623283382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "fef81fc9-4cfe-42e4-be92-af2470a76347", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9947cad5-c935-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623251760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251760, "uuid": "b4b801e1-5538-4f47-a5ba-eb74d8dac19e", "comment": "Malware payload (RemcosRAT)", "value": "b8bcbe4fae0342158680e6e97bc1c6ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251760, "uuid": "a34c441e-ec04-42a4-8c3e-f750b04832d2", "comment": "Malware payload (RemcosRAT)", "value": "003ce2185b3ac778e30dc053f8f1e21bee6e627895e52b6d764c66eb41990bc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251760, "uuid": "1d7878d0-2248-4b8b-b9be-2f5c3395675f", "comment": "Malware payload (RemcosRAT)", "value": "90c01c6d6eda238c36c248bc5dff8052ad3c0a7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251760, "uuid": "41223328-368d-44e7-a002-806bc211b9d9", "comment": "Malware payload (RemcosRAT)", "value": "0534e62e1072d79d2bd48c67a26b963ebfaa9fae0b2246ecd9cf805041f54193c7dd6dddd35b79367e5a2a276eb1c2fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251760, "uuid": "8f5605a6-f94d-4d4e-bd8c-92fb85a44ab7", "value": "A205E0252248AB18E1BF877980A5011487F5E543D323DA8DFDA5D8DD2E323CAC36F65B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251760, "uuid": "f84302be-7d2c-47b9-9f31-0e3ecabdce4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251760, "uuid": "39bd3c61-d264-4544-9a6d-774ff6f60c75", "value": "12288:7tEKRwlMV40JUpuHwQ2SBqF/eWmQ+ZWbPWfzwhRrTOFw7PxTERoLU+h+7:7tEK6UR3+79TUwrTOFw7PxQf+h+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623251760, "uuid": "c8ca13c4-c03a-4dd9-840e-603e5effab20", "value": 838144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623251760, "uuid": "fa17e3c6-5300-4616-aa8d-27d1e385170a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251760, "uuid": "908c9a92-04c3-426a-9540-f5ef126a7687", "value": "b8bcbe4fae0342158680e6e97bc1c6ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e207d7-c921-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623243004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243004, "uuid": "57d95c8e-1f79-4cd2-83c3-783c9378c8ad", "comment": "Malware payload (Loki)", "value": "e91a62d53a7adaa7df110c7f6bb7898c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243004, "uuid": "b16ca4d3-96cd-467a-97ca-e0415b060bc9", "comment": "Malware payload (Loki)", "value": "01618a227132254e16c7b7ce94e36f4db54070c13a10f146470fddf99f5c5566", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243004, "uuid": "ef214f11-b9c2-4f02-8d35-9cf7bf42232d", "comment": "Malware payload (Loki)", "value": "fa10c5ade1442ca6dfe895286e763034d16d724e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243004, "uuid": "c2a1bfd6-7daf-41b9-a0ed-791934455a06", "comment": "Malware payload (Loki)", "value": "b2c9fcbe9f955a07a3e158615331dc6521e650f2cbd962da8b8087f17f226d3f0984ae1de99cc7bc22d53802c5621e38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243004, "uuid": "66f6c919-a055-4544-be65-1a30fb83b177", "value": "D0D4AE9E3250B6DFC86BCA368A981D24E660B4BB570BD307602716ACDD4E5D7CF112F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243004, "uuid": "ea4b5a5f-fa84-4152-ae2c-0413b2e5cebb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243004, "uuid": "0224b538-39d1-40b6-b079-df58c6ce4cea", "value": "12288:7aI7CpLnpxkAKe7WG7PSG0NSCacNKMs5aa/aGf32I+GLNiGZ1i:ODpdxg2WXG6agF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623243004, "uuid": "562fe98f-2c7b-42e4-a962-2bff9a7b8193", "value": 633344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623243004, "uuid": "03df64ca-fd1f-4eed-92fd-fd1f888e5e1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243004, "uuid": "6ff531d2-e6d0-4202-a4fb-0ab2aeb9b313", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907acf07-c95f-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623269784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623269784, "uuid": "c083a785-8bd2-446d-834d-38e425612df6", "comment": "Malware payload (AsyncRAT)", "value": "c1f5eba56ca6dcee282d91f30e4e4e37", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623269784, "uuid": "190b0a75-7d03-43b4-94df-c55e57795aa4", "comment": "Malware payload (AsyncRAT)", "value": "03cf51a9c8cc21718a09020036028fdf5293d88095881d2c1241be48aef79245", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623269784, "uuid": "afd4ced0-20d1-4d2b-8caf-97bfa095222b", "comment": "Malware payload (AsyncRAT)", "value": "65c6c6e5f9cc511dd880c4fd579b720e774646dd", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623269784, "uuid": "ebf4bc30-04fe-41b4-951f-2c578f27f83d", "comment": "Malware payload (AsyncRAT)", "value": "d35ecb93d643e73e9fc9292c1c32dd3185c3a27379cf4441e877dd891ad55daa042cb4ed9639022ba9ebbd71a092ce1e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623269784, "uuid": "42eb9dd4-8336-4ccf-9d61-963df50d04e5", "value": "A5B34C327EA347CAC8ACD0B465028399E5909EF64D523A52B3F5372FDFFC220A4D5562", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623269784, "uuid": "b5efb8b2-a482-4adc-8090-34e00ad2c931", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623269784, "uuid": "42e00b54-62bc-49e4-9f09-f38a63ddd61b", "value": "768:KZF9Pi2HLxzrNPffrfT+y+6r8qaqLCuCnzRTFTSfS/+1aH9smoTuCL:KZFZrNPff3rNr8nwTOTki+169fCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623269784, "uuid": "3c4fea56-69ab-44a6-8998-de15bb5fa079", "value": 113152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623269784, "uuid": "f9c9ae79-c6ad-42d7-abed-76062f0718f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623269784, "uuid": "81514fd6-c491-45d3-be8b-a4278fdef6d8", "value": "C1F5EBA56CA6DCEE282D91F30E4E4E37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab8d238-c8e9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623218987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218987, "uuid": "e790639b-8ebd-4c55-b76e-f8c0bc72514c", "comment": "Malware payload (AgentTesla)", "value": "af03b9b56ee61cf62ce748c62ce0035d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218987, "uuid": "dc71cdd7-5c6c-42e2-81a7-70ff4d7281fd", "comment": "Malware payload (AgentTesla)", "value": "064ad016455f8e408f7fbc52cd6a7f4bc37595d78a0c1164571b13fc3aa443f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218987, "uuid": "ca04dbc5-7d89-4a3d-9787-9aa15aaf7366", "comment": "Malware payload (AgentTesla)", "value": "22acbf277a94ba10c4c69a8c8f78ff0d8039cedc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218987, "uuid": "36dafa97-219b-4003-a714-0ffc4ce6a121", "comment": "Malware payload (AgentTesla)", "value": "a6d156a5a86beb1c4e35427dc0542d753ee9e92e7e306e03602294ce9a12d34cf3e84d9e3e0f365f3570c4d11a11ae16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218987, "uuid": "66f3eb94-556c-43d5-973f-50d4cf7c6a3c", "value": "E8E433EDEEA87508D4489D887F180F3D9AFAC90D1D3A82574066B925B1EFC50432FD9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218987, "uuid": "5aa72807-b70c-4f6a-991f-c4315bd766d0", "value": "12288:LNCGaujb36ua9DRFiwhjUJdaXkxFk3rHFL28TrzRzZ+Rmmg9+KNUYNeYvtdSkvn3:LNCGjj6p9VFiy6Ukk3rx2ghzZiPKNjNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218987, "uuid": "9051fc65-67d5-460e-a34d-522f603bff45", "value": 697018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218987, "uuid": "cf71e026-83a8-4794-a736-9b5354cd11d4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218987, "uuid": "130b3878-4019-4833-8615-00df2a5017b1", "value": "RFQ for PR 11936.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cac0d06-c929-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623246397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623246397, "uuid": "e0ae3884-5a9b-4309-a9dd-888c7b043b27", "comment": "Malware payload", "value": "492486e409c125017dbedb3093ccdbab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623246397, "uuid": "ca8d1191-9c67-4378-819a-e43fee0c0552", "comment": "Malware payload", "value": "06b970bfe80823ad959b8e3f616d274b216f2e14100fced7742604580c0e84b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623246397, "uuid": "19bd60cc-25e7-40da-be38-91015fb0e3dd", "comment": "Malware payload", "value": "f3a8ebb3c77eba31a01e095fd2996b11738fddec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623246397, "uuid": "3e76cfca-5a03-48a2-a50a-6ac1e45b5bfd", "comment": "Malware payload", "value": "6d2e41f3c5aacd5b1ef00b56e3205f4c07f321dc4182956e1ec2913fbbe5ce8df5015ebaf94be2336963e0157e63c563", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623246397, "uuid": "f7d2e721-ad93-405c-a7a4-1157155c7174", "value": "E552E119BD13028BCD651DBA5249F416FB9B03D528AB9F8413BAD34287F651D97B010F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623246397, "uuid": "bac3b564-ff4a-4b7b-9b9a-2bc06255ceed", "value": "384:TeV0foxTK6tuvwdtTX9KSyaBSBjeYTfo9mmQPgg:TDohtBTX941eYFDgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623246397, "uuid": "141cb56a-4941-4744-b208-bba4eece7203", "value": 14120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623246397, "uuid": "f0895d4b-fa48-4e7f-a04e-f4e9a9a7ba9d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623246397, "uuid": "f4fdd010-f070-4048-80d5-734b15ebaa23", "value": "SecuriteInfo.com.Backdoor.Linux.fmhj.30852.24160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59c4262-c938-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1623253123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253123, "uuid": "c3a19850-5104-4ccd-af12-8bf498586e0b", "comment": "Malware payload (Hancitor)", "value": "4367591274b6be8f360905d082b2b4b3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253123, "uuid": "ded00ca1-f803-45b2-bbef-2762f5c68ee0", "comment": "Malware payload (Hancitor)", "value": "0848ff6f55a93865c76f9775ab648f3669618315a157de7476b64bc0ad1cbcc1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253123, "uuid": "ce7b85ea-81b8-4614-8db7-ef79865c5626", "comment": "Malware payload (Hancitor)", "value": "bbc665c0c0d46b48ac679c7f616e182c2741942a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253123, "uuid": "7e135fdc-0934-4c35-9093-c0c07d2a2894", "comment": "Malware payload (Hancitor)", "value": "151085a2c711853852db32093366b090f51c73c9d5bdeda622abbe1412a752075931399edd4a114a2b8e3b08627fd81d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253123, "uuid": "ce2549df-62b5-4da9-a26b-534a269d686b", "value": "BF94D00132EAF471C016813B8F45C6AA436A7C459FED5D8BB9C86EDF3D2E1635B29305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253123, "uuid": "a9a0ad72-8e62-4291-b142-81afea5a8527", "value": "1377db7102a7a91f1f40125ba387f9f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253123, "uuid": "9d3ca579-22e8-4e72-856d-99142ead913d", "value": "6144:ERiEKMBQVteGqlpEDaPe+f6tdhKsqUqhbPfiWJ51oXfVv7SUABS:EdBQVtUHNPe+f6VKbUKiq1odEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623253123, "uuid": "5a869c00-d90a-46cc-8bca-b19eb88b2f35", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623253123, "uuid": "7f707c62-6f72-4128-af59-da836ee4cabd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253123, "uuid": "b56f825f-210f-43fb-92d5-61cb05b4d5c1", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04612212-c939-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623253228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253228, "uuid": "a4eaf1ba-0bfd-43ae-91f6-cb8ab55a2f02", "comment": "Malware payload (SnakeKeylogger)", "value": "eb634dc0d748ab177c3d6984ed0d25cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253228, "uuid": "475f35b0-8de9-4d74-9e69-cef10647a483", "comment": "Malware payload (SnakeKeylogger)", "value": "0851beb2b3b5d3b2c484bbaea0764e7558d46e1dc070ce54610626ecea1f314f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253228, "uuid": "ed817e5a-0e7b-4c0d-b7c2-f4bc656dc130", "comment": "Malware payload (SnakeKeylogger)", "value": "13ec0ec89b9b27e4a307aaffebf3a6471834f06f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253228, "uuid": "323d108a-6d26-48a1-be23-d14c4429c948", "comment": "Malware payload (SnakeKeylogger)", "value": "db23c5941354951c8247d71072a17957be839296b43ea8244334ecf0bcd4d1316746e558d638c5450f4eb6f80d89fbed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253228, "uuid": "b2982a30-4ac0-4b3b-8756-9cbfe0c9b580", "value": "2945EE3F15BE122BCEBCD39587C4451BE4808BBB7411BD69E8DB47984F19A4279C223E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253228, "uuid": "c4259bd1-1669-46a9-95da-2f4a266b1208", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253228, "uuid": "0dfaf89c-d03e-4890-a965-bd8b836f0ff1", "value": "12288:M4yFcrotCGfk3dYM681FRhevnZNHbHH/ZycoCmv4OnB4AkNtNBqr2EE3Xo3:Lybtd8tNF+vnnbHfBjOB4AUxqr0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623253228, "uuid": "070044e0-b9c7-415f-81f6-8cef83e18d76", "value": 1244672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623253228, "uuid": "2a8007e3-3511-47c5-941c-bc5b3b8b32a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253228, "uuid": "53179ee1-9f1b-446b-b693-ea9a6839b5bd", "value": "OC Federal Mogul 2106040271#______.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8b3338-c953-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623264682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623264682, "uuid": "b90d598d-180e-489c-b6c0-7b6d8bce1232", "comment": "Malware payload (RedLineStealer)", "value": "50319d9adef41926a23323e210664be2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623264682, "uuid": "280690d9-5f52-4756-9211-03a95fbf1c31", "comment": "Malware payload (RedLineStealer)", "value": "0983983ec2845d20463751634a7f7aff06aef75fd6a0caa2462802566f72ed1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623264682, "uuid": "498e31a4-b8a8-4685-9649-30992f8400a5", "comment": "Malware payload (RedLineStealer)", "value": "48af24d24817e29cdcf778624da84c76a5dd7af9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623264682, "uuid": "fc320cea-aecf-4813-aeca-e6ae926f7322", "comment": "Malware payload (RedLineStealer)", "value": "75e01a42dbf73f220b7a554da2c62f3293243f5c83d5f40417d98b38ef238f84beb80499b9f62a4754c65503bfff238d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623264682, "uuid": "60307b3b-336b-4ddb-ab41-2fce2f4326d8", "value": "F3934B3D736C9E15E27D0A79B57112A543F1E08F1111EBCB8DC074EA2E667C02A19AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623264682, "uuid": "3c7b18c1-e4e6-45ce-94c1-5079675b3796", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623264682, "uuid": "87e2dd1e-0c54-4f12-ad1c-9380925593ac", "value": "1536:lka5cnOE5VNn0Bjn2ypTNHtOg7J3mLtny9PIFbPLbY3znH0byFJdITSx1E3Ji:CamPN0zpTrOg7J2Lty9PIVyznH0yndE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623264682, "uuid": "0aa6cd0d-8153-47b7-b7ca-9d892c53397d", "value": 97280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623264682, "uuid": "83f1c27e-0474-4bbc-8acb-70c7a2ff284b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623264682, "uuid": "d85db44f-f83f-4cd4-8b81-ec99b5d765f0", "value": "50319D9ADEF41926A23323E210664BE2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0090bb-c963-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623271520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623271520, "uuid": "35c1b678-e21d-471e-b97a-00ca115193a1", "comment": "Malware payload", "value": "00dfd025d19fdf5686ac4bc25361dda3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623271520, "uuid": "9b0f4b2c-bec9-4a49-ab26-2d8a6e072efc", "comment": "Malware payload", "value": "09aef6f54bc8516f9bc1411925a7a5fa2b1cb22b0129dc5debe507121e845816", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623271520, "uuid": "b3b3d1bf-3851-42d3-b15e-8430d8fbd354", "comment": "Malware payload", "value": "7e5e57c2eabcf5b22c92e345331074cd49291fb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623271520, "uuid": "7c9e0bdb-ae13-4e89-85a7-830ad99c5817", "comment": "Malware payload", "value": "05acb8d33de15b421dd56465cfc4ffb1595d3f79fd42ae107f585c2b0f20e91fc08997ae9fcdfcaeee0712e4005bbb67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623271520, "uuid": "6f514ff4-e748-4ec6-8918-457c79a13d43", "value": "A4E4D0259AC4DB56F67DD3789065542483F6FC2BE332D18E7EAE70DE0AB3B80C562205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623271520, "uuid": "5359fc64-1888-4e7b-b138-14d5f65b60ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623271520, "uuid": "272f77d2-8e48-4d18-848a-632d96656825", "value": "12288:F+l3yFWlMV403uJYuNmgN8tOu37fLx08tjGTecafpYrS5:F9WU3uOuMQA7d08tcBa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623271520, "uuid": "cae84e6c-adb2-4284-95e5-2c6ae2ab7367", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623271520, "uuid": "5b22e617-0ddd-488e-baa1-83ff09b95aaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623271520, "uuid": "aca507cc-cc9b-4fa5-a372-6a91481cdd2e", "value": "SecuriteInfo.com.Trojan.PackedNET.832.15445.2375", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1ed64e-c8bd-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623200011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623200011, "uuid": "f8a237c1-aa5a-4856-b634-f2be3bc4cefc", "comment": "Malware payload (RedLineStealer)", "value": "458fc657adb8ac8fca087d0d48aeb3fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623200011, "uuid": "3f44370f-8a60-4882-a21d-68095279fce0", "comment": "Malware payload (RedLineStealer)", "value": "0af922d3a06fdd474a4bbfbf35b5aa5ea28946209e65e91889d81b9ce77f1777", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623200011, "uuid": "f0eb33aa-8d9a-47fb-821f-0a027bac4fcc", "comment": "Malware payload (RedLineStealer)", "value": "1c714ca42adbd307442a7674b24948478e9f74ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623200011, "uuid": "d63a452d-44c6-467b-8a2c-17674bce551e", "comment": "Malware payload (RedLineStealer)", "value": "05b36ae32d982b93eec36207a281cb9d3ba4e7da012a5bee9e2e07cfce11ef29bcdab0c57c0a784e5e7e2920315b8602", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623200011, "uuid": "da1f5adc-5aa1-4a72-a83e-3c5f690af450", "value": "0CC2183927D48A38ECBB1F3095F5D2028B71F4929C02E31F19D4908769D3799DAB23A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623200011, "uuid": "c16ad146-1fae-4375-8936-0e42bfdf46b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623200011, "uuid": "6828799e-da9e-4555-b76f-d996ddf84f55", "value": "384:sAmWfroDgtRveD39S2Qq2SA7inN+yRFa2zdai72xIPUsGVuTGfZR:5rigPej99QzVidasfwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623200011, "uuid": "acdc93c2-a0ab-4740-ade2-255670c4fec4", "value": 27504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623200011, "uuid": "55d9b43d-f16e-4599-bdd8-a00824fcfbfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623200011, "uuid": "7d7cb415-e19b-4531-ae14-bb137f033974", "value": "1c714ca42adbd307442a7674b24948478e9f74ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac9251f-c91f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623242206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623242206, "uuid": "470593bf-cc78-496f-99f4-0123eecd17c3", "comment": "Malware payload (AgentTesla)", "value": "bdff3540e8d0808273c6b2190dbcf513", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623242206, "uuid": "b4f44772-d6f9-4b6c-b214-f2a8837caeac", "comment": "Malware payload (AgentTesla)", "value": "0bd991c7063fbfb58f4d57e32b75e55729e1061110f197e2ce27468de52b6c6d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623242206, "uuid": "eb1576fb-fa6c-4c10-b106-c2ab0388a7ec", "comment": "Malware payload (AgentTesla)", "value": "6e73a70e781b56ba46b1ff20f84e87efb018c337", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623242206, "uuid": "eb7ba508-8bc5-4a60-92e5-7c4c6c78cb00", "comment": "Malware payload (AgentTesla)", "value": "a64e0d238d9fa4bad5f658b95b747e4393f3b4b774b3342b4c3f14764c2a349eec41c71a08736dc9ec926c6a22297026", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623242206, "uuid": "9b6d0235-2c38-47d8-bc87-82d181f82356", "value": "B9F4E02427489B28D17F877AC4A1401447F4E503D323DA8EFED598DE2E233C697AFA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623242206, "uuid": "1dc1e0ea-f379-434f-9fe8-2e1b00b89a04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623242206, "uuid": "18143cd9-3fb6-4123-82f3-fd48d4a123e5", "value": "12288:pJoWlMV40Jnu7m4BLLCTtk+5xmDFL0unKfFzH6UyQXv9neYfZ9MmSEm:pJoWUdgLMkuQDFLiNaUPteY0mSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623242206, "uuid": "577ff184-10f7-41da-a0d6-8283d58c454b", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623242206, "uuid": "4a7289ee-59bf-46e7-b23c-26e45ccc1b0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623242206, "uuid": "bae49d81-297d-4f8a-92d8-8a2c24baf0cc", "value": "4It7P3KCyYHUWHU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a087b1-c957-11eb-875b-42010a9c0053", "comment": "Malware payload (RevengeRAT)", "timestamp": 1623266167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623266167, "uuid": "c087d893-32bd-4ef3-807c-ac01861bdb06", "comment": "Malware payload (RevengeRAT)", "value": "6aabd2c0a9a5c64c335c75564732ffbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623266167, "uuid": "4a4188c2-d8c4-4cf4-97f6-6fcf55396055", "comment": "Malware payload (RevengeRAT)", "value": "0ca6888bef837ddc4fd658f18827446c69e07368aef1b23a54ada567061a2863", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623266167, "uuid": "9a4113af-387d-4724-85b1-9b98896cecb6", "comment": "Malware payload (RevengeRAT)", "value": "0afd0454d61d4e0d2845b043dbe964b9e6c36a7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623266167, "uuid": "4505dcbf-eb7c-48c7-822c-6dac1612518c", "comment": "Malware payload (RevengeRAT)", "value": "4044ddc8c9d68a71f4a35ddbd530de6cb8b6286b1f0e05be121e87b5e3ab38fa42fcc52cdebc37a32d33fbb8a7a1d793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623266167, "uuid": "b182be86-12c7-45b8-9ccd-384f7a4196e6", "value": "09935800535803F2DA86C7F14EBEB18966642BC29C6EAE1F83C1F71DAD5AD3783419D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623266167, "uuid": "8f3006c7-445f-4da6-be64-9de2177bc814", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623266167, "uuid": "18dbd742-d4df-470b-a70e-5d933516adf9", "value": "1536:V6ItYxqnAC6ph6ggxP9dkpSpqeclIycZktAgw1ZONCPi/hwEHYZd:V6I+xSL6CfxkpSQ32ycZ0kC8eby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623266167, "uuid": "8bfe95aa-e285-4c5e-a5f2-c54cd93d4982", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623266167, "uuid": "270f93d9-9bee-460d-8693-249f876b9485", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623266167, "uuid": "c777bd06-d168-4b83-b5b8-9fec6168af2f", "value": "6AABD2C0A9A5C64C335C75564732FFBC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2768c68-c953-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623264714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623264714, "uuid": "7b9e8c98-f570-4246-9f5c-9a5304b79f02", "comment": "Malware payload", "value": "2247db5b20b9e69e2f0358e47c691f58", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623264714, "uuid": "4a5acef2-9b21-4faf-9068-1c44fbd735f5", "comment": "Malware payload", "value": "0ce5ac71f0b4fcfed4daa9f862cdfeedae78f9195fe05123b895ad63c218d31b", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623264714, "uuid": "55dbd245-c21f-44a2-bcd4-31f013f7d4f9", "comment": "Malware payload", "value": "2c9f1dcfb563ede666fa0009713f405b63b254ca", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623264714, "uuid": "5791d973-d1fb-448d-87e8-b7bc24db6462", "comment": "Malware payload", "value": "721ee74bd0d8cc06db2697fc7ce3dd523310e73b3408c513fb5f88d41c8202d8d7e84b1246346872ce3cdf137f229e29", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623264714, "uuid": "7c5f66a0-224c-424c-8678-fb3183dec167", "value": "B7D50306CB05E625F4CB1BCA984B183761F0D249FBD817DC6FBA59E36C2A4F96070369", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623264714, "uuid": "3636b142-b260-4f5a-b2fe-dc1401f2727e", "value": "6144:KSZ/B/upBnfN+4bw/A8l71/nH9NT7jzdjYGr/urO4qMacvjPa2a/Ln6/s0fBWPAn:Etr5In6n9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623264714, "uuid": "bd62dff0-a979-43f8-82ed-03b37a06cb50", "value": 2752556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623264714, "uuid": "7f6e65c6-74a3-40b9-928b-413bbd5919e0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623264714, "uuid": "2397fc50-8fff-4a36-8091-c2e16bdf2766", "value": "0ce5ac71f0b4fcfed4daa9f862cdfeedae78f9195fe05123b895ad63c218d31b.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3297de3-c956-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623266004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623266004, "uuid": "ffaa7e18-9b69-4ef9-a8c9-31fd02cdc73b", "comment": "Malware payload", "value": "a99f6f41e94c0c9dac365e9bd194391c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623266004, "uuid": "07a254df-fdce-442d-8331-c8e1a8d93e15", "comment": "Malware payload", "value": "0d78a33a77954db9c2fd31198710d9beef5f8e1b5147890231896f5628bc4a2b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623266004, "uuid": "994a7b37-5196-4d20-a67f-23833f4924ef", "comment": "Malware payload", "value": "12c8adf784f2e3072cd6142d87c052e3fddde059", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623266004, "uuid": "f80b8523-8854-4ea8-933b-ec44d0151d25", "comment": "Malware payload", "value": "2d5a75d0996b5f05657dd579b48686a5b7f7c6d9a30b5189bca3ce6bc84ad9cfcde370161a5c16d9d8aaf6a5462fe143", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623266004, "uuid": "1cd8d3e3-96af-4081-bf6e-94f0afc2887f", "value": "E143F793EB2280E5ED86C8395305B137EA713CBD422EA752EFF54386473A650F95CB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623266004, "uuid": "3262ec69-ce63-4a1e-abb9-a228a403c55f", "value": "4afb364ef54e8370059ee72303ef3268", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623266004, "uuid": "9d7854ba-2aec-4ccd-8572-08111cd42aaa", "value": "768:OiKo8uZN3lE+CtyCHfrluwzpdxyoRRGK9ChBnnGiH4byX2FzacwOZ6R2:OiKo8mVE+KDHxyoH9ChQq42mJiOZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623266004, "uuid": "d14765e6-9b34-43ec-98f3-a7642d7b2079", "value": 59480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623266004, "uuid": "ca5cd7ac-533d-4609-9152-37e2447ade42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623266004, "uuid": "8af23067-bd08-460e-abbb-a81b089480b5", "value": "0d78a33a77954db9c2fd31198710d9beef5f8e1b5147890231896f5628bc4a2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d86e55-c8c3-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623202735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623202735, "uuid": "ef756696-753d-4a2d-9069-35f99b9f23f1", "comment": "Malware payload (Loki)", "value": "1fda5fb83bfb8f3086e914d843176664", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623202735, "uuid": "914096b3-ce7b-4f15-a0a9-7b53ec224150", "comment": "Malware payload (Loki)", "value": "0da8aeeee0ffafd5c8da6c6ce1ddc1cd7461a29bcec1640032eb20847130a458", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623202735, "uuid": "c13d811f-9b56-4856-9513-da88e85f6b65", "comment": "Malware payload (Loki)", "value": "6172e76bc7aabd18e820d4bc177050f4428b31d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623202735, "uuid": "eb1f107c-b87e-4ec2-b772-3d9d30a65333", "comment": "Malware payload (Loki)", "value": "b1f30fc7894da6e6320085319f2a64238e261bed880b5afb348f79f849a79a975efac31890146f3aede5479f9dab7952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623202735, "uuid": "f391783d-705c-4304-b89e-090a1bd1329c", "value": "C404122939C289B7E5978B354973DB35FFBA67981312C5070728AE7F186235318387C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623202735, "uuid": "297b40d2-4860-415e-b70b-b739545a62eb", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623202735, "uuid": "6e8c2d80-4ce2-4587-955b-faae73ac7f28", "value": "3072:JS8BCfoDaXJnM/8C2+vN2F3v2xKGm6JZ4zINkbFZzzJLa1RDToZ/7y9Xh9:JPB6WpdNYfUKGmS4zOSFxz81RDTAQh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623202735, "uuid": "e73b51c4-5cda-4f26-843f-615cc03162bc", "value": 181318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623202735, "uuid": "2d4736ea-b2ef-4903-864a-be666e03cd64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623202735, "uuid": "b6de0c9b-6e36-4a12-a1bf-ece887cc7681", "value": "Humiling ng quote 09-06-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b17a22b-c92f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623248998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248998, "uuid": "fee3b984-230b-470c-9a25-4933b742656b", "comment": "Malware payload", "value": "fde253a33c430a36d88db75e362a3b94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248998, "uuid": "7c5cde9f-a981-4bd3-807d-074d0e631064", "comment": "Malware payload", "value": "0db01fa52bf9f77f8d6b28cf1ef4556646ed680980051f13ccca7c04eddbbf70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248998, "uuid": "55a9f801-8bda-40db-9480-3c378e76cb25", "comment": "Malware payload", "value": "2cf0e1510d09a9e267932b2077fbdcdaccb54d6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248998, "uuid": "21efe48f-9eab-4394-8021-88822e98b7d9", "comment": "Malware payload", "value": "0144acc66b2c6b565fa67261b9f9eb6ac8d4c1c56d3dcf3ce61e2f204bfa2127036145e436d9d3e3185908684ade28fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248998, "uuid": "639c89c8-1f23-4625-912f-77537585fea9", "value": "9F052E25EBB9B45EB7A913C461148A2AAFCFFDF66034049C4A107763D7982461FC23F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248998, "uuid": "7eb2eb8b-a1b4-486f-bb72-6b97ed0936b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248998, "uuid": "52d9084d-7fc0-45f9-a1c6-9167d0a6deaf", "value": "1536:Imus/9OQI1gPbWwLfy0IFCP6Bmr/0lG+LjHMq0CSbs8ctEEGi3NRXY:ImO1gC8fZXP6s0lGyFJOnctEQ3NRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623248998, "uuid": "b40c46e2-c97c-4aa2-ad6e-74411e7c34d5", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623248998, "uuid": "0d505e07-0b98-467c-9522-8ff6d7b2b21b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248998, "uuid": "c45003c4-3c7f-4333-9ec8-f3a1638971b9", "value": "fde253a33c430a36d88db75e362a3b94_b2646a2701d7403800125b46_eml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba1e462-c937-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623252650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252650, "uuid": "2e507834-f9f6-43ba-8e81-09ada1d53f1c", "comment": "Malware payload (RedLineStealer)", "value": "cc573d9e886bddba1a05eed927046651", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252650, "uuid": "4c139240-317b-4d85-b0c1-c78753f289b5", "comment": "Malware payload (RedLineStealer)", "value": "0e7852a904b6e62cea2484762c716f181b458a244a094bdc13b4fd2f901d30f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252650, "uuid": "9bdee55d-135c-4a2a-b377-2c3ab15ea6ad", "comment": "Malware payload (RedLineStealer)", "value": "29f84653bbaaae1ec3ca94b0e4d06755a9bc0b23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252650, "uuid": "18f7a86e-0569-454c-a718-97e6e5145c21", "comment": "Malware payload (RedLineStealer)", "value": "ad441d43ff04e1e3a5f5406eb4cc85f9148f1b5b0f40afbbccd988659b5f6ff02afb78aa490abdaee2fc1d3bddc81242", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252650, "uuid": "12104bef-618d-4cb0-96f2-c9f88013c41d", "value": "51A34A55639DDE15E2BD0B38E4B001F942F1ECCBE062EB578DC47C8A3E36B441915ABA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252650, "uuid": "8696d108-cd5c-436e-85c1-5d4f60249ba0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252650, "uuid": "d9b55c9c-bda7-44cb-977a-35bb73264448", "value": "1536:QsAXQDR0uPCqOHStn4NTsy9YHvy5tNb4AZTGq8vEvy6JdekOStx95EvJK:Q/XFuPP2xIKtdfz8vQyedZOJvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623252650, "uuid": "7d693b2a-4c6f-4bce-b9f7-60ef2877f87c", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623252650, "uuid": "6d34073a-9163-4587-ba82-dde4d9e3b975", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252650, "uuid": "6c0eb0e0-2279-4b59-8cd1-b9df21bd21d0", "value": "CC573D9E886BDDBA1A05EED927046651.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a6143f-c935-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623251677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251677, "uuid": "05d83245-ff3c-4c1a-8760-f79728f6be64", "comment": "Malware payload (DanaBot)", "value": "66c284b62bd5b6640f4478761a690301", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251677, "uuid": "fae0efe5-e86d-4ac2-825a-1d04da097490", "comment": "Malware payload (DanaBot)", "value": "0e9fb0a524be6d8ff7ca8704b42dcaa025c83247109b5d4e42b1384cf0308f07", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251677, "uuid": "3f8477f1-45a7-4159-b0e0-2d61dd550cc4", "comment": "Malware payload (DanaBot)", "value": "c1a1d3feed660dc7194869fc2dbc9ae43370fe07", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251677, "uuid": "73166d63-bd68-4ad3-b4fe-03d13eec4f46", "comment": "Malware payload (DanaBot)", "value": "9b81f79d32e413f8a7dde5d5911c15a7063dcb9ccbf54a6dd67852ff88cc9d754321d30ec49da4acd0a137a6aba44ced", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251677, "uuid": "7760f99f-0c05-4b22-922d-0d8d396c7b48", "value": "6E56330472E0D03EF2B707F869BA525AE91ABCE33724A0CF029677E956606E0DC71753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251677, "uuid": "26edc199-e043-4014-9aea-fb2c291b8cf2", "value": "6c073e6a8ba68224cd3b694cbab6f2b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251677, "uuid": "aa648937-c551-499a-83dd-9b5edb49117a", "value": "98304:LSHPWWrowJkSqQ3XbBayisgjpyfUaZ8L6mNTLF5QpdsPd/Z8Q9L2iT:LSHproskSqMbIyiD1CUaOL7QpdKeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623251677, "uuid": "48e52e07-2e3f-43c5-810e-179b486afaca", "value": 6282752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623251677, "uuid": "d8aa543f-035f-4cce-ac4f-aa3589a3a79e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251677, "uuid": "0808c3c4-5f7a-45c4-80aa-8cef4a900bfb", "value": "66c284b62bd5b6640f4478761a690301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706ab4bf-c8e9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623219050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623219050, "uuid": "c5c5e4cc-663a-4539-b84a-137555f584fe", "comment": "Malware payload (AgentTesla)", "value": "2d4c9cad67de1b515960fcb12b236436", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623219050, "uuid": "56674740-eca0-43f4-9494-a52ad85aa1ae", "comment": "Malware payload (AgentTesla)", "value": "0f5f9003874d9be19ec66f1e16063e141a2405507058b2a7f50180e05b45bac9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623219050, "uuid": "db8503f1-da70-4f13-a61d-f5cea9bcf54a", "comment": "Malware payload (AgentTesla)", "value": "cb2b38f641dddead81c9320294fd81f3f7139609", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623219050, "uuid": "a147863b-cb7f-4d76-891a-69efc326199e", "comment": "Malware payload (AgentTesla)", "value": "4c6a343625916063133741b58e86b6738a5e71ae72ca915c956150b1b39ad0ccde04c1bade033af1a50603abec03681f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623219050, "uuid": "b99e0623-c11b-4d2e-b1cd-22e814ded27b", "value": "46F4122127886B43C33E19B64821516556F29C017AB1F1EB3DC875DF2AB3F8A4B11B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623219050, "uuid": "519a7022-75ce-4eac-88a7-1f07c9b617ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623219050, "uuid": "8f81424a-6d60-44cc-b396-7abb551d973d", "value": "12288:RGHNWTUVYtXiZB5TtFO0OO/3kKJH9CxgNIzEnm+CzbnRyXrwvA5U9PqLjgTRs1CC:ysUVYtXiZ7tE0OO/vEgNIIm+CXRyXkvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623219050, "uuid": "1738ef97-14a5-48d1-80b9-1b30c87b531b", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623219050, "uuid": "62fc1b3b-2697-4b7d-bcf6-0367d476c95c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623219050, "uuid": "b1c8cb7d-dfbf-41e7-a267-1e83d5c967eb", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199d3965-c8e8-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1623218475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218475, "uuid": "fae28a11-7d64-445e-ac48-e4bc5b979ee9", "comment": "Malware payload (DanaBot)", "value": "717de3c8e1b6b501e2d3ffc800b321ee", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218475, "uuid": "1943a0f2-4ccf-47e4-80dc-019596ed9476", "comment": "Malware payload (DanaBot)", "value": "116a1e6834de8a94ce8d5c74369d59432dae59e04a09a5d517c7eb3f367e9a64", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218475, "uuid": "50d50f6a-d49d-436a-a28b-4dd0e22602e4", "comment": "Malware payload (DanaBot)", "value": "3a7fbe5e21386d32febfa1cffd37b6262653f46e", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218475, "uuid": "44ea82fa-d85b-4df4-8ce5-919ecafc535f", "comment": "Malware payload (DanaBot)", "value": "73712edc420980a51b70b288e152d1fe2b361866041cbff89afc3ba417e58175e84b747912d4eaf4d05b8951776e2be9", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218475, "uuid": "a05d30ac-54df-4c6b-953a-925342c26f60", "value": "53563300E2F8C038F2F776BC2DB8A264B9367AB37B6550DF11D117A492642D19E7172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218475, "uuid": "b1385a55-d1c2-48d8-96b7-1a680d8dafcd", "value": "dbbfd4149087490a92e718a2b81d99d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218475, "uuid": "9bf56030-0b0c-4b60-9968-0c2d65b26325", "value": "98304:vw1fdsaLFNJHyxYGhsubtEI9bJNOdkvAaaeuS1sj0fnN7FUU+17Mb7t6T9ta/VYD:vw1VsUFNJ0ba0jbJNnAaawsj0VmU+129", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218475, "uuid": "c8d9dbcd-b88d-47a0-b000-dd033d48d3e7", "value": 6287872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218475, "uuid": "bb346e55-8bd5-482b-9a46-429e6d91c920", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218475, "uuid": "a8d1d4fb-953f-4db8-a12f-9062d0df242e", "value": "717de3c8e1b6b501e2d3ffc800b321ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a0f943-c8de-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623214205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623214205, "uuid": "65171506-33e5-44c5-917e-9f644e491872", "comment": "Malware payload (SnakeKeylogger)", "value": "034e48799884a892ca862cd3037a9eff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623214205, "uuid": "bec08cb1-5809-4a8c-929c-8789864a7d9b", "comment": "Malware payload (SnakeKeylogger)", "value": "125bdb859fcf3f25f1beee2803e5141a9e33a78d26ada1afab28144219ba3b3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623214205, "uuid": "7f59bf7c-3c20-4825-991c-7b46a8336c89", "comment": "Malware payload (SnakeKeylogger)", "value": "ecd6403896bb4ecdd2e4defd05dcddcd43bb0dbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623214205, "uuid": "3c82541a-c51a-428d-8c35-66b2f9b2d7d7", "comment": "Malware payload (SnakeKeylogger)", "value": "81111eddb1e4ee37f3991d2ac3e5c7a55b45f9c2276b9ab14f97904a191cc6a829875fab01febdf597c1f26a9fc6dcdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623214205, "uuid": "747a6c83-51a5-425d-8543-4cb7103d2379", "value": "9805D0296204EF14E4BE0777C8A44890D3F9EC03C713D9BEADE438DD2E727EA915A552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623214205, "uuid": "cbffc2e5-47fe-40fb-9fa4-e60358b585a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623214205, "uuid": "986ca132-7b9e-43f8-9986-ee4bb54df9ca", "value": "12288:mYOrTlMV409CHb8FO2CEdif2eTDUYuWAepTwd04GpNSUWjATQQ4KSHq:UPUI8FZg2e3UYFDjBp8UWjATSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623214205, "uuid": "49a93d53-a662-4065-837c-bf31dd90d626", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623214205, "uuid": "00c628cb-88de-4c54-bb4b-067fc87e763f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623214205, "uuid": "7cfb98a2-9f87-4e4f-9018-0de2d35d8c07", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.DZG.genEldorado.22118.20141", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570b355d-c935-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623251649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251649, "uuid": "b9a2a2e4-001d-42f8-83f7-e901da6beba3", "comment": "Malware payload", "value": "3bd76401091b804c3a2a6d6c4f34f096", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251649, "uuid": "890952dd-b3eb-4993-8f48-abc4a75b5c09", "comment": "Malware payload", "value": "1483466bee4d7f01cf93d0c402c536f8f1f059c2ebc72485da779faefb47b545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251649, "uuid": "7983c90f-1ccf-4728-bfe1-3c6d354616f6", "comment": "Malware payload", "value": "564d1864fe927d2d1095157d820ecdbbbd139f8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251649, "uuid": "72babcc2-ab81-42e2-8fb3-d277515f6b83", "comment": "Malware payload", "value": "0441e7b0a5942c5e30bc50121a828baa224bf52f32c451844bb69f229b83dffbb5e1bc50dea06a51346a36e10945a88d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251649, "uuid": "b4201ce2-c2bd-41c7-a269-ba1493753452", "value": "F9A33B6022FCD739E27A9FF475E0A16127BB71233102F5598DC2B9C62617F818944BBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251649, "uuid": "085d6c82-f729-46eb-88cd-9ff80dfadf24", "value": "1536:HgZKxGtoQ3ud9k/PKvfDu6s9gZaSw9mUE7kiPmlkLSrZKXUA3XHx058:HgZGGjuz9TuUslvEQwkkUZkHK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623251649, "uuid": "cea0e258-81d4-425f-b2b2-bc4c43a734f3", "value": 106892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623251649, "uuid": "d783a2a1-e396-4c4b-9a97-51344083393d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251649, "uuid": "d901c7e1-6310-4342-bd57-8d0ff807611d", "value": "3bd76401091b804c3a2a6d6c4f34f096.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4eb505-c933-11eb-875b-42010a9c0053", "comment": "Malware payload (ImminentRAT)", "timestamp": 1623250960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250960, "uuid": "0f36c63a-5830-4fb5-8daa-412c79a6c631", "comment": "Malware payload (ImminentRAT)", "value": "bcf5e7012dac6487a136908d6e874968", "object_relation": "md5", "Tag": [ { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250960, "uuid": "6f49813b-5d15-4e72-98ff-d52c92efcf00", "comment": "Malware payload (ImminentRAT)", "value": "14a4bb85b59aecedb1e9d3c6756e5d66e9a10bbcffb000101a8e5e397becd19c", "object_relation": "sha256", "Tag": [ { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250960, "uuid": "5b25d435-7b81-44da-879f-3a6c616868e6", "comment": "Malware payload (ImminentRAT)", "value": "c5761efd2b10a8ac61bf551db4c744debeb68c26", "object_relation": "sha1", "Tag": [ { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250960, "uuid": "59f3eec9-616c-45d4-9664-4538f0027291", "comment": "Malware payload (ImminentRAT)", "value": "070234f61c2264aeaeb4b7fc01fd83db6dc5fff8a955ab77ee5ab0e98adb94108513e3351604dfd9ee48428c2e7dd269", "object_relation": "sha3-384", "Tag": [ { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250960, "uuid": "3bea501e-371d-4fde-ba9d-cd34d398b5c0", "value": "20452354B8CA2F4BD182C9B24096C07591A5EF917A57C504C32C37EAB276AF64FC783E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250960, "uuid": "bc479f33-8209-4346-ac38-65aab52e98f0", "value": "24576:0v4bCQxt4/QjF/+iJ7ldaV6VxZ82qhftqp2pta/a6e4GvjfHh1W:dbNxq/KNzaVqJufUwOav4Cj3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623250960, "uuid": "5c490f18-f9c3-4a26-8d3d-fc1d312a83dd", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623250960, "uuid": "f6465555-b4af-49c6-af58-881c126f2e09", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250960, "uuid": "393a103f-7930-409e-b124-e52eae535529", "value": "DEPOSITAR.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b28ee22-c8e2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623215927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623215927, "uuid": "d4450a49-ae30-4ae6-a010-23f7a5bc943d", "comment": "Malware payload (AgentTesla)", "value": "d0e61c0e5a3ce3762e9eea8a9320e5de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623215927, "uuid": "0e1bc061-f942-4eee-b296-b6a72a55398e", "comment": "Malware payload (AgentTesla)", "value": "14eb0d2e21f743b14c8ccfb48a07d592246744d1a2fbd79d6b32170fbeb74a4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623215927, "uuid": "8c31291a-9625-469e-8e5c-69414ca4afbb", "comment": "Malware payload (AgentTesla)", "value": "ec7f93a4e4f17c8c66f39cce1c9f4488db469946", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623215927, "uuid": "864ae84d-b050-4e28-9eeb-131b779e0947", "comment": "Malware payload (AgentTesla)", "value": "f2164896b8831fa5c87e20c9d6545be2290510d97f04dcfc0954e3bdefc65996ac74f1b644ab1e6ed91e27ca52410e1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623215927, "uuid": "54fff241-ed39-4a81-b0e2-efa5df5b488b", "value": "D8F4331B3E8450890FBF4F069A6FDCE4957E8A95177DB3083D457C4BCB2234A91B2E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623215927, "uuid": "b10e1597-993c-4e82-9b5b-3fd5c99946e7", "value": "12288:z+GLJHNZ3UBB/1EH0NStkyYARM1Iin/m+hVa3Panp73QXc0nCDVmHcEUUl:dlHTUTE0SthUSiO+h43P+Q/C5zKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623215927, "uuid": "75843c40-fca6-4dac-bf5a-a9e4fb8c8d0b", "value": 747164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623215927, "uuid": "b146987b-81b6-4ca7-afc8-2f9febfc5d95", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623215927, "uuid": "0e6fc5e9-9262-4e8a-928f-eccf12cfb4cf", "value": "BANK DETAILS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c083923-c923-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623243873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243873, "uuid": "51e0d1c5-528a-4eeb-9bbd-d309563fddd9", "comment": "Malware payload (Formbook)", "value": "7e922d344cbe7baab727a8254e8a8f7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243873, "uuid": "4c0eabed-d8da-4b50-b5e4-7fb4ea7446a9", "comment": "Malware payload (Formbook)", "value": "190f393f80634efff05c0dc2b7a21dbd7e5cf2695f3f611e8c0d78f1086b0774", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243873, "uuid": "0f6c96a5-b1f3-4c87-a157-473755ae0f1a", "comment": "Malware payload (Formbook)", "value": "3e440c495e5adc20e638c3d832820aad7b2c6386", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243873, "uuid": "99fe4e07-d351-454f-aec2-11da9b4d23d2", "comment": "Malware payload (Formbook)", "value": "59158faa58f1bb815269a11fcda546f9d3be00cc27984b434da7cc819b771ebf987e43f01a4ae287abd9be16f30306c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243873, "uuid": "fb7734d8-3baf-46fe-b681-08a09fb17f0e", "value": "31F4E02927489B28E57F8775C0B1010443F5E603D723DA8EFD9898DD2E623CAD7AF646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243873, "uuid": "a0644db0-6fe9-402f-8f03-5308c107c31f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243873, "uuid": "67d0cf1f-c19d-450d-990b-d7acfb6180a6", "value": "12288:WeJjlMV40Jv1Uk0eJ/uxRo/yfrawUbnznAmcKc19MHC/lNiGNll4D:WeJjUURg2P8yfgbznlgH/lNnNr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623243873, "uuid": "7b052f47-a6d5-45bd-9efa-037fff652981", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623243873, "uuid": "de02b2b0-e961-4db4-9d96-26de9c1ad619", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243873, "uuid": "953a9d76-9b64-4ffd-b1f7-1a3577600d61", "value": "bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c88c932-c8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623217164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217164, "uuid": "059f6075-60ee-4edb-9f7a-1c43cba35d9a", "comment": "Malware payload (NanoCore)", "value": "f343ce75606d600a978f4593ad92a5ed", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217164, "uuid": "d2f8da07-dc89-4439-8b74-8ad8e8ed4972", "comment": "Malware payload (NanoCore)", "value": "194abfeb6f78221b43aff1da8d0aceead6282979840d9aa43bfc20d190ba0ddd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217164, "uuid": "f2db5486-2b04-49f6-a4fc-2cf5be80446d", "comment": "Malware payload (NanoCore)", "value": "0aca94dd295f12f4deb4505a3f3dd470a7a59752", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217164, "uuid": "79321e9a-9bc2-466c-8c57-d368ea5ece77", "comment": "Malware payload (NanoCore)", "value": "5c8ec9d37963cd359ecf7d9b03f0834a9ee7509d960e356f5125929e52642ae1013b4257e229aff124634c3f9fd6403d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217164, "uuid": "0ad0da81-b756-4681-ac8f-3150e1b5a328", "value": "26126C7A4BF15491CE4297E5CA36FAC215F730A443E568C2F84CE7680F85366AF7B021", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217164, "uuid": "f9c488ab-a1a9-48df-a1fa-c90c38f7aeb7", "value": "192:I65CImFOF3MFn290lbwj5COBIaL4Ieor81AiWUKFaaNf7WER:d5hmFOF3stgh7SWtF3Nf7WER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217164, "uuid": "4b4acf44-942d-42ed-aa2f-6b94c429f407", "value": 9110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217164, "uuid": "579c858a-e565-4352-af80-b7188a5aa7cd", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217164, "uuid": "51f1c833-6404-4a5a-818e-e55ff6f08afa", "value": "NEW ORDER Ref PO-298721.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3e9f69-c907-11eb-875b-42010a9c0053", "comment": "Malware payload (Adware.Generic)", "timestamp": 1623231981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623231981, "uuid": "35392a55-afd2-4c16-9059-b3dd06acaa27", "comment": "Malware payload (Adware.Generic)", "value": "f99d0fc489a7258c29ec765cf1e2624a", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623231981, "uuid": "3bbd3957-0184-4b67-98b7-e158f8fc063f", "comment": "Malware payload (Adware.Generic)", "value": "194c31cd0d620ef3c2772030924e28afb54f0a087d4b6c1c73c57f3de8f09222", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623231981, "uuid": "fb8e268a-4233-44b0-82e3-1c15fff0d1cd", "comment": "Malware payload (Adware.Generic)", "value": "75c371deabc64f63a55785abf7d04d6fdb5994f1", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623231981, "uuid": "676680e2-48b0-4aa5-966b-806331be2bb9", "comment": "Malware payload (Adware.Generic)", "value": "710011c0367bf50af6290661524b816514d1d6810b96b240c56168d8094cf3203adb5a265441a3a8aaabab41795cfc84", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623231981, "uuid": "4028a6a2-08c9-4e3d-856d-d44437757052", "value": "30E5E0C13AED6D8AD07527701F7C9E32452CFDA56568C029045A3C4EEAB1AAD7860F3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623231981, "uuid": "744e2396-0028-41bd-a1a1-f7d244918090", "value": "09a2e2c06ba2d6163c72d330b716ac6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623231981, "uuid": "90c120c4-c9e4-4649-81b8-a7678d8ff190", "value": "49152:ENVJk7WTiwEqg9OlppXsZuXiO9ztg15s/DwfxCro2lhf8QHx8etJOHrIgl:+VJk6DEq9p9WuXiKzq15skpCU2HPR50L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623231981, "uuid": "efbfca4b-2d52-4b3e-a15a-5a3b6e125fb8", "value": 3066632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623231981, "uuid": "9b925be3-606b-445c-9001-48da3ac66d4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623231981, "uuid": "5cfa09ec-bbd5-4479-8358-ae1179d76ef1", "value": "SecuriteInfo.com.Variant.Hyperborea.5.5618.24773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efc1bc0-c8e7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623218108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218108, "uuid": "c9eaada9-ac41-4892-bdbb-6aeacd3466be", "comment": "Malware payload (AgentTesla)", "value": "a95524e48635790b707f37d71b393ba5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218108, "uuid": "c70f1a14-4987-436b-9aec-a869099c597e", "comment": "Malware payload (AgentTesla)", "value": "19878cacfebac9ffd1af48bedf636f21b6a1547a4bd70a725e74bbe9caa44ea5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218108, "uuid": "f3ef1e00-38f5-44a3-949d-d5ca7520f67c", "comment": "Malware payload (AgentTesla)", "value": "71527e850f724a5af5cbf361490fa0188f12ae6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218108, "uuid": "937e1238-0dd4-4c73-a3ff-22b8b3851c78", "comment": "Malware payload (AgentTesla)", "value": "676657d8646dc586f1762ca6609b09e496dc415cbae8ffa8a6f7dac6d19e6d9a4c6652edc88dd8d932ede9e22d1c4bd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218108, "uuid": "2555fc13-6516-4356-a157-c99a87a569a0", "value": "9C542395E8A08A2C894D11AD4B4AD33E4893CF7D283DD198EE1DF75CB68E4D2F443467", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218108, "uuid": "1215f0b4-198d-4c2b-bd2f-1693f05efcc1", "value": "6144:9dAAUtmjMVk72IzsbaMCjlGSyNkZGLOn/gqiSZIfG8RaCOWJp6Rk+:9O+E42QMIqgxF5IfZJML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218108, "uuid": "75af48f5-0e3c-478e-a759-035bdb9808a8", "value": 286156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218108, "uuid": "757c0704-0f8d-4a3c-9959-ed92e74c7da2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218108, "uuid": "b9625d05-b80f-4b0e-8d90-0f95867217db", "value": "\u4e2d\u56fd\u6d77\u5173\u65b0\u89c4(chinese version).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541c0d7e-c918-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623239189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239189, "uuid": "0daf54e9-e9a3-4da4-84b7-9b43cba4656a", "comment": "Malware payload (AgentTesla)", "value": "5fcdfae5f392897d385072b71ebaa0a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239189, "uuid": "c07f6da5-8af2-4815-a4a5-be9c2420d5b4", "comment": "Malware payload (AgentTesla)", "value": "1a92c7685a7fb70279355856280e0a335e87d39d4456fed92d5405387eb0bdb7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239189, "uuid": "ee23706c-01c4-4bba-abaf-5f5cdcaa0167", "comment": "Malware payload (AgentTesla)", "value": "23bb9fd142ee89c647a521422100a657e5591645", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239189, "uuid": "1a6d923b-f87e-4f9f-9a63-6e33020c9000", "comment": "Malware payload (AgentTesla)", "value": "928c4bccf59705ed5c83ecd4408729abd014461d3d3248ce141a46df612074a8948223a89c5d3e901e9c9a0134f58f8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239189, "uuid": "3e50cbb6-58bb-4f8a-b4ef-11d23f3bd886", "value": "B05423CD5A92E6DFDC6BFC2E0580776D37770E07743091FCE695486EB01062E266122B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239189, "uuid": "89278a5d-0ac0-4b3c-8489-51f49f64e937", "value": "6144:5Rr++xG3wcEjEGKlRyh6lrWbJoSycb3syyxSwaRXm9+07EXEV:5LGgtjEGKa0lrcbNb3JyERXm997Ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623239189, "uuid": "80b5ea4b-dd9d-45aa-ba32-dffc7d27b064", "value": 287458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623239189, "uuid": "321134a3-776f-45ee-8bc6-84c4b4f2f618", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239189, "uuid": "66efcb6c-eb02-4c65-b225-7e213ba41923", "value": "REG#32746-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e72e370-c971-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623277378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623277378, "uuid": "2df40eee-5e64-4f8d-bdbb-d4feac6e40a4", "comment": "Malware payload", "value": "1b195e0fbc60b0bd4419e0bbd7cf9b2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623277378, "uuid": "18be8555-9713-499b-a112-f99028fdcf51", "comment": "Malware payload", "value": "1b960ef1b3d7aa1527209d64b6f4066e8809eec0e2ebfc612e118feb978aa8c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623277378, "uuid": "aadabe3b-63af-4439-8193-46af54386642", "comment": "Malware payload", "value": "5e419bfc95b6c0f62c6dcac99d55ef94834e1bb0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623277378, "uuid": "1d4f080a-e8ce-44e4-8613-8cb18f9d5aa1", "comment": "Malware payload", "value": "c1ae88100d5243b7277ca8592826b4d2a6b2866e6a07256467edaace70c2e0051fd1686e63dfd76894c55e75ddc63464", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623277378, "uuid": "e69f5590-ede2-4314-ae5e-2a9b107decec", "value": "C405D0789DC4DA8BF77C837480B4997C83FED02F9B21C18A6EBF95ED8A66F485941101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623277378, "uuid": "9085e46e-ee02-4692-a6ba-1dd4576940a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623277378, "uuid": "05398951-3d77-4fc0-b7ef-c506369ac653", "value": "12288:uFYuHIlMV40zx/mwQecEHm6sTk0M/FLL2bkERs23yVy/n3ODpwn3:u5HIUQwQedG6sIfFLybz2+3ODpwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623277378, "uuid": "8fc9d04b-f573-48f5-924a-d8c8d459267d", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623277378, "uuid": "bf016b66-91c8-4199-9501-95e68983e2f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623277378, "uuid": "2b4aab1b-a6f5-499f-b2e5-e5721df874d6", "value": "ekrrUChjXvng9Vr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fc71eb-c8f7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623225159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225159, "uuid": "8ac72b44-cfc0-44ff-a2de-524b426760b7", "comment": "Malware payload (Formbook)", "value": "1bd8c23e84f9fb7e855e5673ee0a0a0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225159, "uuid": "7ae10863-3113-4bf9-aee3-3ea71598bc2f", "comment": "Malware payload (Formbook)", "value": "1cfad5d1e12e19a54ba17a9e1abf882651930d6feea5836e3da45680d941dc1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225159, "uuid": "b0419841-f7db-4ec1-b4f5-327438448cbe", "comment": "Malware payload (Formbook)", "value": "983121d3c3066278808579a850751610129c7491", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225159, "uuid": "459e13c1-29ad-4bef-a847-c251d27f4641", "comment": "Malware payload (Formbook)", "value": "7340951ac0a7c3885d020f04beb8e4ec343c6d6a9b25a62762f1e452b13fdecfdc4f70c4d9c7eaca65a13c9c5f0e59eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225159, "uuid": "108c32a8-8c9c-4b79-a4ca-cc59bc4f6b24", "value": "BDF401335244879FE27B457408311828AFF3EC162A60F69A3EC539DA1EB6FD147E0E56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225159, "uuid": "9f121b0e-ddf3-49be-ab1a-23d8d0ddbb8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225159, "uuid": "a9a79ce1-4304-42e7-b558-da15822fdd7c", "value": "24576:YcLBUVYtXiZD8ZG6ouAgCCSD7rMsuxdK5nzH5XeRI/Fd:/NUYtXiZDko2Ni74suGVzH5Xea9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623225159, "uuid": "e02f3670-be44-4c95-ac0b-febfc8dd6016", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623225159, "uuid": "6605d130-0791-4636-8bb1-9be8463ae95d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225159, "uuid": "0d5c8231-f3cf-4c86-a40d-a8f738b2545f", "value": "Payment receipt MT103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55340cab-c935-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1623251646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251646, "uuid": "79693eec-7d8e-4d24-ba94-2753497f6030", "comment": "Malware payload (ArkeiStealer)", "value": "60b77e30354e20b67873702769a35455", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251646, "uuid": "d0a1dbcd-870e-49b8-9cc1-f3684756284c", "comment": "Malware payload (ArkeiStealer)", "value": "1d78b475ebd4cc187a4bfdbb0e778be2d19d29700cf040795ff886852d18181c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251646, "uuid": "ab82290b-fd51-4a05-b289-9372b166a6a2", "comment": "Malware payload (ArkeiStealer)", "value": "75cb9c68f2853b8a5a9fb84d83e0e0c3a62d2de0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251646, "uuid": "59f191bc-de01-4b59-b54f-5a75c88456ea", "comment": "Malware payload (ArkeiStealer)", "value": "3652d0215ca17c113fb1e77da4015531478fc1a9ae445b132dfa6b6c1e11f3007d4cdebf1ef156b6eb2f40e0082133a4", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251646, "uuid": "ed75b7f1-ea5c-4ecf-851d-364af3f0a508", "value": "81050100B6E1C038F1F316F596B99368A52E7EB1A76490CF52D266ED5734AE0EC32347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251646, "uuid": "dae9470c-2467-47ea-810e-7b2d7494d8ae", "value": "6c073e6a8ba68224cd3b694cbab6f2b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251646, "uuid": "8c91de50-e8f2-4d09-9aee-2e51682211ef", "value": "12288:YFyxFYAIaT6xlbXxv2gXzDyzzJagn3X4TjmPPW9VqLagE9cNA85I7f8:zL6dzXzDyzIqX4e3wSagzA8K0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623251646, "uuid": "192158c1-320e-453a-9574-83a9f4471b54", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623251646, "uuid": "529ade7c-bd27-4c1e-8cec-749856e2b2ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251646, "uuid": "71c2e239-caca-4c9b-8f5f-79f2c8468fc4", "value": "60b77e30354e20b67873702769a35455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ec4b4a-c922-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623243597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243597, "uuid": "828015c3-ed14-42fb-921f-c02a4802ecf1", "comment": "Malware payload (Loki)", "value": "6e32cd4a3fac5e6b0b5f1c5659182f9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243597, "uuid": "9feba569-bfed-4fd2-bd53-33d6074cb9e5", "comment": "Malware payload (Loki)", "value": "1dfce723a17d9979985d027a8b4bf09a943153bb9ff23d082b21825c41104f96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243597, "uuid": "0b6d7147-1588-4633-a9dd-769de73078b7", "comment": "Malware payload (Loki)", "value": "936778dec492c66f9249c5be27b13b79abcd7a04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243597, "uuid": "47f99785-bf13-484f-aa48-f2257c800ad8", "comment": "Malware payload (Loki)", "value": "8ec1b71fead48eefb236d235455430379e4f2d120c9309473261072c65db04890cef8253acb2422e56419da49ba88a34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243597, "uuid": "a9124729-f139-4160-b5dc-ab4abcfc6387", "value": "E8E4DF3912488A05F17F43359071650493F0F907E353EA4DFEE868DA2EA27C693AF697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243597, "uuid": "eb6a8177-6210-4cf1-9f26-b72f993dff21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243597, "uuid": "e8003ab2-1e97-4166-af42-f79b32cae3a6", "value": "12288:4okFD15t0PvHgBlKs3lMV40J+u20ue5SrxVut/5GCn1WBkOC4sy639IxxL:4dn7Ks3Uhx5g8G+WuFQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623243597, "uuid": "deb20b6a-6fda-40ed-8340-77db009277aa", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623243597, "uuid": "a568bb84-0122-491c-b8e9-254ff286033b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243597, "uuid": "e6c27a3a-7c4c-461f-b18c-2f807fde645c", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc08c31-c8ee-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623221299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221299, "uuid": "aa7d1f71-d2d6-4530-a7bc-9199005e8193", "comment": "Malware payload (RemcosRAT)", "value": "6b08b7855bf4fd9df19cb4974f751334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221299, "uuid": "dffced0d-abfd-48c9-ba4f-454fb0e10f41", "comment": "Malware payload (RemcosRAT)", "value": "1f0a11fbabfc7a058b18eedd0d45186c7a3c17283939ac55ba0e0f252716bf68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221299, "uuid": "bbc1d4a7-b0c2-4a86-8cef-40b40b275312", "comment": "Malware payload (RemcosRAT)", "value": "c979d01d7c4eed468a85ad5f6ab60c4ee1d3fc13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221299, "uuid": "52c10533-6fdf-4715-b71c-54b6a94fab09", "comment": "Malware payload (RemcosRAT)", "value": "ec8c1a810b6836524a9cfd8f083bf7fb33038cff8e05c8a9b7e6537c745d13c350a8c3651e7a9f9577815d0658969532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221299, "uuid": "7b2f2365-5d7a-40e7-8a47-3b72f06ae302", "value": "7E4538AC315075DEC467CE768AA82CA4EA6174779B0BD203901705EDAA1CF97DF206F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221299, "uuid": "7ed72972-1657-43ff-978c-739d35d0d01c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221299, "uuid": "9555925b-a677-4f48-8f56-fe918772d304", "value": "24576:r3Q2p/7+VoUT23bsFqEDRbG8KZIigc9vv1F:bL+7SLGDRbG8Zi39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623221299, "uuid": "ed007096-b243-4d23-90ac-c1ee37e96553", "value": 1175552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623221299, "uuid": "014ce35d-481b-4ee9-bf2f-2649aa8b89c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221299, "uuid": "3cddc311-89c5-429c-96ee-4496614556b3", "value": "6b08b7855bf4fd9df19cb4974f751334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed86c15e-c945-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623258773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623258773, "uuid": "adc8d073-cfab-4a2d-bb32-60db8d5077c8", "comment": "Malware payload (AgentTesla)", "value": "ab0994995fd8906b2a887f202b3e11c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623258773, "uuid": "e05abf51-8a86-4935-9bce-96fa26567dd4", "comment": "Malware payload (AgentTesla)", "value": "1fb09ec3072db6358a4f5f4c4c9c35e4de7a34b5be60207d4e6b6794cef45e5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623258773, "uuid": "9d0e6f09-8071-4649-a202-fd0f82b75c1e", "comment": "Malware payload (AgentTesla)", "value": "f5d1bf82dd31fbdda0c7e6faacb6d160ac855680", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623258773, "uuid": "fbebe0d4-67ee-454c-88f7-1a79f85caac2", "comment": "Malware payload (AgentTesla)", "value": "75cc23bed7fd30f243c939511346c30ef735b9e161e259356c5404da1e46ed977a46842dcf8e2b388e448ccf6055d1fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623258773, "uuid": "d5d9606c-2a73-4c5a-8538-66e85f0f8795", "value": "BF152360DC903F8ACEC74874AD6AC57D2298EE46B792D293D3707577B0321BE19E3186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623258773, "uuid": "026c4234-d435-49e5-b363-1bf9ea17a586", "value": "24576:pl9lKnp5uNRIxdAQllRdtM3eMA1LBJogoe:79uSCxyQlbr3Vo9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623258773, "uuid": "4d074147-962c-40c1-a14d-c95f16df2fe5", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623258773, "uuid": "9e4430a7-4bb4-47fe-bb05-b2a9c94e2276", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623258773, "uuid": "ac0a5bc0-f664-4c63-b8b1-c7882aeca989", "value": "pago.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cff306-c8c8-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623204839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623204839, "uuid": "605e06ed-64ee-4bbd-a5d3-018feed6be01", "comment": "Malware payload (RedLineStealer)", "value": "a974d52c8fd2ab3733a1d73c7aa637b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623204839, "uuid": "dcdb870c-1041-4365-82e0-07ceba8d3283", "comment": "Malware payload (RedLineStealer)", "value": "20b9cf58bdd536faa05a0542adb06d3aafe9d818ea825bc835bf3d6c7afa818e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623204839, "uuid": "f7a7b144-330d-405b-8d70-9da054a8f92d", "comment": "Malware payload (RedLineStealer)", "value": "f999509049761a2e6a985337db3f82681e5cb631", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623204839, "uuid": "007b85bb-abe3-4828-9bb4-04708174c963", "comment": "Malware payload (RedLineStealer)", "value": "ecf991fbeb90f72bc0a70c8179020b51474c3b38b237373153c184b129af895509009e1ee0246fca3b00e454e95dd752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623204839, "uuid": "4b07cb2d-f145-4a73-8dd7-89f101dfdab2", "value": "8EF33A5977E88E63C74A177CE1E2524063B0810BBB12FB07884E866E4D577E67C0D6DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623204839, "uuid": "3a22ad25-1765-425f-9f19-b907578533f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623204839, "uuid": "b7ae607e-8903-4846-ac86-1952cb9adab6", "value": "3072:IwARRWebRAF+8BTZAFDS0vyRA9Ujbzcg0vT8X5Obb/9vuXSueM:IXRWeYBBVAFdvYPQggvGxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623204839, "uuid": "83fdc974-53ca-4ed1-b981-ac10919e857f", "value": 166280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623204839, "uuid": "253a5e98-dab0-46f8-a36e-ce385dd93e76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623204839, "uuid": "38c963bd-79c6-4de7-9821-efb39f3213ef", "value": "20b9cf58bdd536faa05a0542adb06d3aafe9d818ea825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e66243-c8c3-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623202732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623202732, "uuid": "dfdc37a3-fc0b-456c-9cbe-6c130104cb15", "comment": "Malware payload (Loki)", "value": "79ed07a5cf02dd53c2a7636f858da665", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623202732, "uuid": "cd9d7f49-dd73-4857-ad93-49ad7c27fb72", "comment": "Malware payload (Loki)", "value": "20cad9050a4e4135d37227735aec3117ea7fe76fd205df1352a1653ca97d01dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623202732, "uuid": "1e88c8e6-f319-4635-a3bb-e2e538cd527c", "comment": "Malware payload (Loki)", "value": "fd0ca79737b09672a59a78aa47fe92dfb919a0df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623202732, "uuid": "493341b6-f1e0-4460-8d04-f133943085e1", "comment": "Malware payload (Loki)", "value": "8f2b6e91800f85d02ab00d0e7846f931d7c563f5032b6becd0ae2bc502dc7fc38b2866c06a75b7a8d8964aedae676b56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623202732, "uuid": "bac41c3d-2cf9-408c-b8e9-6ba1173a274e", "value": "4B04121BA9E58C7FE6CB877009B3D338F7765F08574A1A8F47E81F172D061928A192E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623202732, "uuid": "c6a0fd12-040d-4c46-8020-50dc4ff68941", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623202732, "uuid": "dd6ac0c3-3e3a-4052-bb18-98b20410f33f", "value": "3072:JS8BCfoDaXJnMqZ7tf+v6ncgulMZ6bCT7H9l2t2UzfFs8uzx7qbvrdErWQZ5InsG:JPB6WqZ7tGvEcRMZcJfa82YGrZGsIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623202732, "uuid": "b2726d64-2a2d-41a9-9021-7ab306a91085", "value": 181300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623202732, "uuid": "100f1295-13e9-4c63-b077-49cfdce59348", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623202732, "uuid": "1d6c26ff-6523-4c0d-8e68-c30f06dca272", "value": "Statment of Account June 01-09,2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46789b29-c8f9-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623225851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225851, "uuid": "925935c2-3e8e-40c8-a08c-69ec940e2352", "comment": "Malware payload (AsyncRAT)", "value": "4cd239ef80fd78d61acd9d01ec7ad633", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225851, "uuid": "1df39947-859c-49db-9543-d24de4a5b7ba", "comment": "Malware payload (AsyncRAT)", "value": "220bb2b7deba41f53a8d86d677691aff283314a29c27cc49b2ba396699237825", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225851, "uuid": "e551f2b7-eb14-4d02-bb69-eb66a19df043", "comment": "Malware payload (AsyncRAT)", "value": "d806d9a24c95a9da33a6311793a959320a47dce3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225851, "uuid": "30331b57-0694-4205-aff1-b6dfceb812dc", "comment": "Malware payload (AsyncRAT)", "value": "d9f681b20de43a033b8bd0ecf3342ff05c3934a4e459930b7067972d952618092f17cfa1e4d5cd3928987bc4bc46bdfe", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225851, "uuid": "502369d4-ab84-48d5-b57b-a8c879cbfa3d", "value": "1BC4BE5475F99FA2D135C7F6165011D19FFAA62AB9AEF3080CD6E0DEA470F018E80E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225851, "uuid": "d08c6cd2-93c6-4b79-b2b8-66fcfb171170", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225851, "uuid": "beb6073c-a670-4dd3-8295-aa54d96e9bd6", "value": "6144:28ZRyKve0YARn/tTxuuXYNc4wBQvyTdnLdyNGebH:xZRT25ARn/t1FXYsWyTdnET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623225851, "uuid": "e618e9f9-1ab7-4669-99c1-e57e7cf3a70b", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623225851, "uuid": "c7c7f31b-2218-458b-a0fe-13388497f147", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225851, "uuid": "7ef5c322-cac5-41a2-94d7-ca2114e27b3d", "value": "220bb2b7deba41f53a8d86d677691aff283314a29c27c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360f2749-c932-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623250305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250305, "uuid": "af831331-15f1-4bbd-b676-93e5e00b9176", "comment": "Malware payload (Formbook)", "value": "acf3846551f18e653412dbc995ff61d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250305, "uuid": "06b9a6eb-aa85-41b7-ae32-e08c9f98a672", "comment": "Malware payload (Formbook)", "value": "22a98d91ae654adf8664cd68d3e1ae9857f2b6c63c2a87283e4a794128e58952", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250305, "uuid": "b3c1a472-4fbb-4aad-8e4c-452584940093", "comment": "Malware payload (Formbook)", "value": "2093603c6227379f30255183e3ee0287c724cea6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250305, "uuid": "de2edda1-29d9-425e-b8bd-e7986cd3c99b", "comment": "Malware payload (Formbook)", "value": "41ecd7470852613735695ea0cff2f874694f5b32b25fa61b148579e80ca2bedb00d83525aa4be62d0463a2d0f5edc417", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250305, "uuid": "341e5035-74e0-41a3-89d7-5b60741a8303", "value": "A9C4BE3E77946A96C71C0DBE8567086807F0C593F673F36B2CE81ED48D18F290A1B59A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250305, "uuid": "9a1e21a1-d04d-4850-a704-30c7cd1bb39c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250305, "uuid": "8551927f-0e03-4370-a0eb-d66f2ad40267", "value": "12288:M4AdkZVFLMA4cScHfc4euuKxCiZiXurSkV6wajw:MGZvEkfDxhkerpTsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623250305, "uuid": "89d9c4d3-995f-49cd-b060-1fc502558982", "value": 560640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623250305, "uuid": "3c9e2687-ca7c-4e4e-a5c7-2bfd950f0381", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250305, "uuid": "6ecb095a-cd11-4aad-a26a-314821eefe5e", "value": "SecuriteInfo.com.Trojan.GenericKD.37066764.6014.21898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb6f743-c8e8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623218666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218666, "uuid": "02ae8352-0548-4cb1-9e93-276d0e0651ed", "comment": "Malware payload (AgentTesla)", "value": "3c972d9b4036fc45c55aa15004c92bc5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218666, "uuid": "0a0f8eea-707d-40fe-981b-baf999e4af2f", "comment": "Malware payload (AgentTesla)", "value": "23256fd1a2baa8972ee58af4aeff4ef3dc9fc095086430982f0e27f72c7fffee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218666, "uuid": "82518dc7-0b26-4f7f-9caf-0f928de2a1a5", "comment": "Malware payload (AgentTesla)", "value": "fcb9fd56f0210a0198cd044a3a1a2d443567a085", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218666, "uuid": "64267a45-e3c7-49ad-9cf3-f3b975c5bff6", "comment": "Malware payload (AgentTesla)", "value": "e1e26d151f498ef8920fa7762970fe0bed445b853b9cd2191591e1637d44a81d68453f8889880b9774c87998b3d7f2c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218666, "uuid": "57065432-00db-451e-b64d-5b11081ed280", "value": "A0F4E035224C9A48E17F9375A0B2520443F0F507E322EB4DFED858D92EA27C2D7AF656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218666, "uuid": "9827a377-952f-44f9-b338-523f1b9c3525", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218666, "uuid": "3cf99bc8-bd7d-437f-a601-e13bfcb4832c", "value": "12288:Y4+UNj15t7PvHM28Rtor0lMV40JNz22Ju0okyqoD4NK4FFZCcwvj9zvkUFMPBh4l:J7kjvor0UjzM0AnCRFFZJwt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218666, "uuid": "181fba51-481b-4fb5-bf11-663af16e249c", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218666, "uuid": "df932fe4-2738-42ba-8063-3f4f117fa41f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218666, "uuid": "6e3ae30f-52c0-4ce3-b104-f9d5091773f0", "value": "COMPANY DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd36881-c936-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1623252063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252063, "uuid": "28df13ed-39b1-493c-90d2-29ad0bb41378", "comment": "Malware payload (Vjw0rm)", "value": "4bf99105c5d9bbc157aa9d697caa3b8b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252063, "uuid": "693477c4-a4b3-4db6-a07b-a9b973f747e3", "comment": "Malware payload (Vjw0rm)", "value": "2355e659f40169ec63dddce6d88c88411b1b02f4e4ea6cc74d794dd67a214bd0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252063, "uuid": "ba8f0575-386e-4109-9f31-99dc4f1d25b0", "comment": "Malware payload (Vjw0rm)", "value": "2820dc89db92b41f33d4b0511f02e4e8682f09c8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252063, "uuid": "828ea01e-36db-4209-97ac-86ff2d9fadf0", "comment": "Malware payload (Vjw0rm)", "value": "3eee4fa6fe978c538cd61a1aac76b586a3eb83e653ced3a410736ff324819473119cfeed9a8af21db7a0cdc576b1c152", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252063, "uuid": "d3341a20-c06e-4639-8ba3-5665262b1a94", "value": "7C12AF1F53462231E0C1E345BD1ECCA84766FFA203D5FA0C5E95C991A1ABB16BED0147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252063, "uuid": "bc6a1a8f-129b-4f94-a490-62ca71ef7773", "value": "192:QguI6D8X1LVx9vawjL6NfcIkXU68PWUpMRILrNiLuMMeNFS:QTISc1fBaMLwASPNkIFwmgFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623252063, "uuid": "a5857669-db65-4a40-9895-8a257e5a0c91", "value": 9101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623252063, "uuid": "25304057-1dcd-4b0a-8891-5cfd83e4a02e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252063, "uuid": "6021bad3-726e-4752-b7a3-9d932cd475e4", "value": "IZK0MA1HJA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3181c5-c94b-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623261350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623261350, "uuid": "97d18500-4680-443c-8adc-c13d144f9bf4", "comment": "Malware payload (CryptBot)", "value": "d0cd0b55d658b5c1109f87af54cf7a0f", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623261350, "uuid": "1e404267-7ba6-4a08-8a7f-2107dc0d6ada", "comment": "Malware payload (CryptBot)", "value": "2507f070a5e9c57e22b5c3ce3b54fade48f9aba2d444fa7d0c48146a94309e06", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623261350, "uuid": "5d384b5c-6bc0-4e7f-8337-9e47aa7db751", "comment": "Malware payload (CryptBot)", "value": "6c7e977a1096c9fa4fb3e5e45a5009b42a23fd4d", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623261350, "uuid": "4c8055b0-9601-4287-b62c-2f6ce84509d5", "comment": "Malware payload (CryptBot)", "value": "5c2867334de5966db9294d3c742f116d93475a3eb0f2e4b6b12621caec89b44912401735f661965b2a6bea474b356a19", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623261350, "uuid": "c81713b8-d3f5-4f49-903d-77684c699207", "value": "CA163395BB02D076DA943D3436C94B39EE499CEF41E11C0E1A70B25FEB03DA4876EE49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623261350, "uuid": "8c10e7b1-f722-430f-9793-eaa1e4810ce3", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623261350, "uuid": "dc170eeb-78c3-4cf6-b85b-e502dc31e468", "value": "98304:JB5Xi396HjeeHPtzAS9jyDGPNped1p+PRAiJxcI3SeA3PSCuBZ:JB5s9Gqe59jyoed1pERFxcIQS/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623261350, "uuid": "41df774b-9693-4590-abcf-645516345a87", "value": 4109629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623261350, "uuid": "287fa650-01bf-47d8-a33f-b8b2abe5af05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623261350, "uuid": "7714b711-e3a0-4004-b847-4a21beb3c1bb", "value": "D0CD0B55D658B5C1109F87AF54CF7A0F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc524947-c91a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623240276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240276, "uuid": "ecf39b02-9d0e-42af-976c-0f3f5a0f06e4", "comment": "Malware payload (AgentTesla)", "value": "d5a50f741e0be017e8531eedd0071058", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240276, "uuid": "4aa943ff-7388-458d-bb41-bdabe2058450", "comment": "Malware payload (AgentTesla)", "value": "25918e7133182a6936c7f23aa76b2174f198733bcd7f6665110048a8bc663733", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240276, "uuid": "0dc2a329-738f-4332-b18a-1f2ec07b8cc4", "comment": "Malware payload (AgentTesla)", "value": "e4497751f21c664245a3644054218451deb07e97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240276, "uuid": "658bc37a-15b0-4fd1-8782-a9cd37d0caa6", "comment": "Malware payload (AgentTesla)", "value": "1173275fb787b8c8d2bdcc0507733894bb49541eaec3a44b69bec1b9863e7adbabd4a3146b6f82fdcfa4772e8bf18450", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240276, "uuid": "f03ea546-ff73-4575-9743-4b36c28069ae", "value": "25452326FE864F2BD84778367D67CB10CC5EAD047600AA6328BC774598B5239536FBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240276, "uuid": "28fd030f-d547-4748-95c5-0fc999c1f02c", "value": "24576:F27Gdh0YQbN2+OZ9E9Yyny+12CGCgUc0etsImImwC+dYJEB:F2OhU8M2b+dGyc089lFYEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623240276, "uuid": "c0bd4887-14a6-452a-b7ea-1c6bdcc2b4c6", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623240276, "uuid": "ae95f4b0-d990-4b97-adea-f4996653c95b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240276, "uuid": "44fba7a9-1fbb-4a73-bcdc-635ca5e7a8cf", "value": "PO -TXGU5022187.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec912be9-c945-11eb-875b-42010a9c0053", "comment": "Malware payload (ImminentRAT)", "timestamp": 1623258772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623258772, "uuid": "3e71bd22-3276-4131-9d48-21635954421b", "comment": "Malware payload (ImminentRAT)", "value": "0b0c312fb59de9b066f511d1296f4c9a", "object_relation": "md5", "Tag": [ { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623258772, "uuid": "9a8e951d-b50d-4b80-984e-0222cdb99718", "comment": "Malware payload (ImminentRAT)", "value": "263db47e5300eb9942a58032d14e8250ba63671582411c696794e4a670af0642", "object_relation": "sha256", "Tag": [ { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623258772, "uuid": "2271d571-2d9c-4104-95b6-407041272c11", "comment": "Malware payload (ImminentRAT)", "value": "baae0cce9c4af4c532cd1f7cc5d96aaa50112ab2", "object_relation": "sha1", "Tag": [ { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623258772, "uuid": "c700f72e-8516-4a57-835d-eaf90dc8542f", "comment": "Malware payload (ImminentRAT)", "value": "8abaeb4e367a72dd771164269b364cebd0e89364810872fa393c497aa3b88c004179ef515d351acca3c53c6b245b8ef8", "object_relation": "sha3-384", "Tag": [ { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623258772, "uuid": "b78ff87a-d0f5-4f80-9b58-48cdfece2bdb", "value": "9955331368B16FD3C40D14BA5B3AED2061698C83E141CA33B1443B9EF9B277256D7BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623258772, "uuid": "3f24fae2-fb60-4fa3-83d5-c5ac57f6163d", "value": "24576:ZLkEZCg/5mU60EyIJfPDJs3r4Uw9wLiqBzGe9ScmLn3PWM7Nu4XSuQzvJxGJEG/p:4g/E0EtJnD63rnwCdpG3+cY4XSuqvmmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623258772, "uuid": "46bc1e41-d877-4a4d-b8c4-5fe6ec643cb7", "value": 1336832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623258772, "uuid": "3eee4543-bc4f-4057-91e5-53695e1a0950", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623258772, "uuid": "6225186d-07e1-4161-8ced-144db99b406b", "value": "Duplicated Orders.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e58370a-c924-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623244306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623244306, "uuid": "9c46fd53-5f14-47e3-adf9-269a6b7f6602", "comment": "Malware payload", "value": "276bf3db434b887bb77adca0bd46e130", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623244306, "uuid": "8a78645e-1e81-4594-9532-e3b7ee31bbe3", "comment": "Malware payload", "value": "27180043ebeb8f2aa8728c5ee020fb5368be3df4e9008b8f01242bf82d5780ce", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623244306, "uuid": "b2006b76-50fa-497d-b56d-24807ca2c09b", "comment": "Malware payload", "value": "eee2be9136f2c70a28b6ca5289e73e2a38453da2", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623244306, "uuid": "fd095985-0e6c-4c46-a834-f4d5a5df8796", "comment": "Malware payload", "value": "8dde62e579e06a4ae02d1e86936d129a5c64c09bf64d6c09892d3215f10f5703d106a3c75ee89c94ff29c390f6aa9be3", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623244306, "uuid": "12148b52-c9ab-4745-bc25-fa38c38d4c6c", "value": "6F53E14AE57A3548C733E87DA46429E8FC0D7546AC50B81E1D70B44B8D8ABCB07BF26C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623244306, "uuid": "324db847-4abd-4f08-8213-2c1f3768e786", "value": "1536:LvnO2wWjlMVGoIahaDHTU6hryF70liWWGH0AeWl+R:LGCj2sTU2yF70liWW200+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623244306, "uuid": "1da9b1b7-795b-49bf-828a-28ff39efd51f", "value": 64636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623244306, "uuid": "eb959864-823a-45d1-94ef-0ec54196e8b9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623244306, "uuid": "f5006674-8733-43a5-a93c-a3547a013666", "value": "Documents_13134976_1377491379.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a81ac16-c90e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623234931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623234931, "uuid": "5aea20d9-57ab-47a6-bb66-4af5252a4741", "comment": "Malware payload", "value": "f392daf6339db0736e7d6d79b106a3f8", "object_relation": "md5", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623234931, "uuid": "59fcacae-47d6-4216-8df1-d9aea5cc9817", "comment": "Malware payload", "value": "277d1507ccfc9ee0186fcf122fbdb8f176adb0247a90eea610e2c29f98d04e8e", "object_relation": "sha256", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623234931, "uuid": "84e67c2b-636d-457f-bc57-982c299f1778", "comment": "Malware payload", "value": "f5f46b56cca10c8f9da2a13c108ff18a18873cac", "object_relation": "sha1", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623234931, "uuid": "99029f2c-2fd5-41fe-aec0-0f8eded7959a", "comment": "Malware payload", "value": "4a6d9467e1851aa12ab8e876dc8efc7a0dfe1fcf542e66115e4f0c087c0545498c3ae3b9688691b3e1a21c4f3af6fe91", "object_relation": "sha3-384", "Tag": [ { "name": "ddos", "colour": "#3E8792", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Flooder", "colour": "#DF0268", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623234931, "uuid": "b72a2d08-6c4d-48fa-ae1e-de28c76a8006", "value": "EE82861BF3E0CD3FD9E8427404874538A2B6A8709B329317665465F61E037C8EE1FAD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623234931, "uuid": "c1a689e4-1b62-47b6-9b6d-62b6e4194b24", "value": "192:RIn+8JN0hUSXJL/90s5UY6uHb291isYoiY:oNeLZasi39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623234931, "uuid": "083fb631-f70e-44c5-9aab-36c18999b222", "value": 17656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623234931, "uuid": "d4e9a71b-21e8-49ee-9b87-affe0d6bfd4d", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623234931, "uuid": "5b3db08c-416c-42f8-84b2-e5cdbfedd1fc", "value": "ssyn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34da12f1-c8fd-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623227540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227540, "uuid": "14d441ab-d113-4e5e-8891-ecf603e79493", "comment": "Malware payload", "value": "3b1224fcee5f2e973877d66d81374b47", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227540, "uuid": "33dc3dc3-e93e-400a-a943-b74d1737c159", "comment": "Malware payload", "value": "27dee096fbdbf0463ca2335b1d583acdc4f2886ca6452bc547a9efb8ae0fa738", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227540, "uuid": "f1dc24c4-0e2c-4f8c-84ae-7dfe2389d016", "comment": "Malware payload", "value": "b2368908a2ac7aa9699c1aaeeb9b9acb1903f56c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227540, "uuid": "0aa2ee56-ec7d-49de-a029-79fa3482a833", "comment": "Malware payload", "value": "7ec677dd375884fc4467f4a64fca53e6a698d4b3d721b50a0d050378f1d47faa76618f9a5af26ea11ff8932fe570d376", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227540, "uuid": "117fd49c-b104-469e-a9b0-5edf7a8fa652", "value": "40119B089D18D0E1810233CBCB59F20D94B6A0A7744ADDA9358CEEC09F0317A5EE8DEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227540, "uuid": "7385b485-5120-4e99-86cb-c57f2cd7a13f", "value": "24:tr5alniTYUV2nzeLAHrh1eXNeWWbrMT4eAkMafypV4ik:NyXU0zWtXQWWbGAhMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623227540, "uuid": "17a73252-bfed-470c-91aa-825b7c25fea0", "value": 984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623227540, "uuid": "3606d097-52d2-4205-9932-ed9846bfd550", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227540, "uuid": "2fb76288-5ba6-4ced-bd60-830fb074b54d", "value": "qwqdanchun.sct", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1fe9c7-c8c7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623204277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623204277, "uuid": "bbe3a17f-bd0a-4d8b-9c46-d1df2344876f", "comment": "Malware payload (RedLineStealer)", "value": "6778b560553932b14332994f9335eaa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623204277, "uuid": "44ef42a4-01ea-4bc4-bb91-807f1301ef12", "comment": "Malware payload (RedLineStealer)", "value": "2ae0fbbefc45004c3a7343347dc6931d941b34ab3062e4bc54efd32ba4bcbfba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623204277, "uuid": "bbecf957-4fe8-42c1-a2dc-92383e4e85bf", "comment": "Malware payload (RedLineStealer)", "value": "6197ecf78e4fbd442ff5ac46d5e637bb389f7ead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623204277, "uuid": "76dc8faf-7483-446a-b9a1-ecc234e480e7", "comment": "Malware payload (RedLineStealer)", "value": "856b90db6e84ef04e037c5c67fed0848bcb51a73a33b5e992ad9e906ae9d21e52b857ac84d2c01cc1ff7d7cffef1f240", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623204277, "uuid": "333a4291-d609-47fc-974d-499976341699", "value": "8AB39E2EA76E3C33C7BC09F59981620A47B5E183B741E3DB4DC4E4E61983BD316216A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623204277, "uuid": "7770cf6a-6b85-4749-a48d-9a8d7ea1eac8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623204277, "uuid": "ec062341-9450-428c-88b7-6a52b706dc73", "value": "3072:cItEdenBKqHAP7YBsmG0EL6wVf9vKezCoH4/:cmEden0UsmG0fwV1IC4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623204277, "uuid": "cce59d3c-4bae-4f7f-8dbc-704699b6d608", "value": 116096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623204277, "uuid": "39407edd-60e2-4b9d-a6ee-7fafed340211", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623204277, "uuid": "068ec7f6-c27b-471b-a35f-08f257716e0b", "value": "6778b560553932b14332994f9335eaa5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8547533e-c907-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623231970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623231970, "uuid": "f8c20d69-242b-4c77-b49d-cb8f5015593f", "comment": "Malware payload (GuLoader)", "value": "99bbf83abe9d6e4ecc91493e32230833", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623231970, "uuid": "c3ca9089-c1cc-47ea-8399-c820982cab5d", "comment": "Malware payload (GuLoader)", "value": "2b2a00650dc91d1a7ccfa4a62e3462762c62d8a092bddb75943f87074f1d56a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623231970, "uuid": "55ee5547-782c-46bc-9ee6-b42f07833306", "comment": "Malware payload (GuLoader)", "value": "b0bd6ba2dc10eb5552edc7a3460c80ee0eb1b11e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623231970, "uuid": "2cc775c6-2c20-443c-963d-91e2fc7a67cb", "comment": "Malware payload (GuLoader)", "value": "1a4595791f4655aaaca1f97ca347b337ec11ca09b12334c338ee4e64da17a68ff11a5261195d69b0f55ad9e270ced4af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623231970, "uuid": "e1b55cf0-11b3-4e84-8c91-ad55a4a293fd", "value": "93E33F21BA61E227E04480B4FD49D7DEA4013F721E9F9903368D7F5A503E3DBAAF1916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623231970, "uuid": "f1899a1d-0c48-4c07-b400-b1a2cf2b0918", "value": "9b8686288ab82fdbf8ede30bc55c83b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623231970, "uuid": "295bdcbc-1cfd-4b98-8675-ecfd3527927f", "value": "1536:Fttu3FssKUmvr9DJ1FJS1bQNZ6bp/+Dtr5m3XSt4lYS0eXJWUTFboob:ztu3alxx3fSQmbs55r4l6eXJWUB0ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623231970, "uuid": "596f2820-439c-44e9-9d58-06b590f09d11", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623231970, "uuid": "ef4563dd-40a7-4e4b-88b2-ceb6967eb728", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623231970, "uuid": "6cb32210-7750-4a15-8db8-2c1398020f54", "value": "SecuriteInfo.com.Variant.Jaik.46242.3594.22390", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fbd903b-c8e4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623216955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623216955, "uuid": "0a811be5-3c9b-4c90-8791-1661fc3164c8", "comment": "Malware payload (AgentTesla)", "value": "a8a1665a26b22524c5f27c246e508f02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623216955, "uuid": "6e123a0e-27ca-4514-8c76-a68f32a3357b", "comment": "Malware payload (AgentTesla)", "value": "2bed0e1e9a4dd0aaae978392756979870aec90ae60d6ab7e13acaf67360f85bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623216955, "uuid": "82975ac1-f43f-49b9-8e29-fac68855dfed", "comment": "Malware payload (AgentTesla)", "value": "85e033066ce7e811ad8edd3df04166701c4645d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623216955, "uuid": "2d1e9fab-6327-40a2-abf2-e16ced779eec", "comment": "Malware payload (AgentTesla)", "value": "e18bce267aec83fed3f50b32495ba49529d3a3dcc2c3984019c71d1cb2fe5c3da008f673c29ccaee4c39c0a02c9e930e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623216955, "uuid": "3d1f9a16-bc01-4ffc-97ac-126a3faa2a16", "value": "D5A423AC17D8B304A6029D52C89270855633FCA32E98D1F5BD23C77B9F8D25BADF0648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623216955, "uuid": "6d8e38c9-3ae0-4773-a1de-33081d9558d9", "value": "12288:ZoIkTmcw8U0e4yHDaZncQ362D86p4X97wMqgZ3V6ev6+k:NkTRw8U0e4yjVh2DfJcv6+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623216955, "uuid": "91384318-723e-4319-a2ad-9b18cb42be5d", "value": 468572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623216955, "uuid": "5553ec02-0550-41e8-9678-2b3b3d95738c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623216955, "uuid": "8b17b1bd-587d-4291-9925-eccb372e26f7", "value": "PURCHASE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83375a8c-c935-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623251723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251723, "uuid": "377ed34e-94e8-47e5-98e3-372e9b999240", "comment": "Malware payload", "value": "008e2b469abf7058701ed9809ba1f949", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251723, "uuid": "07be7b4c-d9a2-4cdb-a5b4-2ad159d17cb0", "comment": "Malware payload", "value": "2d659e7701fdd879c933ca2f625d7183810342fd79a75d476dd68f4c3b8eeeb4", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251723, "uuid": "4de376cd-eab2-4a18-8165-fffe5efdac96", "comment": "Malware payload", "value": "d3c7adb371859497a0e3b61796a9469b1e9d1721", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251723, "uuid": "1fc5e74a-2057-4b22-833a-4885764bd170", "comment": "Malware payload", "value": "0fdb156d3ce9459139296128265ce84b867510f1e29225b140a589e7fcb868d4b974157de864d490e7193ff466a15dec", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251723, "uuid": "c8a086c7-e9d7-42d5-9e5f-7b44efaa0df0", "value": "3AF3028F6120B0A9CF5421396283FDA15E25B61FE901FE5F2DE46F8295350E7238D27B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251723, "uuid": "66ce658f-4c8c-4277-9811-05e18148660b", "value": "3072:bzjTemXbxVymd1xXPMU9VlUBWA6CFvA7bRCxAVIKxS6:7TecbxVyWxfMU3liWA6FsYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623251723, "uuid": "9b54c167-5baf-4caf-ac09-84d2721e52de", "value": 157733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623251723, "uuid": "45852fae-bb14-433e-9dd7-ab55bdcf9e0b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251723, "uuid": "b995c4bd-8405-4181-996e-2f7a2e42eb5c", "value": "008e2b469abf7058701ed9809ba1f949.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b569d816-c921-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623243217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243217, "uuid": "563eeb8c-c5d0-446d-888f-640d40db983b", "comment": "Malware payload", "value": "e7ac427e37ffd44c766d3f40ab7faeb7", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243217, "uuid": "80ab0231-76c5-42e4-82a0-51a3ddfd0339", "comment": "Malware payload", "value": "2fc07925618c7b77227339b733da4300afb816f2d1cee0ca533cdd7d121468d6", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243217, "uuid": "b08c2343-4d95-4060-b79c-ae24c0307bd7", "comment": "Malware payload", "value": "6d08a6f8ee1fb04a2c5c50f4875f368d45de1fd2", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243217, "uuid": "ba41f45f-966e-4318-a4e2-57cf8c72b42c", "comment": "Malware payload", "value": "dd85ed9a294f641da9d4e039e59030c4e4ee28c7ba6804c64e487e5826988173b7c89f993ba75d4476f6526c0da82619", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPWiFiStealer", "colour": "#5CE0A7", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243217, "uuid": "56205d50-41d5-4b1b-a241-eba1356b8f07", "value": "D121727319C192030312E386B6508C6CD724A8069992346CE2EE894E90E1FE36BDC2FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243217, "uuid": "8ab95499-f2e4-41eb-9173-57b804e8c0dc", "value": "24:paP4mXjvTCkLKCPW1z+eEGqBYZbxIkyyD++ETTTQ/Tviwdy:MxTvrtW1z+eviw6yri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623243217, "uuid": "e9051fec-abe6-4b15-a758-def9539ed7b8", "value": 1297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623243217, "uuid": "0dcab09b-f9b1-4244-ba52-6e370aea02ab", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243217, "uuid": "157e9460-93fe-46fe-9eb0-97bba5e85f6c", "value": "Hs1Vhicq.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01dccb77-c8e6-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623217576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217576, "uuid": "6d8e7f1d-5768-4d34-a924-e85756b1201f", "comment": "Malware payload (Formbook)", "value": "26ea34fa6d0cb2f11edb8df84953b739", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217576, "uuid": "736303a1-48ae-4fd0-a7e4-e25704b03279", "comment": "Malware payload (Formbook)", "value": "3248fac227ec9ff6f7ec911825f76acaacb4fdf56e90ca17880c8e10d9e9f5f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217576, "uuid": "72791f52-ab05-4785-bb04-d0211f1d5477", "comment": "Malware payload (Formbook)", "value": "c4ed958ae6c50434085d4e29058907949d1dc078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217576, "uuid": "7f6115d5-8887-4003-b80c-88c87552b175", "comment": "Malware payload (Formbook)", "value": "999fbc802619b174f53c551e83e4a3e93c8e787fece3dd75016a32921cd9f63d3d6027be147329959fc05a14bda18aab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217576, "uuid": "7b29f55e-58bd-464b-89de-07938a137002", "value": "B505F1263684AA02C3AE1532CDDF401887FA9E433673EB697D9C33DD0541793EE159EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217576, "uuid": "94d30edb-8b4f-4c4f-a990-8e7531c67609", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217576, "uuid": "fe3b7ca6-c6cd-4730-b968-e1cbbc921ea9", "value": "24576:MncFUVYtXiZuQD2AxfQIxcRu93nroXtdZRI/Fi:MnEUYtXiZhCi3c093nroXtdZa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217576, "uuid": "99b69f9e-6c07-457f-8798-7c8663dab744", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217576, "uuid": "4918c2ee-9e6f-4f0c-a77b-b9689aa75c23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217576, "uuid": "50f86f99-4be2-4cf4-b95f-ef2020e6a287", "value": "SecuriteInfo.com.Trojan.GenericKD.37063913.24539.13982", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b85e2f-c92e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623248506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248506, "uuid": "6332d934-d86a-40bd-8aa5-347ca9fd210c", "comment": "Malware payload (AgentTesla)", "value": "6c6de7ed8eeac54959381f442be47d17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248506, "uuid": "d8f122ea-3369-4db5-b9b4-13f848f0a277", "comment": "Malware payload (AgentTesla)", "value": "3297c3d4fed62a0be84753b3c3469f74419acc2624fe8895e9ab2b686d3a3c36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248506, "uuid": "438bdf31-bc5d-4af6-ba86-d19c267e5f59", "comment": "Malware payload (AgentTesla)", "value": "b9220a53fd91cf07b133ed61554c9002ed9b9dfd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248506, "uuid": "4f71c1c5-a3fe-4d41-8279-9aaaa9c312cf", "comment": "Malware payload (AgentTesla)", "value": "319f1de7abf8ed6c00fa1f1d65cee0dbe7a5b2948b93a51304e8c68fabf87053df4e00748de1fa5cc6a8c5456ccd8a73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248506, "uuid": "8e844f3e-a4aa-420d-95cf-6d5cd29eee24", "value": "6EA531622CDDB009EA76AFF25BE0E5E7C71EA7EE1B065C2932704776051350CCB8197A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248506, "uuid": "db24b414-a751-4869-a3c1-b821ea772ce0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248506, "uuid": "1170d8c4-eb96-480f-9bbd-a731e1361137", "value": "24576:ojejZjUjUjrXTKZhdKnF58cmBgqq9TMJriByUEAArEts0Q:9TKZnKhv8A2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623248506, "uuid": "24954321-964f-453e-91a8-c044da176829", "value": 2113024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623248506, "uuid": "2f0d4c49-8bf6-4ac7-9765-8485fb91a11e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248506, "uuid": "e689c5cd-a7c8-4289-9064-bf54502c85ab", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d36166-c94e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623262564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623262564, "uuid": "a50c5f4d-1063-4dd2-ba5c-91ceab181933", "comment": "Malware payload (Loki)", "value": "22a72d3487bdcfe4e9dbbf908913207d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623262564, "uuid": "31d432c3-fc47-4c3b-a44a-0d5fd2a5127f", "comment": "Malware payload (Loki)", "value": "32c101c0259ce872165dadab40dba3a06ba25c28d4c544d062fb8ee8f7c1ade4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623262564, "uuid": "37c3d7bc-2dd7-4e3f-8a28-5ce01748e745", "comment": "Malware payload (Loki)", "value": "4384f3089f4cd00a643fb03cac26e5173621d083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623262564, "uuid": "eb080f9d-1468-499d-97c4-9050e5f519bc", "comment": "Malware payload (Loki)", "value": "69b2d881edd90edeee9efc81e3c9f691ad6534f0fddee0ed14816b258db83d358e57c74827f8cf80eb1866a5555e8e22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623262564, "uuid": "11b59daa-69cb-4031-a757-c5e4382268c1", "value": "6805CF6C8D44EB4BF3BC027594B49A3CC3FED82B8B56C5456DBB64EDCA6AFA43411102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623262564, "uuid": "a74e7837-35d2-4926-8ddf-4c05332fd186", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623262564, "uuid": "866e5220-5e1e-410f-9c16-8485eef72c1c", "value": "12288:rv1z1yyBjlMV40N9eMhpHzIHSJzGlAuAvUwspXMNpNB3p/rQMou6zK/iwnu:r79jUHe2pTIMqWuAvYpXuB3FvsK/iwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623262564, "uuid": "6226da27-a00a-40e0-9cc9-a7df70d94e53", "value": 841728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623262564, "uuid": "de84e671-0600-4e30-b6a0-40ce58d42330", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623262564, "uuid": "d43f6a18-d387-469e-a7ab-030cb4418089", "value": "Cotizaci\u00f3n.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827bc7ca-c925-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623244850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623244850, "uuid": "04a53b9f-cab1-4cb9-a0c9-6991def78832", "comment": "Malware payload (CryptBot)", "value": "be891367a9a7f020097506d3e964bd08", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623244850, "uuid": "a00b1d34-ad1a-4509-bed5-35bee8b0c0b3", "comment": "Malware payload (CryptBot)", "value": "32ecbb31b795b66ace206da2ca93e22f05a002d070ba5a5965bf89c0c91beb82", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623244850, "uuid": "746825b4-fff4-4486-978d-56f7c4abec17", "comment": "Malware payload (CryptBot)", "value": "4ae27f5a2ec7c7aa26ca725d79397e4645c807c6", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623244850, "uuid": "65b5a0be-5a01-4cd1-ad6c-9349a4443d70", "comment": "Malware payload (CryptBot)", "value": "2e9a4b5cb7cfa08e2abc9ce2710a445aa9db9e9f71ce0d20635c7728200b89ee069907abd6281a22911042d0ddc36889", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623244850, "uuid": "9959e7fa-1302-4d63-851a-db13bce4b50f", "value": "2C32B60177E84A10E6BF8B782DB343211671FA568D32CB5E1CC6429D5C72B94CAB2F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623244850, "uuid": "b9b280e0-a799-4b10-8ffa-2bfd056ed457", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623244850, "uuid": "b9908a51-b713-4f06-80f3-311d1e760152", "value": "192:dD5G0QXE2YYgL2pA+On9xLrkYT00bOTFi7Dgvlnnh7/r+5d:dD5G0QXaq49xLrku00aTQqLa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623244850, "uuid": "51f37ac4-75e7-4c36-874f-46a6283df636", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623244850, "uuid": "6c73f5f7-629d-4808-959d-f8bb70122404", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623244850, "uuid": "b0bd2f7e-9c50-41b9-a33c-e02a2cef61a3", "value": "4ae27f5a2ec7c7aa26ca725d79397e4645c807c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c029391-c923-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623243900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243900, "uuid": "503ed4b4-147c-4ec8-88bb-039ce6214c4b", "comment": "Malware payload (Loki)", "value": "b30cbd3143ed9daaa1525a6b8b4eb592", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243900, "uuid": "d874d688-644b-4cfc-b312-529afc248eef", "comment": "Malware payload (Loki)", "value": "3370882264de064e542eeb61d27f80ff62d4e4221ef5de03f9f5efa6b5af8ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243900, "uuid": "b86e9f4b-f544-4fb2-ad54-ef2e54c90fb7", "comment": "Malware payload (Loki)", "value": "4154dfe2128cb2ceb6dca04299d8e5394eef0880", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243900, "uuid": "0a74fe40-bb30-4148-a1ab-6b48e3308ab5", "comment": "Malware payload (Loki)", "value": "0e9e40200d1e3c9ff9c3525e61e483224fada34e4dc390e287378ba5369fa797cc0f210db595717d9a7e43899576f40a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243900, "uuid": "f6686060-1c6c-4792-a8ae-b56dba1de19c", "value": "B1E4D0252B449B28D17F977A8061410487F5E503C323DA8EFDE689DC2E323CAD76FA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243900, "uuid": "e6b7cf9c-09f6-48a3-bd78-91f63f941b2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243900, "uuid": "36837a7d-351f-44c4-93ed-28d5520de9a4", "value": "12288:OJ+GlMV40J+1QEb1jHhNQw8te9TUK36oQAqTmi:OJ+GUdEbZHnQwNTJHqTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623243900, "uuid": "559895a5-ac0d-4943-a4df-0c70025b492d", "value": 687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623243900, "uuid": "4261bd39-c909-4ea7-bed8-70e0c0cedce9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243900, "uuid": "e878997d-0d38-4afc-944d-4e9ca813371f", "value": "Bank account info.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7392802c-c8e5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623217337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217337, "uuid": "48629f53-3703-4780-8cb3-b97fa4890651", "comment": "Malware payload", "value": "86b63601140901937ce3d9d4d27642d8", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217337, "uuid": "e7f6d67a-ce75-4043-a6ca-c5e1d9222127", "comment": "Malware payload", "value": "34e0fc5b0b161819a322ae04d5696080b15819e7801809221a6e0f809da3e4d4", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217337, "uuid": "a03b3557-e077-40e6-a0ea-b9195448be6d", "comment": "Malware payload", "value": "31247519f12de92794b153a3b85d25120e913c1d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217337, "uuid": "587ed983-e175-4007-b5c5-a21a73088b28", "comment": "Malware payload", "value": "2e5affedf17df8356938f3edea69eaf4e67d34c49edf02e663e2a23ee2869ad2da578ecc7a6ccb41248b5ea422c66479", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217337, "uuid": "31f03de6-1b54-4e98-9d56-b8f1a562a19c", "value": "5B553344CD84CB4AD626C5B8C40BFA909486CC45269BD3D763BEB52ABF337F4118276E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217337, "uuid": "22117824-5acf-4fb6-9fb3-7a183f90fc54", "value": "24576:KnN7rinmnNISnpkbzh69ZcQkLMrFWaG2bTsqnF2k60ne8jj9Stx7ccwkx:KnN7enmNXuh63iMr0f2b4OQkdLQIcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217337, "uuid": "ac621230-f7b2-451c-9135-58c7f23cb2ca", "value": 1393152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217337, "uuid": "02ce1d36-6b6e-4bb8-845b-f81e802ed0e6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217337, "uuid": "20042bd1-1d38-4436-9591-1a7c50823f90", "value": "KYC Compliance 10031.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e03657e-c8e7-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1623218241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218241, "uuid": "b84d082d-3921-43a2-9683-064023291916", "comment": "Malware payload (ArkeiStealer)", "value": "adaaecc4f0854d9bd8faafa8582a755d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218241, "uuid": "5c5ca5c1-4b00-435e-9634-c3bf0e983817", "comment": "Malware payload (ArkeiStealer)", "value": "35404e223636c2a102d09b94a72df533271404fd00edf63c6c1ee43d3282b54b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218241, "uuid": "6f72ba7f-2b44-4cbf-a11d-85f85d7ca300", "comment": "Malware payload (ArkeiStealer)", "value": "95856c417340327f8ff16e5da75ef69daced2b86", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218241, "uuid": "03650f28-da0a-4dec-9ec8-fe9ae798979a", "comment": "Malware payload (ArkeiStealer)", "value": "287d26e45a6d289d76592b1bc35efd0dd56393f7ee99cdfaa0db2979e58ac7882e9aeb819e26d9176982396721c46f15", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218241, "uuid": "5d54fa8f-440f-4978-a722-2ccba1de7a67", "value": "52050100A6B1C039F1F356BA1AB593A5A93B7AB2677490CF12E526DB57347E0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218241, "uuid": "c644d5ee-ced0-483f-8912-1c5e97e69112", "value": "724fc268cccef646d4517481c9e2932b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218241, "uuid": "d989cb5e-75ae-4a2b-ac3c-7c01a6d73049", "value": "24576:FEIt1ZQw8m5FcovJw7/KijwMCg4qkDLLu:ZHFjxe/KawvgNkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218241, "uuid": "db91c1d9-e735-4cf2-bd7c-3179598745a1", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218241, "uuid": "b9d0c0e3-773b-460b-a759-30c0be105476", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218241, "uuid": "b6f34d34-931e-4e28-b277-2732510dbe23", "value": "adaaecc4f0854d9bd8faafa8582a755d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df4bff8-c974-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623278773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623278773, "uuid": "de10bf13-85cc-48ad-b1b2-093b2e5479e9", "comment": "Malware payload", "value": "90555333e767c4f1254a74fa8a793d2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623278773, "uuid": "e88fe6f2-f75c-45cc-a43b-180cbc6d357d", "comment": "Malware payload", "value": "3698d2855e9efa5979d94dad6e2044627134de86015421ebf548682400fe2163", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623278773, "uuid": "5e04b661-b832-4144-a122-c833e4dd11f6", "comment": "Malware payload", "value": "5400ff76e2f46ad026e501c0a90cce36fa43c631", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623278773, "uuid": "54be0902-2754-4ca2-9111-b0add9630e7b", "comment": "Malware payload", "value": "3f38d00c37e9b5e5de4197fd5f08eaaa6bdbcf33375b8e1187cd7d87403436dcacf45463aa583a5c07378e4b2c786a10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623278773, "uuid": "aa6e880d-9c75-4a3e-b163-7eccadbacd6c", "value": "3075BE191BA742A2DB153779C9B696A409191F431F28C0B66E310D1EBD2724FFC23EBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623278773, "uuid": "39f257fa-93ce-4541-ac81-1d0573a14051", "value": "e46104cff241b795c3b20f9431c74064", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623278773, "uuid": "93cc8f58-9024-43cc-86a3-98e76921baca", "value": "24576:mJ24dUNXvw/O1yKYcQXYhpQAvdjeTAbwW/tCTEWChPGK:mptWAYJjeTIqToZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623278773, "uuid": "da80bc6f-f47a-44d8-b771-ea29d3d303c1", "value": 1568768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623278773, "uuid": "0fd29413-0104-4353-85e0-626e856a76ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623278773, "uuid": "6318aba4-c823-4589-8b02-8f82eb01e7d2", "value": "3698d2855e9efa5979d94dad6e2044627134de86015421ebf548682400fe2163", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfe96e3-c8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623217434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217434, "uuid": "3a4b5d83-b153-4a81-9603-524618336184", "comment": "Malware payload (AgentTesla)", "value": "8f09c2a64edb392d6791d2ad5e504128", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217434, "uuid": "83b614a9-6f87-4ef4-9965-c83a646b5d20", "comment": "Malware payload (AgentTesla)", "value": "371855b80ef1a4d99ea78f2804e06f2c9ba390e23dc03aa7db1fa644ee16108f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217434, "uuid": "20aea58f-18a1-42f2-b2e6-23675b1098f1", "comment": "Malware payload (AgentTesla)", "value": "bcc55f9fea68f7eda0c59e8ce62dd72e7d7300d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217434, "uuid": "c1456699-0041-4fd9-943f-69ec8752a328", "comment": "Malware payload (AgentTesla)", "value": "14505b36409fdfc066b03a5209567ccaca4e45e23340b90b85d185a9df91a75da7c3f65c7741ee8f468de65dbf83b503", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217434, "uuid": "bca94ede-462d-4787-94d1-bf704daf9b36", "value": "FAB423751831AB3D22D360A4B11F3A7074AB84B13B0FC90EAC38F52D45D9AA52D974FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217434, "uuid": "cee209e2-d937-4e0a-bef0-9d7e0983a1cd", "value": "12288:YIRSAuj8SATs352FweAx3FbgUMvydKNpxZwtjZayYwOfe6A9:YIR9SYspbD3FbgHMwyROfej9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217434, "uuid": "a20ff5c0-7ddd-43e3-9504-4e8a6d1bff4e", "value": 535474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217434, "uuid": "977ab3ab-21b1-43a2-91cc-8ca43e3ab9f9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217434, "uuid": "a6e283b8-d1b0-429b-8db1-88d525d192ef", "value": "CCSX09B00730_drw-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fbf4e3-c8ea-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623219326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623219326, "uuid": "c8dd6592-4c73-4789-bfeb-3bac63d4607a", "comment": "Malware payload (AgentTesla)", "value": "a021ea74b595cfdebde6ba5ddbcae942", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623219326, "uuid": "6b186a98-f263-4e4b-abe1-c7f36373d8b5", "comment": "Malware payload (AgentTesla)", "value": "3a0fccb87c875ff0038def1012996cdc15c18559073a2ee1a4521177fbf373ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623219326, "uuid": "c8b0c58a-e5ba-4497-b640-290a958b9a62", "comment": "Malware payload (AgentTesla)", "value": "cf105a2827c814af18ad2e395a85ce4632702bf9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623219326, "uuid": "15cbe51f-a7a6-4842-9401-8de34b6d38c1", "comment": "Malware payload (AgentTesla)", "value": "97d1f449a48cd841cc41415c91dcd225775021217001126f853edc3c34a8b67a6d13ed5287c69e35900b1558e33ffe84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623219326, "uuid": "56fca9b8-286f-4513-a5ad-91cddc121baa", "value": "F7E4E025224C8A55E17F9336A0B1110443F0F547E722EA4DFED858DA2EB27C3A36FA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623219326, "uuid": "b4f149fd-76b1-47ef-8c59-748d86866d48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623219326, "uuid": "812d5540-e0c1-48fe-808e-438a08bf9497", "value": "12288:LyUkX15t7PvH8bFvfsujwF3HlMV40JllefiJlY9jkMyVCcCLl4+8Qo7WdvnaCU:L/v4F3HUSirYRuvCRL8Qoyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623219326, "uuid": "fd584bb8-baf1-4550-a7d0-ed83a4492b0f", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623219326, "uuid": "ed332d6d-a6b7-4df6-9734-8ecb15ec0106", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623219326, "uuid": "9ee47da7-3d91-4852-946e-a90c6907e33a", "value": "9JC4DGYYJOSCZ0E.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55403812-c937-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623252505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252505, "uuid": "6f72c411-6435-4791-a05c-a6a958e242f5", "comment": "Malware payload", "value": "354ee90263324538a2f5ecb524a17ac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252505, "uuid": "73928770-a271-43dc-accb-b224cdb99abf", "comment": "Malware payload", "value": "3a34600201faac1dd440ac084c1fa238312a6f51c6500b814fd50197f600c3d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252505, "uuid": "47d62786-7712-4d1c-a0b7-9a9e2be7865a", "comment": "Malware payload", "value": "3245fd1c9d1ce9443a216fe2293bb8b05d3a7c18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252505, "uuid": "be838ac1-7088-49f7-a025-375a0ad7a973", "comment": "Malware payload", "value": "9012cb437c42c1001d47b67c28a9a518e18743dcb04042f9805a7b4d00cc2a3665989d65a206ff52d0301449f201eeb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252505, "uuid": "1fcb66fe-6a84-4202-8960-30c81149595c", "value": "D6923C476762C0D8E1AAC239CE65C93AF072B5221323679F37B4865B0F71550BF2AF85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252505, "uuid": "87b53168-8ee7-4d43-99e1-f7afdb88a587", "value": "a032950828fad364443f14852450e96f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252505, "uuid": "16a62e31-315a-4570-a069-e2ed23f7a9c6", "value": "192:bbSLMYfo9rHDNT363UPKqlnd6Z79Xlr5rYTAl2Zw3Q5tfGDZOOFW:Pydfq3eUPKLZRN9liw39O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623252505, "uuid": "6d08dbbb-cf27-4fe1-be54-323ffee322e6", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623252505, "uuid": "4be1297d-532e-4049-ac31-3431ae4d2d37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252505, "uuid": "3e0b3d91-469d-441d-a43b-56b6980046d3", "value": "tat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62fba129-c8f8-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623225470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225470, "uuid": "957c41b9-a1bc-422c-93e9-93274dab5e0d", "comment": "Malware payload (NanoCore)", "value": "845d5dc8393bf7652f744e7fa7dfb3c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225470, "uuid": "6848326b-541b-4f23-ba83-7d55c197b2e1", "comment": "Malware payload (NanoCore)", "value": "3aa4556bd929b55c5a51ea8cd76865fd4e27b880ec483aa8a94582071cdef24d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225470, "uuid": "3788203b-bc2d-45a0-bfe0-575a028529b9", "comment": "Malware payload (NanoCore)", "value": "f83096a377039cfdbcfb930a98fd1b78691c4456", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225470, "uuid": "1c14cd29-8a15-408a-8415-a49c682a29cf", "comment": "Malware payload (NanoCore)", "value": "f51ba22e205d48ace8ac0801e8eae819104401e5b094a5c9959fe3f6d36cf8777fa8c61984a51e477c63738ab8772888", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225470, "uuid": "ff6cb3f4-b794-41a0-9913-31060e47c1df", "value": "392506AC319075DEC467CE768AA82CA4EA6164775B0FD203901705EDAA2CF97DF106F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225470, "uuid": "8b995bf9-af9a-48da-ba23-9b2fe3a47a64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225470, "uuid": "764ee0ca-a8ea-4952-a934-17cd6e1a5c84", "value": "12288:c1mk+vR1Hup6Z7Q/pDTXWILsbGRzcmtCN1/LFk6Hq0cpeTHKMgAbCZBvqpjExD07:Ox+vDOQZSz5UQRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623225470, "uuid": "69dbb683-57be-451a-832b-90800712a678", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623225470, "uuid": "602d65db-7d0e-41e9-b7de-26e6c9abb604", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225470, "uuid": "b134612b-0852-4237-8827-f16452e0a1e1", "value": "payment invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f46c950-c8d7-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623211156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211156, "uuid": "eb5d2f14-8c24-4b8e-b56d-28333f8739eb", "comment": "Malware payload (NanoCore)", "value": "18e38261e8ea6ae0077c5448f809ccb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211156, "uuid": "ed7cb3e3-a925-44b2-9d21-be4c805cb3c3", "comment": "Malware payload (NanoCore)", "value": "3cb5c285d5e7f163c9764ef3e99467f5460b7f704c996ffa8e5e2982a2a86693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211156, "uuid": "078dafb8-70de-42a8-a08f-1420a53bb31c", "comment": "Malware payload (NanoCore)", "value": "bbfaf42987014ba9571c75d1982843d7ad7155ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211156, "uuid": "60f3bd3d-0289-46be-af1c-2b5087820bde", "comment": "Malware payload (NanoCore)", "value": "176c7d0a424babb2e8bc537541efbc19a171339fb57bed9b3a77dc423c191e17fd947ad100e27d00e9dc8596477b2185", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211156, "uuid": "e6dedadf-0ee6-4291-8e79-fe53edf1adc9", "value": "C605E02522488A55E17F933590B1150443F0F907D323EB4DFEA858EA2EA37C2E7AF657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211156, "uuid": "2d5e7585-822f-4aed-bfb2-7054e00f785e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211156, "uuid": "aebcb4f3-47d1-4bf4-959e-e509f569d869", "value": "12288:qB4w15tyPvHv4nO1eklMV40J4o9MBfpXjgp6PSPxM6Grfs768VN21zX4y8:qY4O1ekULCXgp6PSPxMtE768VN2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623211156, "uuid": "62e131c7-728b-4c2c-bdb3-4fcdc97afd02", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623211156, "uuid": "1b67bc98-5863-412a-b485-ed39fe6f91a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211156, "uuid": "d9563311-c17b-4691-b197-c153cf11f689", "value": "#RFQ ORDER484475577797.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b51a7d-c963-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1623271266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623271266, "uuid": "6327b599-6102-49e0-ab01-2eccf76ed800", "comment": "Malware payload (RaccoonStealer)", "value": "89807de693c5d845d463f6da8990befd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623271266, "uuid": "3ccd438f-0b90-43a6-b1ae-72fb0e1ba982", "comment": "Malware payload (RaccoonStealer)", "value": "3d30ffd438512742fc01ca5df9c4b9d0deb9f908ef56e7dd3e284eec904f517d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623271266, "uuid": "027345b3-375e-4cc1-9497-d9055a57c5da", "comment": "Malware payload (RaccoonStealer)", "value": "87c57a25a1837cefe066411f61e89e4d3617707b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623271266, "uuid": "eba184c2-cd86-473a-b5c6-8520f7ab829e", "comment": "Malware payload (RaccoonStealer)", "value": "2376dad8e0ede51a6c27af1f198cec0d503f297930118e14487b1cc112e014ab1ed4f22d55a21366fe65452310e0e1fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623271266, "uuid": "8fda01e0-c715-4acb-8f51-6be835ca0328", "value": "C8063311BDC0C8B2D5B51E774C285B22553D7E211F298EEB67E49A9D89301E0BB30BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623271266, "uuid": "6fdb1684-2ece-43a5-9208-0578086f00b4", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623271266, "uuid": "a52ba783-a1bf-4e4b-8c01-b99d363724c8", "value": "98304:UbnFZeT8F+BmZ+DrZ3smjx/KNLTBXSX47C+kyZ9k2:Ufa8F+cAJcNLTJSqjk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623271266, "uuid": "90db061b-7b50-4042-b122-edd699a3534d", "value": 3980457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623271266, "uuid": "ec7cd6f0-73ef-4e02-8605-62c6751bc5b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623271266, "uuid": "bb649caf-327f-4d5d-9532-dcbae6fa5202", "value": "89807DE693C5D845D463F6DA8990BEFD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103fca89-c8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623217171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217171, "uuid": "296308f6-9596-4bc2-a940-eb092aad41b8", "comment": "Malware payload (AgentTesla)", "value": "16b4d5403bd2bbf89c69658b954a5903", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217171, "uuid": "22e1ee24-ef5d-48fd-882d-5250ca548444", "comment": "Malware payload (AgentTesla)", "value": "3ecb682b2a36d695f9449a8f7ea067a8193b3955efbcb47ad72ce684f25b884e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217171, "uuid": "23dad4c7-aae1-4c62-917b-9725a422d1c5", "comment": "Malware payload (AgentTesla)", "value": "d5f7f67d6aefe8462ec2a8be26d552ec0f078f63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217171, "uuid": "a9679e95-036c-4d1e-b953-dfeadb8dafd4", "comment": "Malware payload (AgentTesla)", "value": "4cae687cfaa5d1a519176d5cd3e70bf48f622968264db836f8f1966b1192c11bccbd0a959601efe4964bcb1ec0b0324d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217171, "uuid": "0643fb1b-fa90-4364-9128-e061b06a0073", "value": "F5C423804255BF89FB08D3D42C37420895608DA89BDB0A795EA45FBAD5C7F6BB42CCCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217171, "uuid": "faae6cb2-c25e-4f3f-8016-1e157e681725", "value": "12288:pppNoXYTElfGrLDGMUnExOeeQHDOAyu42lWk8dLKfpRcm5:lNooEerLTUnnyOBu42lvsLup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217171, "uuid": "5cf6c187-7964-4415-83ea-b68057ad3ca9", "value": 564856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217171, "uuid": "1456ea87-8aed-49d4-8f0b-7761cb0c6415", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217171, "uuid": "f44bedfc-92b8-442e-9c7c-e7fdf53d2902", "value": "Urgent Request for Quotation- 9957801- Front Office Europe and Asian market.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5233123e-c8e6-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623217711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217711, "uuid": "b4fc5015-aa39-4b53-9579-0934eb4e87e9", "comment": "Malware payload (AsyncRAT)", "value": "b82b657f2b51d3a32e7b05398ed1773d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217711, "uuid": "f50c72fb-48a4-4bc7-b92b-09af215bbfde", "comment": "Malware payload (AsyncRAT)", "value": "3fb3e734e2197f17c9d058a9001597ee1431526758407e59bb10f84d0855bb8f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217711, "uuid": "e33868c9-fc74-4789-9429-1fa16a2afb0c", "comment": "Malware payload (AsyncRAT)", "value": "96f60544a9f9f40533012b265346f81109d4a563", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217711, "uuid": "1d4c5430-aed6-4118-a896-aa2c1d92c459", "comment": "Malware payload (AsyncRAT)", "value": "7fa7b42dd0136e9eccab084f6185c4727cee33f9289345dffbe279499414962cdb2896f3d95a6c705fed6b064e337524", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217711, "uuid": "1b0d082b-94c7-4358-ad77-3f55e23c7b71", "value": "AA05D4AC31A075DEC467CD768AA82CA4EA6174775B0FD203901705ED9A2CE97DF206F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217711, "uuid": "5f1d6693-e9f3-4654-ac54-9d486ce1a741", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217711, "uuid": "9da534bb-675d-4033-a2fe-61deb8efb185", "value": "12288:Wfo3pX2n8SeCNFvbvqU0wBnQ/4rDIZrPE21QLdOVfgheo4LNhjMIzIK0fxg0FBRC:WA3pX2n8SeCNlbvqU0HSDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217711, "uuid": "64b942ba-aa4d-41d1-93bf-23315a4824f6", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217711, "uuid": "5c24fc26-107e-49e2-a03d-24e268883d52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217711, "uuid": "491d4259-b64f-47f5-b361-010ccd77efa0", "value": "MS2106071066.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befa4162-c934-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623251394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251394, "uuid": "68f742ae-03e0-45d9-920e-e3f8e820c496", "comment": "Malware payload (SnakeKeylogger)", "value": "7973f9305b4c1812b034214df2cd358d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251394, "uuid": "614cfbc6-e5ca-4345-bfa4-5d728c6db692", "comment": "Malware payload (SnakeKeylogger)", "value": "3fd47f87a13971c5b26030d4ae64c76e6eb9a49ba53fba16241a523ff489bcf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251394, "uuid": "d6ebb8f2-e833-4bfb-93cd-98558e855e40", "comment": "Malware payload (SnakeKeylogger)", "value": "107ff0c6baa797c9979d5259f2412d115b2384c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251394, "uuid": "dc2e0b32-d78b-4312-ad75-ed6ac3fbe2d2", "comment": "Malware payload (SnakeKeylogger)", "value": "f6b669edd8e1f60d51adb30bde49a7b316ee479e4f57c5c617066b58a406ff5714c0c0f470cb9745e795359209da0145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251394, "uuid": "97ea34c2-8a62-4cb9-9d97-aa4e8d49216b", "value": "1C9522A21DDDB449EB76AFF25BF0E5A7C71E63ED1B0A5C2832308B72051351C8B81976", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251394, "uuid": "a6bfbec2-5db3-4e15-b4ef-740ae3134c98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251394, "uuid": "916ca519-f0bb-4a0f-b9bd-b37d198272a5", "value": "12288:ofJO4zsPgcjVcj9kHcjfcjfcjrXTPRjF8TZhdKTnyLdxdY0QarWf5tXvBNmxfv6k:fjejZjUjUjrXTKZhdKnPUsblPEFDbDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623251394, "uuid": "22762df3-cec3-40a0-a7c1-180539b498e1", "value": 1942016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623251394, "uuid": "5e3e8ec7-734e-41f3-ba65-e368cdec1352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251394, "uuid": "116b2336-b03b-4dd8-9069-7c505dfcbdf0", "value": "Quote copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b27ed5-c933-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623250977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250977, "uuid": "4f22920b-fd9d-4535-8ff4-c365883be602", "comment": "Malware payload (AgentTesla)", "value": "b50ecd05e33c6fd8f679d10f1c39842c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250977, "uuid": "e5efadb5-fdb9-4c4d-aa45-0446e45e6f25", "comment": "Malware payload (AgentTesla)", "value": "4138434cbc206b7784f77de845b2614a046b50be1ad47f3bd91c4622952aabf7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250977, "uuid": "7bbffaa6-0b76-4075-8a92-322cd8c8252d", "comment": "Malware payload (AgentTesla)", "value": "d1534c5e62ad04270055447a2d191e2b2137ea73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250977, "uuid": "6bba072f-d5f5-4a68-a59b-2eaa549fcdf2", "comment": "Malware payload (AgentTesla)", "value": "6ab2b5842aabc7061914d83b2a648e43a16ae8b51b065971f9fe3bbc2c479f0e142224d463d1434806cfabfd15b3f64f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250977, "uuid": "1197db1c-d1ca-419e-b089-7cde9ba1bf3d", "value": "F7024B70E4F5DCD5CE0B06A0823BFF644DF139A9CAC26980B79CE7154B973594A2DD60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250977, "uuid": "c613feba-1cf4-4df2-abff-9ab765aa294a", "value": "192:BfEguGY3e6HkrflcNeRrMew/SCZisU81xgDm5BaDWZ:OfG8WdPwaQMsB0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623250977, "uuid": "4efb2f2b-908a-4235-bdac-ee99d4486e8d", "value": 8457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623250977, "uuid": "fe46297c-8480-4914-bb3e-96762f94c6f2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250977, "uuid": "536f8170-2807-4a68-ab84-32ae96aabd40", "value": "Bank Swift.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ef009a-c918-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623239049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239049, "uuid": "6732bd8f-2de9-4802-b374-275241cfe43a", "comment": "Malware payload (AgentTesla)", "value": "80e8f6d17f8a35b66f035ad11a40ce68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239049, "uuid": "bbb77953-d73d-4ff7-a3e0-db690957208d", "comment": "Malware payload (AgentTesla)", "value": "432789a95ba1fb6d2e53eba94f5118f3cdb90bcee6578655aeb6ad01960a3e32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239049, "uuid": "2ba05d5a-4f25-43fe-93c9-a2cacf3ab335", "comment": "Malware payload (AgentTesla)", "value": "b76f3d69658755d5a58acf0c2ee41f3e68f850ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239049, "uuid": "3abac1f3-f698-4df1-af06-6b1154bb885f", "comment": "Malware payload (AgentTesla)", "value": "4c83f484aa5949fbe5b95699e06ebdbe9ea79306314041f7c6bd1a35d0f6db267762bc1ef878c143442ba40b81a879f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239049, "uuid": "c918d271-dce5-4718-9518-4e7bc21b63fe", "value": "5A2517AC319075DEC467CD768AA82CA4EA6174775B0BD203A01705EDAA2CF97DF106F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239049, "uuid": "9d79712f-9841-40b8-8f24-45d5350d6c1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239049, "uuid": "0d075253-faeb-47c4-943d-e0d7260d76d2", "value": "12288:fFehcxZOFc0SsumP7jCD5qDEPzYqmawZduqR0aX8hVc2WJVHmLXBmMrJNJNgx0fD:NehqOK4ylqaWa87X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623239049, "uuid": "417b1931-f699-4fb6-a2de-971748a33aac", "value": 1013248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623239049, "uuid": "2576cc83-40bb-4ad4-b903-14d62fed90a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239049, "uuid": "4a60061a-3eb4-4bcc-8c6b-bb9a1cfe76ec", "value": "TT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d982ed-c930-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623249419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623249419, "uuid": "27419f4a-9261-4a50-b0f4-1ad5153b964e", "comment": "Malware payload (AgentTesla)", "value": "107d1d0f6a1331ebe7225425430e5b6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623249419, "uuid": "363bb141-c545-4359-8632-1d408f4f5350", "comment": "Malware payload (AgentTesla)", "value": "43a795bd9e344b33d21b36ca326e12371808d3836ec4b8bab2d92e9bce016198", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623249419, "uuid": "7c473bb7-8686-4858-931e-a82ba3e408e3", "comment": "Malware payload (AgentTesla)", "value": "81ad19af728c6fbdd63cc55eb8f68032220e1ef4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623249419, "uuid": "088461c6-31f6-4aef-be7a-4290b45a9f75", "comment": "Malware payload (AgentTesla)", "value": "682ebd9ba697a06264e84a57b567558861a8181bfb20b70621fc99f8042f4ddbeb4dd4dda79e1ed5e31f91b83c54c25a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623249419, "uuid": "2eacf680-70db-4932-85b3-39582021e6c3", "value": "3AE4D05535F9AFA6D135C7F9061012819FFA962AB8EEF2084CD6E0DEA170F418D80F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623249419, "uuid": "90a97ef0-7ce2-42ab-be6d-a545e3d91b31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623249419, "uuid": "569cd19b-4b08-42fa-8146-bf79310678ec", "value": "12288:yujVqP3UdoIg1eCHQbmydvTkIyRjGMFK8+6Wo9w86:bjwfUKIggnLvTkIEjGMFs6Woi86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623249419, "uuid": "6e223b14-ba17-4eae-a470-f5a3308487bc", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623249419, "uuid": "4df3a45e-b097-4502-80be-3505efb9bfb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623249419, "uuid": "be5c359e-f0f1-4888-b498-714d008bad31", "value": "MT 103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3d700b-c935-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623251685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251685, "uuid": "422e00b5-1d9b-4dd9-948c-1ac74354860c", "comment": "Malware payload", "value": "de89502fa0ed1e751a5c68ef542113e6", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251685, "uuid": "6440e409-c13a-41a0-9f58-f776b40a5a88", "comment": "Malware payload", "value": "449e2cb6732de53677803fd5badb9e93c210df49b272b8c319d82a547db3722a", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251685, "uuid": "bf8a10b1-07b0-4b26-bed6-908352fd39ac", "comment": "Malware payload", "value": "776a87b2f73019ac58990fccbc3f5720484c3cf7", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251685, "uuid": "80889de2-0484-4575-aefc-fc9c1c8418ff", "comment": "Malware payload", "value": "63aee608c6447d5234277060792ea54ec2e6e40fd388f27350756b7d6424e7a1209b0a6c7feef50f61b411df106a1c8c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251685, "uuid": "da051325-09b3-4f40-a0c0-3d4ded14ca13", "value": "B1F3028F6120B0A9CF5421396283FDA15E25B61FE901FE5F2DE46F8295350E7238D27B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251685, "uuid": "1025d5a4-7ac6-4e7e-9b64-2e83b0aa3ccb", "value": "3072:5zjTemXbxVymd1xXPMU9VlUBWA6CFvA7bRCxAVIKxS6:1TecbxVyWxfMU3liWA6FsYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623251685, "uuid": "678d572c-ec07-4497-9d5f-eadb6d22f02d", "value": 157733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623251685, "uuid": "b69968c7-69df-4bee-9e76-84eb567b803e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251685, "uuid": "80c0563e-ece2-4700-85c8-91d6232cf092", "value": "de89502fa0ed1e751a5c68ef542113e6.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b62aeca-c918-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623239201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239201, "uuid": "a7f4cb18-c09f-481d-a9e7-46b57f953599", "comment": "Malware payload (AgentTesla)", "value": "2363307596549a8f06fd3d14d0009ccb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239201, "uuid": "cc51df8b-5f11-48ac-b309-9dc975065207", "comment": "Malware payload (AgentTesla)", "value": "4582274eba330fbe931668d6bc5dabeec20a514b6de73143375668b74c98cd02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239201, "uuid": "fd69b3ab-3e7b-46b0-81c1-c7b22000aa0b", "comment": "Malware payload (AgentTesla)", "value": "0958a4dd4cf2d1709da346c81cfc1aa02bcd9f6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239201, "uuid": "4d747f07-ca2a-4a61-8a94-3b06c2fddcd6", "comment": "Malware payload (AgentTesla)", "value": "55de2c798116133b685b20021674113983346cc164d60dbb81c81aadc25fd31091f81defdf4a0ee515e4237ddc830cfa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239201, "uuid": "ce762de0-b413-4fee-91fd-5910d8f984e6", "value": "6B1597C678C21F7176954EBAF02A36B44C27DAA253904C66E86F7410B720FF4DE935E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239201, "uuid": "13ff1269-b39f-41b8-b88c-b5c0873ed07b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239201, "uuid": "be37b743-432b-41d2-b04c-d9cfdfd96b4a", "value": "6144:5/Z/yW8Vu+uDY2SjUUOi61S4BMkofrLWprQ4X6ED7COHPoYqweGupoQyN/fqissv:HzWG51uf+gGPomdiWvwlIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623239201, "uuid": "6a4a1f22-6504-40fb-afa8-135fd9f9953f", "value": 939376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623239201, "uuid": "72e061bc-7e2b-4dcc-aaa5-e53deaf4f1a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239201, "uuid": "f6b578a0-ab4d-4b1a-b35c-39ddc70304e9", "value": "REG#32746-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1620141b-c8e8-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1623218469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218469, "uuid": "51b3ab2e-c163-48e7-bc51-14cee215c99d", "comment": "Malware payload (ArkeiStealer)", "value": "01862a43cc6dced19b49fb6ae238407e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218469, "uuid": "bb2c4780-dc5c-4408-b9da-826b6990f478", "comment": "Malware payload (ArkeiStealer)", "value": "462783684b396fce03b80565e0b8e089b0ac9d2edebe195ec6c7f55473402625", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218469, "uuid": "0c86daa7-0fd4-4b0c-a889-d8a32ab5bf5a", "comment": "Malware payload (ArkeiStealer)", "value": "5dd976ebdd91c4cb0c9de4ccd6a8b7a9f111c8e2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218469, "uuid": "63a16f74-fd01-43dd-bc77-c168cbce9f32", "comment": "Malware payload (ArkeiStealer)", "value": "bc43fd00ea85c54110100c292732823b72320f19e21fd8b915aa54d5d12d27da94cc8549153c4ccf23ef4ddc77f5ab8f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218469, "uuid": "50775484-ff3a-4099-a998-fd4c6eac7d44", "value": "2C05F100A6F0C039F2F356FA5A766395A93E79B26B3491CF12D516EB4734AE0AC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218469, "uuid": "3c780b7c-6fa0-4201-9077-a53e9e290da0", "value": "7868d5ef32f26d2611938c78da4c90fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218469, "uuid": "5877efaa-be44-45f5-a635-57afea8e371a", "value": "12288:mPYDJkQ4LWzaYm3W6dHaOigqXCKp41b4Z4MXksTNV9vrZZUxecF+x:qa5ZaYm3WaagM5+WtXvNrEvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218469, "uuid": "3c5bd1c8-22d3-44d5-a775-da5b2690878e", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218469, "uuid": "ce75049d-39fc-4f5b-b3f2-6925f09f79e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218469, "uuid": "bd2fed02-c0aa-4157-bd41-8badcf1b64be", "value": "01862a43cc6dced19b49fb6ae238407e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1e10ac-c91b-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623240543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240543, "uuid": "40c54347-d11f-4006-93f0-5abff6314984", "comment": "Malware payload (Loki)", "value": "f4c574b00479f8b078039fc0a22f23dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240543, "uuid": "f5579fc0-ffc8-45de-91c8-ae92b50c3813", "comment": "Malware payload (Loki)", "value": "48aa8fd75e2be7fad2e1df3d81dc1653380a546611a53afbf6092ec9c104c324", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240543, "uuid": "782d1619-d65b-414e-93c0-ecf7ab5619ef", "comment": "Malware payload (Loki)", "value": "4e94e0af5e01d770846d65a5afb3c14dedf8c9e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240543, "uuid": "83a41956-4327-4bd9-a294-894e68035843", "comment": "Malware payload (Loki)", "value": "2139bb9815fa7cbc647997e2a5174e93e12b47577f1be9e78efeae11f038bd6cc19d8aac3f96c58fa7b063003859887f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240543, "uuid": "940b052e-e924-4000-83b8-74092ab4895f", "value": "E0E4E0252348AB28D5BF877AC061401447F5E603D723DA8EFDE588CD2E223C6D76FA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240543, "uuid": "9a7a7234-adea-425b-8fef-17bae207ea5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240543, "uuid": "442066ea-788b-4ae3-b058-6b5966937d2c", "value": "12288:5CihqklMV40JuWv2oGISiSn1GI5f1pGkJwq+CgHg:NhqkUzexISJn1x5bGi+CgH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623240543, "uuid": "c7a554ea-0485-4055-8b17-a515de86c010", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623240543, "uuid": "7bf0b81a-4e89-4013-8dfe-116b3ad3e5ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240543, "uuid": "97dd9af4-fef6-4b11-8a76-c8b7f9bc6d74", "value": "1JnVUm5sgrUDRS7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fefb9072-c913-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623237328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623237328, "uuid": "bd65dc97-08f1-40c9-91c6-302db0a63f50", "comment": "Malware payload", "value": "6a44858ca2fe28f5e2c4eed2c5a360e4", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623237328, "uuid": "832c39b1-1831-4c2e-8c3d-4342fe009f2d", "comment": "Malware payload", "value": "49558300c4315c8c53216a8c17e32ff87ca4be34547ab064de7d872d429bb3f3", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623237328, "uuid": "90d28bb7-a56f-4845-a4b4-3745ad27dda6", "comment": "Malware payload", "value": "e793cbf64ad364c93e3a673a090977a3434cb6d9", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623237328, "uuid": "95dfad52-1ec8-418e-96dc-97c9a221dc9a", "comment": "Malware payload", "value": "57472290770e59fba17df1cb5141f31e3695f2639d07ee29249afcdcfa70c7a54e538be2822f529de334af90ac91ee96", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623237328, "uuid": "b88589a6-8f1d-4532-ab60-f807a27f1eed", "value": "49F3028F6120B0A9CF5421396283FDA15E25B61FE901FE5F2DE46F8295350E7238D27B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623237328, "uuid": "4737c546-e247-469e-9bde-ceb0526d71f5", "value": "3072:VzjTemXbxVymd1xXPMU9VlUBWA6CFvA7bRCxAVIKxS6:RTecbxVyWxfMU3liWA6FsYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623237328, "uuid": "c2d9198e-6ac8-4de1-93dc-0ab025b2757f", "value": 157733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623237328, "uuid": "0d2e4a72-c1a7-4759-a251-978a2b3ff7da", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623237328, "uuid": "36fc5145-685a-40e1-8bb5-023863c45431", "value": "audit-367497006.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c379c4-c8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623217280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217280, "uuid": "fdc33636-9f64-411a-8d15-5367d2313951", "comment": "Malware payload (AgentTesla)", "value": "0cb35b83feceed818e522676403731fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217280, "uuid": "7cce36b7-0a06-457e-8103-913a2554484e", "comment": "Malware payload (AgentTesla)", "value": "49722e82ff4fa5bf002f714e9a9840287437758d3771646bf8a0e47c8a46f52a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217280, "uuid": "154dd632-0a97-41b6-b425-ba0c2f059371", "comment": "Malware payload (AgentTesla)", "value": "a8afd260d11dd488c54c128f990da42db406a199", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217280, "uuid": "4db315e2-1fd5-4ee0-be54-f02805557e80", "comment": "Malware payload (AgentTesla)", "value": "b37ea52dab6a2eaed29d5a6a949d50c56fe6936f5123dde1aa2c2800612019acfd01e3549c0ae8a820470cdb4bce149f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217280, "uuid": "60ccf904-38e3-48f8-be23-52021f3c04d2", "value": "D5759252AE96BA24E27886738DEB583846BC8DF617033F354FF27D483F7934A8518446", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217280, "uuid": "b4250f92-930b-4328-802e-aa39dae11cca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217280, "uuid": "fc2c7f98-4da4-4c22-95a5-b5061a46672c", "value": "24576:ApbQdMfxP+KfZ5S7FLk8gBizOCb5UYyx:AV/5SBxIQOCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217280, "uuid": "53ea5e16-15bc-4a3e-b696-fd65a409da73", "value": 1691136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217280, "uuid": "9b772723-e8c8-4700-a476-d8c340f4a32f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217280, "uuid": "a41851b3-dc79-478f-bad2-65460b352f5e", "value": "SWIFT Msg of USD 78,000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde1c3d3-c946-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623259150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623259150, "uuid": "96a19a3e-796a-4fae-9ef7-4ac812bd72b3", "comment": "Malware payload (RemcosRAT)", "value": "bee1b5a09da4f1bc92b3c1a283ab3157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623259150, "uuid": "cb26a1b3-d9eb-4eba-8c63-89fe791eb725", "comment": "Malware payload (RemcosRAT)", "value": "4a9ceaeac471469be12c4c6b231b8597190192f4818e278c307a13533177f7f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623259150, "uuid": "07fe2d3b-6ec1-4c1d-8b85-202f9c0657a6", "comment": "Malware payload (RemcosRAT)", "value": "e3013d622789a4d927a6cea1bd179d9a5bd96121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623259150, "uuid": "41cc43c7-f704-41cc-882e-d8b353707c66", "comment": "Malware payload (RemcosRAT)", "value": "e1e58d08f8c16533bccccde5413715171d3ffe9def2cc28c9f103216ed4448e534d209f6631e3620340224892f471a2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623259150, "uuid": "479ea60b-1eb8-4f0f-a6d4-7dc952005490", "value": "2B25F1392744AB18D1BF8779C0A5411887F5A513D313CACEFDA9D8CD2E223C6836FA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623259150, "uuid": "e9be4041-fca7-4496-865b-0cb58a1754b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623259150, "uuid": "5a6425c6-bde3-4735-bd49-6212b9df7c1b", "value": "12288:XJaPlMV40Jv4zBIoovR9sH6eNSkwm04OaQnyYF2ip2MPo6berH0XUgtoJCBc:XJaPU0ZKn1zzU4yYF2iY6berqntoJCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623259150, "uuid": "828e6291-ba1a-4be5-962c-b4a862617dfe", "value": 977408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623259150, "uuid": "b8947c02-cefb-4923-bc7f-dae0638d777a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623259150, "uuid": "2fb2c301-94f1-4c5c-93ab-46e270578094", "value": "bee1b5a09da4f1bc92b3c1a283ab3157.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c303e2d3-c933-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623250971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250971, "uuid": "bdb0f45c-6199-4391-b4e1-a33ddbbc5e96", "comment": "Malware payload (AgentTesla)", "value": "4649a2ac082e124f2d31cd45b223f090", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250971, "uuid": "f8ffcba2-e41a-4a18-ac46-702461fc306c", "comment": "Malware payload (AgentTesla)", "value": "4ab4361be8674f2fddc7f173d2ef7aa3d8a26ae10c9210bd600bafdce7f34aea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250971, "uuid": "3edd2d80-c594-4d55-89ca-3fb724288fbf", "comment": "Malware payload (AgentTesla)", "value": "511a9413162b233884bd4f7ad41bc4d3a1d6d60e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250971, "uuid": "48a8902e-70d3-42ea-ae5c-6d9855727c40", "comment": "Malware payload (AgentTesla)", "value": "ec32440223eefffa47cff875125033e46a22c61068611d285d3651924f698c8a5c4b7b5babe0c8b346ac94820ff8192c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250971, "uuid": "d00bc3aa-4b23-4963-8c05-fd955905dc01", "value": "A5653342E6C74F13E60F127BD4A6E03010254DC067256F6AEA19336F147FB986B93E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250971, "uuid": "1602f1df-51ec-4388-9bfb-f2c2de9b154c", "value": "24576:8fOmIuc65jc77EfGFwHrkcFKkyLWhh1SR3BumfDKvJtaUF1FZTL3A/DbiQD3mgKy:8fs+q7YOFaH4BWDFVT0rO6bKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623250971, "uuid": "7fc72546-a701-4be7-89f5-030f56a770d2", "value": 1496064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623250971, "uuid": "17804bc0-a636-45b5-9482-c987b44161de", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250971, "uuid": "c3d8bb3b-33fb-4333-ba5e-2cef33c315a9", "value": "order 4806125050.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec55c08-c8f9-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623226000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623226000, "uuid": "ad8dc1eb-cfba-497d-b276-a1a3ac875bb7", "comment": "Malware payload (RedLineStealer)", "value": "6c3123e59b49a835cdaae190cf784f8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "build7", "colour": "#98329A", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623226000, "uuid": "da3493fa-629e-4a0d-a875-e48d2083fde5", "comment": "Malware payload (RedLineStealer)", "value": "4affde0906145b59b617833571ec9ee44d87eb82c4f159a6ead5fd0a49fdc5db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "build7", "colour": "#98329A", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623226000, "uuid": "c363aa50-c573-4b59-b9b9-9bbbce31dc16", "comment": "Malware payload (RedLineStealer)", "value": "29a3c34c1c15ee6fb2a9c00b537a7686525a97c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "build7", "colour": "#98329A", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623226000, "uuid": "f3b561e0-6055-40fa-8148-63faedb97f90", "comment": "Malware payload (RedLineStealer)", "value": "575535c40583ba249b6869dd380f80d345a4461f0739669d619d394c3f2322319ad90598ef8eb60e3891f04fe7d3839a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "build7", "colour": "#98329A", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623226000, "uuid": "b74283c3-7bef-4d7b-a0d1-08d872004086", "value": "39442D77354419E2F53D1BF16BC2AAB65AEEAE7F1CC0898516D830F9A476320818C17F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623226000, "uuid": "f4b72a8e-e67b-48d1-b214-1b7c276c02ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623226000, "uuid": "b45a0c22-1908-470a-beeb-f654f89331a5", "value": "3072:WLN9P4873tmPp4Zty9m21yAHNyndY3PRg6Ae/TXs:v8JPD2Y+yW3PRgcrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623226000, "uuid": "6461aa5d-77d9-4a26-99dd-e4ee473bae2f", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623226000, "uuid": "a21495c1-40aa-4ad8-8bc1-17171a209481", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623226000, "uuid": "7b76384f-c887-4cef-b007-4479b31e274a", "value": "unpacked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675d47f5-c95d-11eb-875b-42010a9c0053", "comment": "Malware payload (OrcusRAT)", "timestamp": 1623268856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623268856, "uuid": "0448f8fa-f31a-4a18-9b76-cc11f80a99c8", "comment": "Malware payload (OrcusRAT)", "value": "b48c688301a8ede00f3e6da221c1a9ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623268856, "uuid": "1d2f67d6-38b8-40d5-8956-a6c741c165be", "comment": "Malware payload (OrcusRAT)", "value": "4bc2d84d15ae45ccbb03aa55b17d1a03fdf2f55efe3540d7e1762d4b58a538c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623268856, "uuid": "8d71622e-e9ac-450a-abe2-012f2bd7a012", "comment": "Malware payload (OrcusRAT)", "value": "a713a4a488d218a438c9920393ec3a2f4cd5a976", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623268856, "uuid": "26c6c86f-4393-46b6-a424-74ff1a7f2268", "comment": "Malware payload (OrcusRAT)", "value": "5b264ce27a5318dce11dc939e9398f086f5444e5455b73dd0ba4a47a883a8116197add5e1e0a3b79c2c00c1a517a58f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623268856, "uuid": "6d9372bf-a9a5-4523-ba8d-b0668932e98b", "value": "1085F1013BFCBD0BC1B6373D677B2AD067B9EE010542EB0A1014551D4EAB789BD793AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623268856, "uuid": "7e81bbae-0f7b-461c-a8ca-6440b728e2fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623268856, "uuid": "9455b19d-18d1-482a-b03e-0680313b1816", "value": "49152:xZGXb+UIsAvFp35EBQ6gMi7QjzQ7g0ILFStLCpQ:xZGXb7Iss350Q6gm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623268856, "uuid": "edfc4252-09e0-4909-99f4-c8ea336fb505", "value": 1779712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623268856, "uuid": "4f9930b0-829e-419f-9f37-762879086b6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623268856, "uuid": "020389ce-1043-4759-8477-17eabbd39b01", "value": "B48C688301A8EDE00F3E6DA221C1A9EA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f72e50-c922-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623243436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243436, "uuid": "d1f30d0f-37ef-45cd-afac-f0244c3fbbc3", "comment": "Malware payload (AgentTesla)", "value": "8e184d9586c57ddab5d67c7988208511", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243436, "uuid": "7f296722-e80d-41f4-8fe0-b58d59fc3668", "comment": "Malware payload (AgentTesla)", "value": "4c586af41cccc35228e2e1d972baa8fa4109e698577cb48302b218c0b64be21f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243436, "uuid": "a1eeb592-f845-4740-9b4b-e18727321a98", "comment": "Malware payload (AgentTesla)", "value": "c0e7a282b9681d4d7db4f314a6610a5ab95ffd17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243436, "uuid": "74533bbc-b286-4f61-a9e4-28b3994e1fc1", "comment": "Malware payload (AgentTesla)", "value": "5c80c4178c90fe7ff208dabdfdac87960e3d0235a35249acf4aa755fd6b5f64377dd536dfda97c9065305b56073f363a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243436, "uuid": "098e2eb7-46c7-4f3c-9b32-9de1e5720a15", "value": "13E4DF6475F9AFA6D135C7F5061011D59FFAA629B9EEF2480CC6E0DEA460F01CE80E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243436, "uuid": "2cc093f0-10fd-4b05-86c8-8dd7e7065165", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243436, "uuid": "20e75815-823f-4bf5-b665-d177ad02ee33", "value": "12288:00F8QQnyLEW/XX8yTnDSvFyWS+FB+r5+23NInn+:00Wn7W/XXHGv5cL3Y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623243436, "uuid": "a1edbe13-2fff-468c-8052-212965d9c762", "value": 695808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623243436, "uuid": "e12990d9-15fc-427f-902f-032e68c28f99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243436, "uuid": "c829c218-3fd0-4f53-8ed0-f089e3ec1e9b", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805c24d1-c8ee-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623221224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221224, "uuid": "f7280f19-3088-45d8-8bd4-de8e51c723c7", "comment": "Malware payload (NanoCore)", "value": "eb43b3c033bd76b51b90a51a6726a81c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221224, "uuid": "97891dab-17f7-485d-b139-0b60c3102220", "comment": "Malware payload (NanoCore)", "value": "4e9a5cc90f1d17550208942e0182e9a99598c18c19b3467c184a46f4214755e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221224, "uuid": "0ae33f56-5567-4317-9349-fec474308de1", "comment": "Malware payload (NanoCore)", "value": "0d39ffcf64ed4f38ea83a72d726d40881f583014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221224, "uuid": "173b90ca-2c46-49da-80ab-4d7cf48810ed", "comment": "Malware payload (NanoCore)", "value": "7bb9276a46a1fdf046c1677e1fbbbe2354501490a5d5552167ee8040d03aea062fbb8bfebef08314b382671ef25bee49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221224, "uuid": "93b2e312-0d9a-4348-a326-9455e8433bf9", "value": "20F42306BE828B42CC4413F58AF7C13247B4BD158903CB6A77EABF4B3977356994215B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221224, "uuid": "564865f8-0adb-42e9-b456-74b0c6be27d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221224, "uuid": "842c3766-effc-489e-80e8-ad1006c9fd73", "value": "12288:iRqIue16rc2fV5hZcK1KjkiZCx7jsFuR6Y/ctiBHkcpZtoMZ:AqIue1kff/ECKwiZCx34mcC9LtoMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623221224, "uuid": "25fe9b80-5872-4418-9ef6-c79a83d3faaf", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623221224, "uuid": "6ef05d60-3cd5-48fd-94f5-dd8c08f35457", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221224, "uuid": "aee2b2af-b50d-4db0-be78-c0794287fea3", "value": "eb43b3c033bd76b51b90a51a6726a81c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53bc8ccf-c8f8-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623225444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225444, "uuid": "88d714d3-9fed-4f3b-a2f2-4bc908788d59", "comment": "Malware payload (NanoCore)", "value": "76cb475e000aebbd9faa94855b029f52", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225444, "uuid": "5685ab15-4ac8-4baa-9551-6156bbff298d", "comment": "Malware payload (NanoCore)", "value": "4ea6f0802201e606f694a34f2376c416eab228de16f9ba098719be2b96449cf0", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225444, "uuid": "8d0d2c52-931c-417f-9c1e-c9549afb4206", "comment": "Malware payload (NanoCore)", "value": "093b60c39777a1f99de8d87e7082325db276b9a6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225444, "uuid": "f6e89016-ae75-48c7-a608-0e38fb5f4051", "comment": "Malware payload (NanoCore)", "value": "235593b690f099f37a47c65dd777f606ba79154353937cc0cd55f8551ee145d405f259730c6855cf82d9b722eadc17de", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225444, "uuid": "56a1bc9d-4de1-4b89-9597-36537e1bee50", "value": "4DD433BF2DC1E447B4D16BE22AF723E4D02C44F80B29508B755FE89983758EFA761225", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225444, "uuid": "0c32ba74-eb8a-4df6-a5e3-af80e042b564", "value": "12288:/6awGqKQfz/lIWILslGRzQQDCNV/5Fk6lq66L69q2W6S9:fwAYz/7vSznU6Vgqn6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623225444, "uuid": "8dfe4048-b6da-428f-a3ac-d62e6d2a2e10", "value": 636678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623225444, "uuid": "4cdd7d80-b367-4f04-ace7-0ae158deb28a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225444, "uuid": "cf92d5d5-1efc-481b-b4fe-8771a662aaa8", "value": "payment invoice.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea33330-c8ee-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623221275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221275, "uuid": "abab0f3e-138d-4ff4-b377-807c61f22420", "comment": "Malware payload (GuLoader)", "value": "196b3c910b8d74c5916029f6eb037d5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221275, "uuid": "31a029fd-84d3-43d8-a2b7-920abb63016e", "comment": "Malware payload (GuLoader)", "value": "4f6b4079a3f1b56421cbca34d112ba6a867ff8a6bd706010bfe931ac6d635361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221275, "uuid": "69e4e7c1-990f-4483-ad68-844b1ead494a", "comment": "Malware payload (GuLoader)", "value": "37968cade61e54ce0c4ec24e83c35fadd583019f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221275, "uuid": "873a9824-0b18-4be2-98a2-c545548e7213", "comment": "Malware payload (GuLoader)", "value": "367df315a9790049cd61eb18a943a69945b7cf806980abfd2c51c53516361d286555be65ffa76b027ae9c27907c3682b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221275, "uuid": "d4e58873-9fdf-442f-bc71-372a63176092", "value": "6AE33E21BA21E123E44590B4FE55D7DEA4013F721E9F9D03368D3F5A503E3CBAAB1A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221275, "uuid": "64bf6c91-b2e6-40fa-82f8-ae478390554e", "value": "9b8686288ab82fdbf8ede30bc55c83b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221275, "uuid": "d3c0d96d-0d73-4063-a357-beee9a0d6b77", "value": "1536:IFXJHkDZ+2HdXrK5feyoSP+6a3bQQ6GaXSt4lY5YGw12IjqQRsk:CJiUEXrKIIPcl6o4lBGw12IuMsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623221275, "uuid": "627a736c-da44-45f6-84f9-1d9ff0b50852", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623221275, "uuid": "b40de8c9-5a1b-4390-b346-aab99239faea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221275, "uuid": "c74133b2-74a7-4422-869d-7011e7684aaa", "value": "196b3c910b8d74c5916029f6eb037d5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a743e69f-c935-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1623251784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251784, "uuid": "1af53866-abbf-420b-8752-1f4ea4ab7dcd", "comment": "Malware payload (TeamBot)", "value": "8e1fe7e8ca900954c1e224e06cb0244f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251784, "uuid": "c4d9bd5c-478d-4bba-828a-f72c8b859983", "comment": "Malware payload (TeamBot)", "value": "50b6f7a42dd6497bff09277e52154b8d60b0aa95c33ffd838aa14040c7bb02c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251784, "uuid": "9aa68ec4-c6bd-41f3-b03e-67bdc9efa60e", "comment": "Malware payload (TeamBot)", "value": "75036d149eb360bbb9096e1f93f4f3eff9786af2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251784, "uuid": "99c18fb0-1809-40dd-a98f-a1b365d9f7da", "comment": "Malware payload (TeamBot)", "value": "f1afbff0981aa4d1f67c04afc322b958aabe76c38958c702324c59ba74155fc1e24ebb068a8160a3809c2e2b44d21e7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251784, "uuid": "5b11a323-fc09-4fb9-a596-54175b16920b", "value": "4505020067E1C035F2F31AF99AB656A8993E3EB26B7481CF13E526EA57346D09C31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251784, "uuid": "49a3a806-af58-4909-9d55-f08a02c082d8", "value": "94daac93a6d0c1e4911809ca567dd303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251784, "uuid": "bdf73c8b-80a3-4072-a096-7c500501b781", "value": "12288:9FgGebqEW/iwFkpYl9SCmuqF9urVOrXrIXK19G7i7GJgFyNBJMMRegDCnxb7EUHo:L10vYqF9urVIXEXAyNBCMjuneUHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623251784, "uuid": "fa3bebf3-3c49-4e5e-afd1-9aca9be634d8", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623251784, "uuid": "567ea52c-7485-470c-8c06-bfeb27a7824a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251784, "uuid": "8393d570-ff34-4aa9-bae5-7b8df670a102", "value": "8e1fe7e8ca900954c1e224e06cb0244f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034077a2-c8e6-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623217578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217578, "uuid": "92b87a50-a01a-402c-a1d7-03d44fd82541", "comment": "Malware payload (SnakeKeylogger)", "value": "e8f6931bb50d77f167521fe3e4689069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217578, "uuid": "67d8dfa8-6c70-4538-aab4-424b3e837696", "comment": "Malware payload (SnakeKeylogger)", "value": "50dedf49ca4e2c03fb776fc7924ce9da149d9e072f2dfb9f8ff7ce0332e14c6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217578, "uuid": "8cf22dea-21fc-475b-be33-0b4bfb65ad9b", "comment": "Malware payload (SnakeKeylogger)", "value": "e334fb2756d514e6b26b8612099a7572b4f3c29f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217578, "uuid": "db92f158-cc14-4924-a1e8-0b5cd4852066", "comment": "Malware payload (SnakeKeylogger)", "value": "a0022c430e9a0dd90e18c7d48b0f05782f8ff0e2fefba38fe8b30bee4f4b477f939e33eb62be97b7cdbde3b0f8deef9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217578, "uuid": "e01850c0-21fd-43c2-bc46-e2cea4d9d4fb", "value": "708510A218DDB449EB3A9FF25BF0E6B7C71E67ED1B0A5C2832708B71051351C8B81976", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217578, "uuid": "a68c93dc-3479-4f22-8ac2-dcc0d2fbe95c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217578, "uuid": "5f9faff0-fc8e-4b79-a1f8-63891f01d387", "value": "12288:UfJO4zsPacjVcj9kHcjfcjfcjrXTPRjF8TZhdKTnyLdt4HVPB5mwX3bNR7Td4qZN:xjejZjUjUjrXTKZhdKnF64Zi2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217578, "uuid": "c80a8e6a-c0ac-4caa-83ed-eef2e8ac2192", "value": 1858048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217578, "uuid": "50b4e384-5e16-4c03-b3dc-c6aadc9a1413", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217578, "uuid": "eeee94d8-6e68-461d-a192-d0f6ba973448", "value": "SecuriteInfo.com.Trojan.PackedNET.825.1165.20623", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6feaa9f9-c8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1623217331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217331, "uuid": "fb7ac5fc-a808-411b-aefe-1be85dda087e", "comment": "Malware payload (GuLoader)", "value": "6f52b7cacc2da41a4b6945310158fc82", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217331, "uuid": "0a7b05dc-fab9-4976-9133-5b4c9315ae9a", "comment": "Malware payload (GuLoader)", "value": "515c50a60572c34bffc777448aecb0a778b777bff071d65e5385eedeefc43830", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217331, "uuid": "930fa12b-aebb-4d04-acc7-1994105f7da9", "comment": "Malware payload (GuLoader)", "value": "39e0f4ea68407310b4b6e9d41f27285020bb7a5c", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217331, "uuid": "cc5539f4-3ac9-43e7-a35d-d657460a87b0", "comment": "Malware payload (GuLoader)", "value": "b3fdba3be2f9e7a8d929f934d364a3fbb31da021c2ccf712757e17510a9e0793dcdfa983a5f76fb6dd1dde955de904cf", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217331, "uuid": "c131ee9b-db6b-400a-a5ed-95ba83eaa75d", "value": "3A553358ACEC0BEAEF9E5B361260C635D37C9D20A706D007726D3A16B434EF57B9A50C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217331, "uuid": "67fd1d41-9476-4e03-a13f-da4d21e9e67a", "value": "24576:RwaQ+eKnnA8krVc1UhT4lslqVHgMLHyZpWAxftj49Qqx2E22tvB:RjQ+vnAfV8UhdlqVAwHSICljbqpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217331, "uuid": "b9e19b99-92f9-4cbd-a7be-d1c5276ba084", "value": 1348096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217331, "uuid": "a1667a79-e49d-49ce-9195-480b242fcfed", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217331, "uuid": "36fb2754-4d9a-40e4-aa85-a7ce8d8221b0", "value": "DEBIT NOTE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94cf4a6a-c90e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623235002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623235002, "uuid": "e5ba5c3f-25c3-4827-b1b6-212cc33b0be5", "comment": "Malware payload", "value": "5769565a7f75e355dd86fce5ac78bfee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623235002, "uuid": "b8982c8c-70c6-4c8a-a944-1dda71faac59", "comment": "Malware payload", "value": "532cbf94d0d91cc6b21b06f99f2f24463fe46636eb236c781a3c5141ea2d0f8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623235002, "uuid": "d4d33052-3794-4876-be9b-a9d50a5adf5e", "comment": "Malware payload", "value": "86189b5c38df1a018ac2af38a5530b21d1c832cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623235002, "uuid": "29b471ff-65dc-4cdb-bea5-079e6f6f0bdf", "comment": "Malware payload", "value": "67fe765c0137f42850ff9795a01a3729371602d7e50b92b33d1b79f71c29dcce0bfa5c35a302d390b2e18da6aa873ad6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623235002, "uuid": "ab345a79-7d14-45e3-b8b6-8d1f07f8dfbc", "value": "C8B38C03665955FBCEA88834D88BC072172626406ED36D2B7BDCDD39BC776344ACE328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623235002, "uuid": "b49e98ec-b073-432f-81f1-8deabfbca2dc", "value": "1536:E1CvFJqRVbGC9mCILahEqUje+mpir9GXIpziD5QfpTXHss5BrrrcZCF+3ho:EsfG9XhEq0eXipGXIpK5QxTnvcMF+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623235002, "uuid": "8a639853-83f4-4a64-9fee-aacb0ad87a33", "value": 110360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623235002, "uuid": "861621ae-1a87-40da-8916-1e9299cba3d2", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623235002, "uuid": "3a9390ba-4fd7-4f99-8623-281d4d0b31ba", "value": "gg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56d6f0b-c933-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623250975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250975, "uuid": "016f3d33-d870-4ab6-a173-c9cf5bdc4c61", "comment": "Malware payload (RemcosRAT)", "value": "d293c21518f6cc090a3c6838f82f66a0", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250975, "uuid": "1fb1745e-585a-4b08-ba26-d725b542d5ab", "comment": "Malware payload (RemcosRAT)", "value": "5688feee626fdfc5e488d5a07d4a0ee86029ad46bc6ff4c46f3828d0ab87140c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250975, "uuid": "b5747d77-fb1d-42ff-b848-a56bf643bb3c", "comment": "Malware payload (RemcosRAT)", "value": "a3fb8b2905b99f5746ef945f0b99ff733c4dabf1", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250975, "uuid": "b1c83ea3-ff03-4bfc-9985-2be62fb78a6a", "comment": "Malware payload (RemcosRAT)", "value": "999f60cb172cea2198fbd58b0b344b6aa860bb35c2c931795b1cd3cac0b4731b37c6e7bc73ba9595ae38d0a55d68c1de", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250975, "uuid": "32629616-477a-4b23-9879-739d7ec02ac6", "value": "73552365FC98AF0EE5A9557DA8B78138502ECCA16700ED873380F940F9BD774D79388A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250975, "uuid": "1c109cdf-f364-4268-bb58-39c520143c46", "value": "24576:bZK7L9zWWBCOXWD0tfPMSwnKwAjqJ2ZjjziIj5GbQ59wnkCbMIyHGSZ:bwJzZoOmD0tfPMD7AjMS/iIlV6kVmSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623250975, "uuid": "8ebb7a0d-f188-4a5a-bba8-112d40e188b6", "value": 1373696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623250975, "uuid": "ba8ce4c7-94e4-4e04-88c4-ee64139754a1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250975, "uuid": "0f7ceee6-3249-4aa5-94ed-89f640a32c2b", "value": "HT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7f1ce0-c969-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623273937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623273937, "uuid": "7ff96d5c-1742-4b43-863b-2e732c222abd", "comment": "Malware payload", "value": "06c2e47c5210db4db648210ed57dd62d", "object_relation": "md5", "Tag": [ { "name": "tag1", "colour": "#C526B8", "exportable": true, "hide_tag": false }, { "name": "tag2", "colour": "#6401F7", "exportable": true, "hide_tag": false }, { "name": "tag3", "colour": "#B2ECFA", "exportable": true, "hide_tag": false }, { "name": "tag4", "colour": "#884843", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623273937, "uuid": "f0793e5e-d4f5-485f-860e-836570be7def", "comment": "Malware payload", "value": "59396c3c3e8e4b8a842a7c6d5ea09718de5a3f53e5d18bbd99245f0722a32a17", "object_relation": "sha256", "Tag": [ { "name": "tag1", "colour": "#C526B8", "exportable": true, "hide_tag": false }, { "name": "tag2", "colour": "#6401F7", "exportable": true, "hide_tag": false }, { "name": "tag3", "colour": "#B2ECFA", "exportable": true, "hide_tag": false }, { "name": "tag4", "colour": "#884843", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623273937, "uuid": "94b7d96d-87fc-4bd4-9f96-12f69f5c0974", "comment": "Malware payload", "value": "694b48ce26e62bd15e48a24b3a8caca38b91004e", "object_relation": "sha1", "Tag": [ { "name": "tag1", "colour": "#C526B8", "exportable": true, "hide_tag": false }, { "name": "tag2", "colour": "#6401F7", "exportable": true, "hide_tag": false }, { "name": "tag3", "colour": "#B2ECFA", "exportable": true, "hide_tag": false }, { "name": "tag4", "colour": "#884843", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623273937, "uuid": "04d65ccd-f265-428a-9694-112418525961", "comment": "Malware payload", "value": "a1de06a2dceda61ca6fad1ebe57b7e33cf5aaaed83ebefd8aae17b0214f3e46579b9173b4174e6c71f903ff0fda8ee89", "object_relation": "sha3-384", "Tag": [ { "name": "tag1", "colour": "#C526B8", "exportable": true, "hide_tag": false }, { "name": "tag2", "colour": "#6401F7", "exportable": true, "hide_tag": false }, { "name": "tag3", "colour": "#B2ECFA", "exportable": true, "hide_tag": false }, { "name": "tag4", "colour": "#884843", "exportable": true, "hide_tag": false } ] }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623273937, "uuid": "2fc98a6e-78af-470f-8f03-a90057ed33b7", "value": "3:XA+Ruw3Ae:Qu5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623273937, "uuid": "dade482e-a16e-4222-a49d-dea5e564132c", "value": 24, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623273937, "uuid": "f95adb22-1c4c-458f-9965-91a9d56545f3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623273937, "uuid": "3fc1ca90-cdf9-4010-bbc4-15a0c7f5cca5", "value": "test_file.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1819a1-c93c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623254803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254803, "uuid": "a453d2be-61f5-4301-92cb-229841f77b61", "comment": "Malware payload (AgentTesla)", "value": "dde74c34ba189cc87aec0b0db5354eb2", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254803, "uuid": "dc0a06a8-3cac-4695-a17e-83173b517a11", "comment": "Malware payload (AgentTesla)", "value": "5acc833d0d95ecd4ef4533990df1c7b6b9edcd9c7e42e920eb6a5d7e1ea09858", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254803, "uuid": "4c788718-8555-4e92-9a3c-2373fe0df61c", "comment": "Malware payload (AgentTesla)", "value": "4c203d23ffd3c17fe68aa29e6060d7e8679a8f9b", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254803, "uuid": "d61fd339-da76-445b-8495-6260d5677fbe", "comment": "Malware payload (AgentTesla)", "value": "a260c8591cbc6a4b6575fd0b2b14c30c3ca66014c5c9fceb60198565ab5b56c99eec8ba4a43f89d78e5c2912ef872ec0", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254803, "uuid": "655099a4-db05-423a-b581-43ceb9447ae1", "value": "DE542395E8A08A3C894D11AD4B4AD23E4893CF7D283DD1D8EE1DFB5CB68E492F443467", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254803, "uuid": "473d841f-698e-4170-a224-b9e441bfb7d9", "value": "6144:zdAAUtmjMVk72IzsbaMCjlGSyNkZGLOn/gqiSZIfG8RaCOWJp6RkZ:zO+E42QMIqgxF5IfZJME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623254803, "uuid": "0e6af792-d77c-49e2-9caa-b29fc9c5cf2e", "value": 286124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623254803, "uuid": "3a8d7408-f916-4d22-9ac6-97688d74de1e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254803, "uuid": "d6bd9d12-86be-491b-b156-63755afa05cd", "value": "CV_DOCX.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2500dd6-c8e5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623217523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217523, "uuid": "bfcbb38e-07ba-47d7-9730-73a44030ece4", "comment": "Malware payload", "value": "2f355cdf5c150ffe38fa3ae1e36fde4d", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217523, "uuid": "86f750d0-2b6c-48e6-8daf-d4e3474a24db", "comment": "Malware payload", "value": "5cf6e78b628641dae59b9982c33e6dff174d23125b15ee53073e52f186ac6d6f", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217523, "uuid": "88994825-239c-41d4-93ee-33f6c4dcfb5c", "comment": "Malware payload", "value": "fd38e89aac8eec1f830013ab5007a90675f08f7c", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217523, "uuid": "398ca0cf-eb8c-411f-8abb-e7b93d994c77", "comment": "Malware payload", "value": "f0dabc7f73ffeddf3d1abc7cc23608038e793ffe403b1eea9ebfa50b908a0c0ed8ae54d21ef1ff7c37f43e077b931437", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217523, "uuid": "3225b26f-23ac-4ada-8dcb-6da5c341df69", "value": "DC3423EDD1CB16752DF843448183AFC0EB469B170F7759AF1B32C82A9E85E6C25E502E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217523, "uuid": "96db74aa-07a8-4292-aaf9-1477b6033a28", "value": "6144:DYveCR0Us8b9s/xtZ4uIACOLybR4uR5eBTKsOSYF:D8JNCXzUR4u7IT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217523, "uuid": "ad09ac93-b00f-4823-9be3-bd6f153bb632", "value": 250540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217523, "uuid": "e0362575-69e1-4102-99b3-1d23a673cdc5", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217523, "uuid": "202c499a-267a-4d2a-860d-f59d7bd5c812", "value": "CCSX09B00731.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d60e0f6-c922-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1623243499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243499, "uuid": "6dd8cad9-d78a-4698-9ec0-221a00cdabb3", "comment": "Malware payload (QuasarRAT)", "value": "b96b296fea4bc13b18d998e9fe6d386d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243499, "uuid": "001fc7df-6604-487d-aaac-e3660995a4d4", "comment": "Malware payload (QuasarRAT)", "value": "5dd39fa32d0446752e1e77f66e0d1fb32223feba4bf21ea3551a9f84a01e320c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243499, "uuid": "174b2a40-04ae-4a63-ae1b-24abcd4d8911", "comment": "Malware payload (QuasarRAT)", "value": "de7a2afc4a96c28b96af4f9df2edb840332a93e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243499, "uuid": "c021bde5-3473-4879-ba45-7dc0abc6bc11", "comment": "Malware payload (QuasarRAT)", "value": "50aab5a7bb53a0a2739ad7416c05ed9b4e2228abefe3164adc7e06c8b57ad0fd350b7b609f6139bcdd1e08bab4db8fa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243499, "uuid": "e090aade-1eed-4fe0-8675-a89b4289628f", "value": "4744121966C0A4B3FDD30BBA77B2637FF77E87882915590B17105EBF4A52E43C922242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243499, "uuid": "4eca2d8f-b9e8-429e-9953-f6c68371d9c8", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243499, "uuid": "72a2fc38-ec5b-4532-ab01-21bccd6cdb29", "value": "6144:JPB6We7kvxVUxApbwAlW7a+2uXDCaPvlmnki/3KNshndcYYsQVUczc:F5ZvxVUxgbwra/ubPvlCmNUndcXd6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623243499, "uuid": "bd768ccc-17e0-403b-bd8d-18bdaf4236e8", "value": 272000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623243499, "uuid": "5807aea4-32f7-49c2-9d83-c401ab84bd3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243499, "uuid": "787226e2-bce5-4d81-b583-b4896131c2e4", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af4f121-c975-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623279143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623279143, "uuid": "94f3f0e3-13ed-4841-9035-1c0600624a3e", "comment": "Malware payload", "value": "28f73898629deb60193e8bd5ed6ea96d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623279143, "uuid": "c3da4394-f439-4eb4-9070-2d330a044646", "comment": "Malware payload", "value": "5e4b70fa595cb17cba9e674ec3fa574d830b43d3a4b6b3417d8c8c243880e93c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623279143, "uuid": "a5fc7bd2-eb24-496e-923c-6261ec9d8d40", "comment": "Malware payload", "value": "f8b6299ca7c45c9a298f9b911174ae49f01d7adc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623279143, "uuid": "f90fb9e7-6e47-4966-bfd9-c3b6355af3b7", "comment": "Malware payload", "value": "c0527ee554b3dcffc9666b14bb8a3ac3739f1d19c3962d9ece540b73f0304d4acb7039e790f49c662a38ef00328b4561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623279143, "uuid": "491b98a3-3e5a-42cd-81cd-d25168c1932b", "value": "0DD4BF21BE81C4B3DA678170DBCA9B75A2B5DE100B6583530748BF1C3EF74911A2FE5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623279143, "uuid": "d8ab1177-ec66-491b-9545-e33c651cec9b", "value": "2f1d3b096ce4c20b15cc60b0dbf40e59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623279143, "uuid": "ba2871c2-8f6b-4dbc-8496-7e13c14aea38", "value": "6144:L5WytLcWjbi+nIgFo9xp3zIdBMM4XDsBRHJeqc:h3lnIxPjIOzwHJer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623279143, "uuid": "cb268e35-c382-43ce-85e5-fe4f287be366", "value": 623520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623279143, "uuid": "b824407f-7258-4117-a7e7-dad32b9ff434", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623279143, "uuid": "4b2be691-4f9d-42d8-930b-1f2ecdd58a91", "value": "2021\u5e746\u6708\u4efd\u53f2\u4e0a\u6700\u5927\u902e\u6355\u6848\uff01\u8fd11000\u4e2d\u56fd\u4eba\u5728\u7f05\u5317\u88ab\u902e\u6355\u89c6\u9891.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58915f90-c962-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1623270979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623270979, "uuid": "c073d04b-00b3-4c40-8088-5b3891825d26", "comment": "Malware payload (AZORult)", "value": "d6ab48d2e4748f18434c825ae97dae61", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623270979, "uuid": "f2c13821-aba0-4b49-bc86-6fd8e586dd62", "comment": "Malware payload (AZORult)", "value": "5f17392ea25b37a326c15c57807f697fc6669b9c416c5b11ade1b9fb604106f5", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623270979, "uuid": "dc9972ff-7ab3-4b32-983c-3ff7074bc15a", "comment": "Malware payload (AZORult)", "value": "3979f0416fdc3024cbf11955c5fa590e27d7168b", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623270979, "uuid": "114125a5-2e51-4cf3-b250-89f5d863f212", "comment": "Malware payload (AZORult)", "value": "e3b4b5031631cf3b81127425fa2ba1477bbbdbf5dbd3d580692784c10133db7b34bfca5da5e1468ae11853faa42e1870", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623270979, "uuid": "e0ec040f-f332-43c7-8e9b-5c11905e12c9", "value": "1CB3197AF6C19672E02808BDCD46D1B6912D76302D3918B6B2DA4F8CD5F95C26E2C3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623270979, "uuid": "6e534b98-f491-4083-8fcf-1a84e737c712", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623270979, "uuid": "1a278e26-d896-4a0c-90ec-aaf78b65f8f0", "value": "3072:tuOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEY3E/Rxg/:Zzx7ZApszolIo7lf/ipT/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623270979, "uuid": "0e245a1e-5734-447d-bbdf-0110f8a628f9", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623270979, "uuid": "ed345204-a9d4-4534-82ef-0902e5911afd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623270979, "uuid": "3babdfe0-d7ab-42a6-942b-f39a3c4e9dcd", "value": "D6AB48D2E4748F18434C825AE97DAE61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf581a4-c97b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623281858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623281858, "uuid": "016ea820-eb32-4441-84cd-5474838bdfa7", "comment": "Malware payload", "value": "c2967abe99e9fc84c4b1df1b91ee2089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623281858, "uuid": "954dbd61-a10b-4054-8f89-cf04761705bc", "comment": "Malware payload", "value": "602b9e5b584b67abd5573952c8633272e414dd6cde6485b9722cf780d809297a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623281858, "uuid": "c59169bd-b618-4d4f-ae37-b0337cf3446c", "comment": "Malware payload", "value": "c07355cb770a36c75a1aff71d9084c1b58342f77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623281858, "uuid": "e0a74374-abf7-4f92-8fe1-5f3b28a3d900", "comment": "Malware payload", "value": "28dd72a3ee52d8ba4f261a2a22bdc7569886937711f8424ce1424da89c83a0cca95b028fa9f71c47871936c57954dd56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623281858, "uuid": "ef88403d-f3ac-4d61-b9fb-d4bf250dadfd", "value": "5AE4AE01B6A89B11E9BA5BF10A70959047F6BD3B6579E01C4CDA72EB0FB3F0049A1F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623281858, "uuid": "3b1d00ec-04b4-4bf7-ba58-046810479012", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623281858, "uuid": "45bbdec9-3766-4827-abe2-579e75061948", "value": "6144:E97fWQ42fme0R72a2htoGhsj9yZ87F2Q7IsnBuhn7A3MCT9rEWkLuA5YfVtUvVE9:y4ITi7jgSj8eSnU3rEWKuaY9qI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623281858, "uuid": "ae4681fe-83b8-4a53-9cbf-e41856c2391e", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623281858, "uuid": "6416a413-b402-4bcf-8a73-a6a7808e07be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623281858, "uuid": "49fd9b9d-9596-4882-ba34-82a6fc055b0f", "value": "SecuriteInfo.com.ArtemisC2967ABE99E9.17436.10643", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd358dfd-c912-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623236788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623236788, "uuid": "849f8581-fc7d-4f79-a016-5660465cb713", "comment": "Malware payload", "value": "c2091463b7539a8f6d3e47593bcd9cbb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623236788, "uuid": "8d76d295-6f7e-40e8-a685-690831b4144c", "comment": "Malware payload", "value": "6166dd44bc6d71b976b6e62c33d8ce16687738809753f8c3f7dd81cd170be371", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623236788, "uuid": "f16bb603-1293-403a-b658-5366817be76c", "comment": "Malware payload", "value": "b4766d75c25d884dfa3e26980e2f8b443622bf9c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623236788, "uuid": "c88dfb33-dd07-4813-955f-962bc5d93bdb", "comment": "Malware payload", "value": "17e94ac5fb52559a150599428d74e7fbbc60777cadc86cc6d1861ee803b72adf02f07b765c4923a98fc1d7ef57b3aaf7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623236788, "uuid": "2b93fd6b-81d9-43de-abb7-783ce70b392a", "value": "C6226C7DC601F82BD125447DF515D2F5E72D00A3E622782C619072AE4BA06D287DEAA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623236788, "uuid": "c6087b54-b058-45d9-a028-32710ac3343c", "value": "192:ScIMmtP2w2e3G/b6EVOLi4e77avWBrd6390p:SPX+w2eSjVOLpeiOZOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623236788, "uuid": "65793321-06a7-4c6e-94fe-5cf466d987cb", "value": 10327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623236788, "uuid": "afea3a20-a732-4575-b9af-85a46effc25e", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623236788, "uuid": "520d3f0b-dc1a-478e-8ab5-507b095636ce", "value": "PREP LIST.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a677e81-c907-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623231978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623231978, "uuid": "4521d633-27f1-434f-807e-c30f6b426982", "comment": "Malware payload (Formbook)", "value": "8f4bde6223f361b3f8cf3fcbdb92cdd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623231978, "uuid": "418adee2-6968-418d-ad0f-9190ef45b67a", "comment": "Malware payload (Formbook)", "value": "6441f1b766c5d4130181866440efedf63b4b3a8876e4f3d97a58eae3d2200641", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623231978, "uuid": "487c29fc-c413-4e27-971e-6bf48c8c87db", "comment": "Malware payload (Formbook)", "value": "654a77edae553ef07fe7b1e6981ed80c429e76b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623231978, "uuid": "a48577b6-b1cf-4308-ac22-1d3f2d3433d0", "comment": "Malware payload (Formbook)", "value": "76f94f1f42b20c98264b4fc8862eb917e61a8409a5417f6c13b80e4c8134b0e24aa1c4e1fcb24719e4ee4de33cebfd92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623231978, "uuid": "5cebcbe0-3659-417e-a345-3c44873d3988", "value": "D335E0256348DA10E47E47355063520047F1EC07E752EA4EBEE8B5AECEB33C2A35B697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623231978, "uuid": "a664b4bd-dade-46ec-8cd6-97e4716d78ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623231978, "uuid": "d19fdf58-f5f2-41d1-9852-760315bb602b", "value": "24576:LziPO+eUZ0CrFs5/EeXXUs8JCMWl4cXw7KeSsQY9:edZ0CJsdEenUs8JCJ4L+sQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623231978, "uuid": "6918667d-f3b6-40e1-9ca0-1b49f2a3a451", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623231978, "uuid": "0931e1fb-94a9-4e3f-9bcf-35bb14b1d3e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623231978, "uuid": "118bfb8c-574f-4f83-ab1d-156f8bbfcef6", "value": "SecuriteInfo.com.Artemis8F4BDE6223F3.10750.28395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7edeaef0-c936-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623252145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252145, "uuid": "00f21ab1-fd0b-4cd2-a815-bcb3ed9096ac", "comment": "Malware payload (AgentTesla)", "value": "07e2072a51819c4bdb8c31ff4300c0fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252145, "uuid": "2e43e062-925b-4662-94af-e04379612532", "comment": "Malware payload (AgentTesla)", "value": "65c8046cc58a7d4bc32a01c4c98a262ce873883fc878c2cdaac34593fd8397ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252145, "uuid": "154e29f0-0052-43b5-b9c7-aec52eaf6311", "comment": "Malware payload (AgentTesla)", "value": "410d5dce519d7be1a692f12c096076b94978b488", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252145, "uuid": "9b20d340-ea0a-4f5f-aa23-826a63ce6305", "comment": "Malware payload (AgentTesla)", "value": "d3ef97a27bdcdb3a25cfad516b764d38a70c9420aa2c3ad2bf30fbf70f0d0cb18f276447074cc6a935fe275978f9b16d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252145, "uuid": "2a20d6d3-d0eb-4936-83bf-3ceebe3ce02b", "value": "A2E4CF5575F96FA2D235C7F9065011D59FFAA629BCAFE2080CC6E0DEA570F018E80E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252145, "uuid": "7170ba07-2b7b-49bc-b65f-28f1f803a456", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252145, "uuid": "70a17eea-4ddf-4d49-8086-30d7a094d91f", "value": "6144:P8Zige0W3F9MeJQEarC1p9NnUECojDg2f+y08HH0lxVPbZw24XR9g2y9v:0Z4pMeJQSQoPfXdH0HIJR9Zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623252145, "uuid": "a83f3f35-4a61-4da3-81ba-68be95e6e1a5", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623252145, "uuid": "5661f990-9a70-4f2a-8d0c-65ba41a75937", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252145, "uuid": "0fd6954f-0d50-4296-9476-deadb9207e85", "value": "Contract #RFQ 269986 CILLQZS MDBCQ GR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccbe288-c8e8-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1623218453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218453, "uuid": "e3135a69-e342-4254-83c4-b325a7743ab4", "comment": "Malware payload (RaccoonStealer)", "value": "ef8efde9f631c28472193cae25a589ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218453, "uuid": "fd87d9c2-45b8-4513-a849-6cae9b2d0986", "comment": "Malware payload (RaccoonStealer)", "value": "67ee0a1422563807cb5af36dd2527d3e96f5532f34020c0cdacb4325d31d77b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218453, "uuid": "d11195c4-4d52-429d-9378-826ed3c47424", "comment": "Malware payload (RaccoonStealer)", "value": "cb8fd51a5ba43bbac56241f543020a0771bfc202", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218453, "uuid": "ab2636d7-3591-4c75-b2a8-feee8e063f67", "comment": "Malware payload (RaccoonStealer)", "value": "22ef2d68d1bd38a185da9bf4d3f05b35671331bb3450887af9488e054966e83797272a1accbdaa89ee3e1100d497f9c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218453, "uuid": "63c78201-e816-4bae-84e1-f16d20e36f7d", "value": "B4C4E100B7E0C039F5B336F4597A82A9A53B79F1AB7850CF62D516DA5A346F0AC30727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218453, "uuid": "4036a853-286d-44ea-b7cf-5690bd6bc4f6", "value": "7868d5ef32f26d2611938c78da4c90fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218453, "uuid": "3bde2b3a-3b4c-41d7-a26a-1591985bd581", "value": "12288:B+UQvsLI7PpCvyF8PZzTbvPHAV5Yya8nSq1Z5ChYwYNn:ApcA8vyCPRT7HAz88f1Z5Co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218453, "uuid": "5e03b99a-5d95-422a-904e-b5eec4db9b7c", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218453, "uuid": "d16ecb1e-a70a-4467-90ed-795f116df36f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218453, "uuid": "e62cf80d-d39a-4199-a512-9fc04d6cd932", "value": "ef8efde9f631c28472193cae25a589ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dbd8bce-c93d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623255177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623255177, "uuid": "d35e2df9-a959-4430-98d6-f605e83d8964", "comment": "Malware payload (AgentTesla)", "value": "6d06a8c0a9d0c0fb69187d7bdd4d4c03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623255177, "uuid": "04b3d77e-c14a-42f1-9867-be68965d837b", "comment": "Malware payload (AgentTesla)", "value": "682ea743ceb920ea2f5fa8cb8e8e30aea2aaaaccd90c9cfbeb446a2225e024fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623255177, "uuid": "883d39fd-8561-458f-8b07-5aade734c469", "comment": "Malware payload (AgentTesla)", "value": "703e55f988e5608eaaf0e5e3d68e86134c0ad023", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623255177, "uuid": "5049b1e9-0d19-4a33-989c-a5dfd5d98ae6", "comment": "Malware payload (AgentTesla)", "value": "bcbf505779ea2ce87e743fa4a0d426a91b615ca61ac2c000fd605a257e4da4309d3b23abc346240cc496945696e93750", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623255177, "uuid": "e8342251-4af9-4f24-9203-cec32edd5709", "value": "A105F1663668EA01C3AE1435C9DB402443F9EE4339B3DF657EC932CE1912B97ED01AD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623255177, "uuid": "1a07eb12-afc8-4842-ae40-206f56906cce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623255177, "uuid": "58959a76-b560-4109-98e6-f53d29d6198a", "value": "24576:Tt0cgUVYtXiZ5iO7h2tOVEQ+kIP46QHSzeEeWQcR2YHRZRI/FS:CUYtXiZ5f8tJrP463eEFk8Za9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623255177, "uuid": "904b410f-68e5-42f4-8c9a-68fc4e0c2812", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623255177, "uuid": "1f3488e7-834e-4c96-af47-d27e4ae87348", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623255177, "uuid": "6e4a332f-4c64-4d3c-ad6e-d14123ea8c37", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5e297a-c946-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623259097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623259097, "uuid": "526f9ab5-078a-4927-8cac-9f0f617dc13e", "comment": "Malware payload (AgentTesla)", "value": "2fb326a8f311ebb5b809b377fbd1f655", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623259097, "uuid": "776c0ecb-6446-41f1-9724-7247a90c8b74", "comment": "Malware payload (AgentTesla)", "value": "68adf1593246aa30e26bcabf3dd8bc48f17212a2e6cef3bf9bfe0ce5e2625af3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623259097, "uuid": "077b9166-7f38-4a0f-90a8-da7693c2ff85", "comment": "Malware payload (AgentTesla)", "value": "53c19192fc92eb51f56a94f34441982b24441090", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623259097, "uuid": "dec49b2e-5709-4d8e-924c-aedc8b62296a", "comment": "Malware payload (AgentTesla)", "value": "68efc07488d9724877014144ef9817a6aefc6f0b4c13a8fc8f4d9d3a41860df33fc2cc40a03b55e751daa0b87c2dd232", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623259097, "uuid": "1adfd429-d5ad-4cab-a4ba-4b64641ce0f5", "value": "932517AC31A075DEC467CD768AA82CA4EA6174775B0BD203901705EDAA2CF87DF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623259097, "uuid": "12908344-5fd9-4e06-80c7-9112157bab81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623259097, "uuid": "86d2cc13-914c-4b98-a338-cccc2d6b51c9", "value": "12288:cxoRbMeKrV+w/PKIIxl4m6TnlYoMJwi6OjknTNqNeR7exu7ndDBeLEVqSrtlAley:p5yV9ml4m5oM3RknTNqQR6xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623259097, "uuid": "0b1c6193-f62b-4aea-88d0-fcb5014a1d4b", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623259097, "uuid": "92c087af-d245-4843-a3f1-d490dc881823", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623259097, "uuid": "e6c83a53-3600-40cb-8c1d-4698606389fb", "value": "2fb326a8f311ebb5b809b377fbd1f655.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc335ba-c93d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623255361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623255361, "uuid": "86c610a3-438f-4e9a-9fd5-8409ca275cb3", "comment": "Malware payload (Loki)", "value": "3432f5b8b3d1562cd94edcf132769ac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623255361, "uuid": "06f7aef7-5782-4695-ab31-9193ec334796", "comment": "Malware payload (Loki)", "value": "6982289da268751833df86719adae19eb523aad13273d4b484dfc6bf7bb606ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623255361, "uuid": "07d6d29c-3cd3-4d93-bbd7-ab5395c75715", "comment": "Malware payload (Loki)", "value": "1bc7a1b3193cae6fe72d9bc2cba734a26a615990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623255361, "uuid": "cdde8d79-044e-4b15-942e-e8441633ed6f", "comment": "Malware payload (Loki)", "value": "232145a7688e60be2df70634a252d99605e14172cf415a8bd9206bccbc49dcf083748de34f5e7aa275326c66181f5e41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623255361, "uuid": "69a4887b-9224-4261-a6c6-590fce2a9579", "value": "4EF4CF7CC984EDCBF37D50B0C0A4A67E82FE812A3B55D281BEA769DDCAD5F542B01016", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623255361, "uuid": "b8f5826c-ed13-4c62-86ab-bd4199f42b6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623255361, "uuid": "c1e91165-0b75-4b10-9f12-52d2f8e8f179", "value": "12288:pijlMV40j0lAPr4/7HPBDc11VIFfKSBQ/twf54:pWU4Y27JDCRB/twfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623255361, "uuid": "8fa6dab9-6522-4b89-ab49-cdd2001ff80d", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623255361, "uuid": "755a52ce-5939-436d-89a2-6aad3d5d830d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623255361, "uuid": "10c18fe3-138e-47c5-9516-ef4b07240dbe", "value": "SWIFT.PDF.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c8a5659-c8c8-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623204843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623204843, "uuid": "3c45d38b-01c0-47a0-bf93-0e1f058a6119", "comment": "Malware payload (RemcosRAT)", "value": "81077810ac367491d2cc0361bd379258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623204843, "uuid": "9336fc3a-6c8b-4728-a970-5d41a0dc5b4a", "comment": "Malware payload (RemcosRAT)", "value": "69f2bc91364fd9cf7c4e8e5494ccbfcb9fb11f3c71f1e84d05d6744b9c3fd58e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623204843, "uuid": "3f384add-b467-4999-9a0a-b7a023a42ca7", "comment": "Malware payload (RemcosRAT)", "value": "2e10dc1acf22c9bf18d34f7ceafa3ca1d809542c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623204843, "uuid": "311d13ce-c135-48b5-9946-96dde2aaa717", "comment": "Malware payload (RemcosRAT)", "value": "67719c25667974bdfe501f04624b1a53d20c4226ee79320a0127d506746f7082d0b4dd2033fd14a661aa0468969d49ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623204843, "uuid": "5879e8db-b4fb-46b4-866e-bc5f5820f4fb", "value": "DF759C341BC819A5D8D5CDB942352E62DD23711DBAE319A3C31BBE9854B48FCEAE140F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623204843, "uuid": "63c37c3d-d193-4279-a050-1449715f0fe2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623204843, "uuid": "fc61bd94-f250-4ba8-8ba0-6fa82b5224e4", "value": "12288:pbdeJkpDpU2HueDu8d83Dp+j5WAWq6MQt:ldeJqIU5WANQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623204843, "uuid": "1b80ddb9-4b3f-42e7-9803-d1ca85ae7d39", "value": 1673216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623204843, "uuid": "79d34893-c030-45ff-9ee4-ed4262949bf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623204843, "uuid": "5cff1e8b-668d-40a0-87a3-2d4de9d92eca", "value": "Factura Serfinanza043646133915059003076753598.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a845ec-c8bc-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623199696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623199696, "uuid": "50e11d42-0440-481e-ab3d-d94c33cfb2f3", "comment": "Malware payload (RedLineStealer)", "value": "3c159d357afea9b006402eddf2e36f8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623199696, "uuid": "2112d90d-4dd3-4034-b207-504a8dacdb1b", "comment": "Malware payload (RedLineStealer)", "value": "6b6913fa339d39736b38a25dc20e62567a8f969aa4410967ba5d8b24b77515da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623199696, "uuid": "e3a89496-e46d-49e7-ab33-1f1381955100", "comment": "Malware payload (RedLineStealer)", "value": "083176d2ed44bc9744b7041f165bbcee6ff9009b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623199696, "uuid": "948b34f4-c315-41c8-89ac-7b1f9ea4c7e8", "comment": "Malware payload (RedLineStealer)", "value": "76c061846af4dc363bef7d81600a0de6f8ccb7bdbce6aa64def0bf39681e74930f0344c3c47770e88ea1748c001297f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623199696, "uuid": "f361f047-7430-48b6-9d27-95764001314a", "value": "43A219786BE9CA79DCAA2F7199B1D205D731FC514801EB0F09D4818BA5D378CDA317B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623199696, "uuid": "e714dbad-9687-4bfb-af21-866fa36e9098", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623199696, "uuid": "ff03d508-0e1f-4361-a193-cd3263055271", "value": "384:+MSWRRoDMRtQCZrSmMTbq7yg2a2zya+H8/d9PD:xRiMUCFRAb6qyct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623199696, "uuid": "e8283651-e38c-4673-951f-ba79bc03e1a9", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623199696, "uuid": "b35e37d4-f82f-40f7-abbf-401e6219a086", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623199696, "uuid": "f3785fa4-fbca-4db7-83bf-819a943035dd", "value": "3c159d357afea9b006402eddf2e36f8b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf2f5fe9-c8e4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623217035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217035, "uuid": "a91e1b96-02e9-4fa3-a646-8398e8c712cf", "comment": "Malware payload (AgentTesla)", "value": "f89bab7af3934bc3077dabf2e125a220", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217035, "uuid": "0026bdf0-e668-4c96-b55b-3bce3ebd3966", "comment": "Malware payload (AgentTesla)", "value": "6ded6dc56dfca912f3d1e843151cb1265c1322b130d9b5721512dcbea078e6c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217035, "uuid": "23b537ab-8f9b-4d0b-878f-90799b100d4a", "comment": "Malware payload (AgentTesla)", "value": "36aa7e6b4b8f56e2b4e31b85ffa591ddb4a3a094", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217035, "uuid": "487cd700-b912-4468-9419-c1b463309214", "comment": "Malware payload (AgentTesla)", "value": "a0c1b4879be74ed67c7e31dc1c65683c7ef1c03d3e9998b0de56dc4d1673d8a81512bcd625d46055f2305e32bd65b0aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217035, "uuid": "c9223bcd-8128-4ee6-9e0d-a5c8fa4dc678", "value": "63A423AC17D8B304A6029952C89270855633FCA32E98D5F5BD23C77B9F8D25BADF0648", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217035, "uuid": "7e27ff28-8023-4b88-9372-08b41e449408", "value": "12288:joIkTmcw8U0e4yHDaZncQ362D86p4X97wMqgZ3V6ev6+m:LkTRw8U0e4yjVh2DfJcv6+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217035, "uuid": "46265272-634f-4d3d-ad83-b5f64f635245", "value": 468574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217035, "uuid": "02d24d09-5ba7-4605-9733-920f870f86a7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217035, "uuid": "00e4cf04-5666-4098-8fd4-b418fd73db9a", "value": "Quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25d33f0-c93c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623254916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254916, "uuid": "6c7bdb12-1642-4758-a8fe-ff120df1c8a5", "comment": "Malware payload (AgentTesla)", "value": "06981f4a46b2a26ea1b5958fd06cab74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254916, "uuid": "fd060715-0d53-4625-ba9c-7f4485241aae", "comment": "Malware payload (AgentTesla)", "value": "7179ce38bfea7ada7b29e550bebfe740255cd7ccbecd03796da84bd3b768bf04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254916, "uuid": "689ea460-3f8d-4e94-9ab4-1b8718af0122", "comment": "Malware payload (AgentTesla)", "value": "ff227b5b8664d1908985dad3df6d633467253528", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254916, "uuid": "bdc9e436-09af-4283-afcc-759b4e056a01", "comment": "Malware payload (AgentTesla)", "value": "09a1103fcc9d9de9cb4af5b2e1875f2605c0bbbfa5937b3a06be062cebf87c3203970d90dff43c95d931e918d106f5ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254916, "uuid": "40af6c97-b49d-42a2-a3c3-c925f544a92a", "value": "D1F4122137D42B47D37F26B24835215612F2A8026771E6EB7D8835DE2DF2B8AC714B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254916, "uuid": "bd4f0d27-1df4-4e0b-9c3a-da83b66b6c5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254916, "uuid": "bad2ca73-2f24-4c36-965a-e913ea5fcfa0", "value": "12288:zihWnUVYtXiZowl4uK4Vfc64D+2HuxiRfIIQfnOunU2PPdIalZC6Jjrcux8Ll+Iy:9nUVYtXiZoU4H42+2HuYfFJYXdIF6V39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623254916, "uuid": "a5245beb-091e-4049-afd2-fbde416d061c", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623254916, "uuid": "507a4d40-8b12-4723-8b5b-560a89e4cb77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254916, "uuid": "d69dffea-1e43-4874-b5cc-d6759863ae60", "value": "DENSCO QUOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5fc592-c8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623217188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217188, "uuid": "a2ff886d-f4bd-486c-a2a6-161817d9c312", "comment": "Malware payload (AgentTesla)", "value": "bb833e12d6504192fa97d05f5fea5bb5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217188, "uuid": "b1a816fa-15ed-4f63-9cdc-6cc0f9a9ebd2", "comment": "Malware payload (AgentTesla)", "value": "725078aa0f1842739208d0d7836dd81f44cfeafbe9974cd5cc163b6214107cc9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217188, "uuid": "e7a72b8b-0aae-4845-8a6c-b13fb2464e47", "comment": "Malware payload (AgentTesla)", "value": "7ae615822be409997ba279fd09a47ca8741c5d7b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217188, "uuid": "1bd2319e-0ad9-49ea-88f4-19b1a1c5f41a", "comment": "Malware payload (AgentTesla)", "value": "fd621587f6031a847182dbe1081888fbc7fea7f551dbf5990f5aaee94754f1b6212c44a44c7605d0ca6eb5f5544a64f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217188, "uuid": "69fbb9df-314a-4f35-8297-6ca4b63338f6", "value": "9635D6EC325071EEC467C6BACAA86CA5EA61357A471F410794132ADDAE1CB97CF104F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217188, "uuid": "b48de867-7eb7-4d8f-bb2b-2d96d7e90cd2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217188, "uuid": "d411953e-0605-4497-ad58-075db3ef9a41", "value": "12288:JQfWP0rOZd2GhQ7TGud/N32df6RYju1ch8fbz9Or5J04P8S3VqEiaJnbK+rDo/0u:PnA7T3N2df6Ramc2fbAj04NgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217188, "uuid": "29c648c5-4047-4467-bed5-5acac2136dda", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217188, "uuid": "67ca005b-a57a-4796-8dd7-84b6beded7bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217188, "uuid": "fff35c42-6e8a-4009-8b72-c84eefbee83b", "value": "Urgent Request for Quotation- 9957801- Front Office Europe and Asian market.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8aa373a-c922-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623243760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243760, "uuid": "802fd284-ad3a-4a7f-8615-d7c5f7924420", "comment": "Malware payload (Quakbot)", "value": "5b24714729a060ba44ae054e3d0d013f", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243760, "uuid": "3cd9e647-9427-48fa-ae8d-9c2c4817e5bb", "comment": "Malware payload (Quakbot)", "value": "7275dd8635d1ad64f258069bd74768e77d7b5dbbec1a92fb684ee861d9b3304a", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243760, "uuid": "9d16757d-25b9-4383-a0b5-a45369875170", "comment": "Malware payload (Quakbot)", "value": "8febf8a15fe6417ef7a937dabfc2265a240eb353", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243760, "uuid": "0c224401-d5dd-4ece-b3af-a514898fb324", "comment": "Malware payload (Quakbot)", "value": "d56e9d8317e3180471adf703f5adbcb0171d30414d46bae71b56ad7a96553c48423d51bc01efa7ee14b626c848188120", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243760, "uuid": "83b9aeb2-7d60-4ec8-99d4-749b7cc56aa0", "value": "41A3794AA7511074C7E58F7987974CE2C20E307FFC0FA0292793A7463963BCE5A2926D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243760, "uuid": "23d71d07-eb67-4dfe-b6e6-1709fcc4c2f9", "value": "1536:yfo95wwhYzZGVs0YNCAD2RkQ0wWfkkkkmaebc6rbNGlUDCx3or9rd04YbfJRj:yfo9aXNcWhQ5JaQnNGUJrvebfPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623243760, "uuid": "53d1c5c7-1b9e-4bad-bb4a-93b405b8af78", "value": 100304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623243760, "uuid": "beee1de6-4f67-4c0f-b856-9b0020b2e6b4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243760, "uuid": "fe6372eb-29a9-4fe9-9438-db163cd22a85", "value": "Documents_1556816880_1960631962.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309af137-c8f2-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623222808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623222808, "uuid": "c95faf6f-0846-44ae-8559-35165756da20", "comment": "Malware payload (AsyncRAT)", "value": "a38420b83c3a59cca60752524c7dc448", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623222808, "uuid": "02bb93b6-01f2-4093-b9ff-eb3a9a848fcd", "comment": "Malware payload (AsyncRAT)", "value": "729be186b438461299393d8348a836569d3bcac48df1bd5ebef25cdf1b908ecb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623222808, "uuid": "28a03237-486e-44b2-91f3-ad6b832f9c85", "comment": "Malware payload (AsyncRAT)", "value": "c60b541b1ccaf5e03f08ed319551fae9bd6c12ad", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623222808, "uuid": "5a24d704-25e6-4031-a90e-61489159fc7e", "comment": "Malware payload (AsyncRAT)", "value": "236750b3ccd0d826e4b36c5b1cae2de206a0dedeaa305549f6827045e66c66db77a47a814c4a0cd04083775204d09ebd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623222808, "uuid": "2b6cda10-3708-4ed3-b4cf-a14d0314b1fa", "value": "30D2AEB1D70564A4C47F5A3FB0E166F5E3E8003366A4D6BC1D42BADD851064B4B122DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623222808, "uuid": "a42eac0b-189b-427d-8469-3ed8eea033fa", "value": "384:7ZSQMTrMybpOEpExJAXG8MCpqva7QeQBRdsdv8ycONNxt/ZtNN1GNYS+30OnL9xW:l+sHp7CpqyTc7sGOxllN1GNn+3BG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623222808, "uuid": "bdad9913-913b-4adb-ac06-219e465a64fd", "value": 29437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623222808, "uuid": "3cb2e937-31e0-4525-9f42-0bdd928acda8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623222808, "uuid": "1e73da45-b72c-41f3-8842-30f882190857", "value": "Scan003.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8904a5da-c8d2-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623209213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623209213, "uuid": "d2c5f560-5ae7-45ba-9705-99d40337c0fb", "comment": "Malware payload (Quakbot)", "value": "245c3e542030fb5f37cc1786c6d2ad52", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623209213, "uuid": "ab8a3258-aa13-4a56-b980-3709a8307e05", "comment": "Malware payload (Quakbot)", "value": "72da5a8ba62bc25dfbe12f189664117f79db3fcf2d539e3b1f8abc3923e8a2ea", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623209213, "uuid": "5815fabd-9078-4c98-9e89-2c0bdd071446", "comment": "Malware payload (Quakbot)", "value": "d3659467af26b5cf1773b69bd6b9820b1b777dcb", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623209213, "uuid": "66a9c767-0fd6-4068-9ca1-d3da28fc55d4", "comment": "Malware payload (Quakbot)", "value": "18fc5678debb043ef9a6e241ad6dc370f8342f0b93eaadf31b151b44120fa565c4a34a260a4a3708c2affdf0368a87eb", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623209213, "uuid": "43261fc3-90e8-4c79-8772-43d196f10e89", "value": "9B7412BFE28159B4C3398D3EC68091D0C251F1D481A7731D47DD3528A7532AFAA9E2DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623209213, "uuid": "996df8ae-5ca2-4575-a30f-03a147671326", "value": "6144:8gRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNpC:8gRMmEv2Bc/nvm8IKABfsYOmauFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623209213, "uuid": "42d448bc-86d6-41cf-9879-1004af527518", "value": 341572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623209213, "uuid": "e986f853-be3c-402d-bf6f-423e45089cea", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623209213, "uuid": "996a5611-93af-437a-b074-d5866ccafa57", "value": "Cancellation_1844611233_06082021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2092cff8-c91c-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623240820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240820, "uuid": "b31ba66b-bcfe-47d8-8148-ff861c4d3f75", "comment": "Malware payload (SnakeKeylogger)", "value": "82b0eb590428ba310a78172776b9ee6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240820, "uuid": "c53536c4-3f16-4dc6-9740-36202b3ae157", "comment": "Malware payload (SnakeKeylogger)", "value": "737db6e7e93b47683419c374b4c85f92b3c0b5c2437c343de2dd4b35e50a4758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240820, "uuid": "55f61eb0-b8e1-41cf-86c1-ef1997f0e8fd", "comment": "Malware payload (SnakeKeylogger)", "value": "b086f5347e3a6ee9e088025e74870af7d13d9594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240820, "uuid": "781d56bb-4a42-4e36-9c49-52da42fcb553", "comment": "Malware payload (SnakeKeylogger)", "value": "deef602bac3006626848ebf736bf52b32fdb616c31a0c5e78a90f4e4be31aad5b13eba5064f816b832b118de002a2d89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240820, "uuid": "ccbce36c-750d-4e3e-843a-44e4e98f1d8c", "value": "A22412182504B113D6C306B65CEBF1967AB6CE228F5B82DBBC98771F2EF27C52253425", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240820, "uuid": "73260f50-0a2d-4ffd-9df5-5ebaa253ddcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240820, "uuid": "def692b1-6724-4e68-8c5c-b3dc6a0b628b", "value": "6144:llRkWl1MpJucWLWq8IFQ081f0VWiV18bU1:lln1MpJuMq8JFyWG2bU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623240820, "uuid": "6903e34e-da98-4d00-9ba3-5486c9d86888", "value": 227312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623240820, "uuid": "c234c22f-d128-4fe1-94e2-a8a815741027", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240820, "uuid": "19bac2d1-e9f9-47c4-afc6-30812adcc270", "value": "RFT_0336_137_390.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1406e38f-c923-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623243806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243806, "uuid": "d62b036c-85c8-4a7f-b02d-d17fd63d39af", "comment": "Malware payload (AgentTesla)", "value": "a6a1cb4fd875049bf1a0339bc7e98ad7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243806, "uuid": "27cb21a7-9f6e-4fb4-a25d-2fc1f56b11c5", "comment": "Malware payload (AgentTesla)", "value": "745037a09cf0b795466c1f81465c339f6a89b6cfab67baa60bb9fda125463905", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243806, "uuid": "047d2a39-9425-41fd-88bf-42a55ec49f5b", "comment": "Malware payload (AgentTesla)", "value": "0a258fcc918985e4246ec65d727cd8e46b1d146b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243806, "uuid": "ee7d1fb4-6da8-4cc5-b532-9393828d8555", "comment": "Malware payload (AgentTesla)", "value": "41c836d9b10eff82090579a45c9ae84410a53f5844f3c9afdcea3322273084cbb935e4ab60f4dcb8f5ca96ec17f4f8d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243806, "uuid": "be8b4b90-37d9-43a3-8c55-fba8c3e786c7", "value": "1735BE2426B4EA5CE17A87F780E140004BF1AC07C72EDA4DFD71BAAD1E723C6525B766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243806, "uuid": "84085591-7835-4be1-9231-20eed191b926", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243806, "uuid": "f30b9ca8-c86e-4722-b408-c8eadf7478c1", "value": "12288:dhzNlMV40JY/4yEjAo8K/xtQSstRTe6Zoc3yNB3qgkGO5yl:dhzNUW/49jAo8K/4SsHeGyNvkR5yl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623243806, "uuid": "369857ce-1d9d-4722-a2c7-1db71f9ac11f", "value": 1102848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623243806, "uuid": "273c9303-e4c5-4ecd-aec1-bc59affb4469", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243806, "uuid": "d4bdff36-78a0-4f6d-83c2-ed5fdd58dacf", "value": "All the Documents and Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baee2c15-c8fd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623227765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227765, "uuid": "36e23bc9-4086-4147-9c12-375f6d85f55a", "comment": "Malware payload (AgentTesla)", "value": "822514069b929321e08d7db13ecf8159", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227765, "uuid": "6544307c-b971-4c90-baab-f4c01fb045b2", "comment": "Malware payload (AgentTesla)", "value": "75a25ca27415d7a318ed0cc5e36ef146b0ef0719a33efb6e6ae033422250dfda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227765, "uuid": "e678a03e-1fff-4c73-bffc-d0ae2fed8997", "comment": "Malware payload (AgentTesla)", "value": "4887c607c109d3d2e4db330d8bfac18e566d1600", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227765, "uuid": "bf815d87-c42c-4e8f-a16b-5bc491d296ad", "comment": "Malware payload (AgentTesla)", "value": "9ea8a8a1e5b7d896ee0292b5c31430ab0fe1ecf242622f1bc9e08e12ef0c68e73e2d02b95b144605cb24a3f052eaccf5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227765, "uuid": "91f3d78d-4cc3-460d-b33f-97130738dd43", "value": "AFF4DF3562488909E07F5336A071550443F5FD0BD362EA0DFEA978E92EB23C2A36F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227765, "uuid": "c0c381be-cd1f-405c-8f6e-b6d3d0c0357e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227765, "uuid": "f4e54e44-354a-4031-8708-1c6624947cf5", "value": "12288:e+Zg15tNPvHyBAkqgo2lMV40J9f0ki028CJEFDKTYo0l60e5PltfdRc8:ecBARgo2U30kilYKTYoH0e5Pltfnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623227765, "uuid": "8edc5ad9-b66d-4941-9a70-7ea559308478", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623227765, "uuid": "28c3b541-6efa-421a-bb81-0a76d1a74336", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227765, "uuid": "5bf71225-af6e-41ac-8d89-62275f3e65c5", "value": "Bestil 5039066002128.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcedbe8-c8fe-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623228280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623228280, "uuid": "07d835cf-03d8-4923-a76c-3e0891fa98d7", "comment": "Malware payload (Formbook)", "value": "9f57fc54e657e237a2208000532e99bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623228280, "uuid": "92ea61bb-9c34-4ad8-aa30-0fd357bc3d31", "comment": "Malware payload (Formbook)", "value": "76a9d850411a7418f464266168a7df679b4fa00934649ed2e509156aa2875be2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623228280, "uuid": "794855c5-241c-40ee-beb5-2041fee2aafd", "comment": "Malware payload (Formbook)", "value": "35cdf7a7e33e50ae2029b9f023769d6ecfdbc26f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623228280, "uuid": "6dfeb1d3-ab99-4d99-a906-0ac3fca6e23c", "comment": "Malware payload (Formbook)", "value": "e3d7b602a9e69c9d527a0eab64bc2ddf371c43caec79dddccdac7847d3e9db332c99faf931ed76cc27c9224e7a927737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623228280, "uuid": "c806ee88-73ce-4511-a6c3-4c5d7aace68e", "value": "5334121A61E3CCBBD4D18F320E71B76AE376E70E05556E4B47186FBEAC1058387182E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623228280, "uuid": "0c6c308c-bbee-4bfe-903b-af4cdec0050d", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623228280, "uuid": "9c1b96ae-90ea-41c6-a93e-ea016e1402af", "value": "6144:JPB6yjkFPS3SvoR0uQkFzOOid3FSSjZwx4gIM:Fdjc63auQkF3yIPxVIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623228280, "uuid": "0d5705e7-7409-4946-9d30-a477ca3399e4", "value": 238405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623228280, "uuid": "1eede188-99db-4400-ab31-8f8216457ade", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623228280, "uuid": "ba45284c-17de-4516-a5ee-9458d04d02d0", "value": "SecuriteInfo.com.Trojan.Win32.Formbook.3cc50675.17377.30053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d05dc9f-c917-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623238855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623238855, "uuid": "4d7b01ba-ea8e-4ebd-8976-47a72cb00e16", "comment": "Malware payload (AgentTesla)", "value": "13c438fd9d99e36bfe63935fbbc96db3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623238855, "uuid": "e6a0fcf6-1228-48cd-b85a-79e25cc7649b", "comment": "Malware payload (AgentTesla)", "value": "76e9b9a64e62360d816453480d8b6dca8a179ae043a2022a165dc7dbcbb7cdd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623238855, "uuid": "3d527a17-8f26-48ca-8c82-d65cbb328f0c", "comment": "Malware payload (AgentTesla)", "value": "77e4db5c93879972463187f1a0ef06a6de4a55d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623238855, "uuid": "10050ff0-bae6-4ca7-92ef-84f36e827b14", "comment": "Malware payload (AgentTesla)", "value": "1bd6da291e843a304bb5823b2aa5965e280daad8da8ba7ad01256f40eb82c8b3a6352d36682a6633b35cf19c114d500f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623238855, "uuid": "47d9f2f9-8b98-403c-9c9a-1bcc94237931", "value": "2A25BD5D70E7F7238E1A417C9DA6CAE651BCC75070F4AEB4250AC7EE42D9C7A20B0687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623238855, "uuid": "d681816a-cb8c-4128-b625-5c0d09bf7226", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623238855, "uuid": "19967c8a-32a8-4c7e-80d2-735b379a0b12", "value": "6144:GLJ2IV2mjJ7wbma2WJcsQJUY+mbfdsB9KfoA50Gmj/gQ8/+Tx:Uk50WqRUWls3AGj/c/y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623238855, "uuid": "1882cdf1-a4bf-4fec-b7bc-576b0b259d9d", "value": 978096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623238855, "uuid": "3f3e4650-de47-4022-990f-8cfcef50a63b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623238855, "uuid": "a6059183-4d47-4def-b654-657aea8fd332", "value": "\u4e2d\u56fd\u6d77\u5173\u65b0\u89c4(chinese version).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a57b66c-c8e0-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623215067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623215067, "uuid": "a70545b1-3e8e-4a2d-90b9-d0e9591facc0", "comment": "Malware payload (Loki)", "value": "e7a81600cecc055600d60a3c1029f374", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623215067, "uuid": "4dab7609-d3b7-451f-8e4c-025db52ac363", "comment": "Malware payload (Loki)", "value": "76f8eb1c233a5e3f94fe5bf42e28198b922b2957fcaf1c471c8e4fd5e59a2f80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623215067, "uuid": "a4f56c85-b74e-4310-b229-2eb06f49dee3", "comment": "Malware payload (Loki)", "value": "eb6458ff8a0b63d18bb4082226c62400ef924226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623215067, "uuid": "6aa5a50b-8df8-4e91-b87f-03ce4b975ee7", "comment": "Malware payload (Loki)", "value": "ad8cdc31433c55c768c702820346a55ac4b6ebf8e245202af3708423ec23f7f1cb7bb424ce69b49842ef52b7b9e5b47c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623215067, "uuid": "41a19407-6632-4fa1-af01-c754b74b2ff3", "value": "43448B7164F264C9FAE98DBBAC1A8480BEEB5C18DD02810EE01871F502737D9D65A4FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623215067, "uuid": "8fb1bac2-8849-4945-a826-1f7eb4a5cc16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623215067, "uuid": "d6b3c20f-7f48-46f9-8ed1-66f1251907a0", "value": "6144:1GobdlPFJzy2fEi0xIAZCGLGFUthiIYTz:9bfP+2AxNFy8gI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623215067, "uuid": "72b71190-3924-430a-9b62-c6d15b792c92", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623215067, "uuid": "3b5942ea-cb71-4eab-abb9-c2cd7cefe0a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623215067, "uuid": "c23ba995-f5da-4366-9983-273f2e936b68", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce4a95f8-c8e9-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623219207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623219207, "uuid": "f912321c-7154-44e5-989d-44ce5a37234b", "comment": "Malware payload (Formbook)", "value": "3198be740acf618c855287c53a7c242e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623219207, "uuid": "0f42ec66-cf12-4555-a163-cd64bcb680c2", "comment": "Malware payload (Formbook)", "value": "77fad01edc15317271ba3b5b125518fee0be7b91513a0db9d518e0fe6ecb2b27", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623219207, "uuid": "0f2f585f-ee15-4eef-b110-9829df1f1259", "comment": "Malware payload (Formbook)", "value": "dfb9a75a56a10c1b89015149be7d71ab66814702", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623219207, "uuid": "825c8f20-d81d-4f05-aed0-d348ede77b1e", "comment": "Malware payload (Formbook)", "value": "7653f325418675bb49d45ced9323f2e9e87db48322c7565a6403cab384f51726bdcd00ef0e4663a2d844f3f31ef3494d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623219207, "uuid": "71c5796f-b789-4134-91bb-c3e5bd04be9b", "value": "E0C423227C2EF0A3DA23F397CD4856492C766A73A12AB0427959FDC22E099C33F4C517", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623219207, "uuid": "260d1ec3-a533-43d4-8d28-8d3b2d070c41", "value": "12288:plGWyuuoID5/NfbyUkkOmklca5ksFRhkEtaKQyXFbxPp3SFUQm9MK:p4W9uoIDvyUkDmklcG7hkVnaDhiOQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623219207, "uuid": "5135da59-88a1-428e-b414-6eb9c3f8ff57", "value": 587266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623219207, "uuid": "5691f516-f5da-4472-9c46-e31c5c68bc5d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623219207, "uuid": "12037f38-a49b-4b47-bca0-3702c0c2e299", "value": "Bank payment.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9550295e-c937-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623252613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252613, "uuid": "21192d3e-67ee-4577-9ebb-9e1b6c41aa8d", "comment": "Malware payload (AgentTesla)", "value": "3134a0a7cb659dea105396040fe159dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252613, "uuid": "f0052880-d080-484d-b5ee-060a4836af5c", "comment": "Malware payload (AgentTesla)", "value": "790f829773689daf7ac1571c58bbf2ff17d57af30a1ba1a2334b7a4ec0ce9645", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252613, "uuid": "341fbb22-6e9a-499e-ab03-a6b5596f9537", "comment": "Malware payload (AgentTesla)", "value": "5070365c358aa0d82274239dde08b25b98409f80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252613, "uuid": "c92f6b37-30c3-4dae-92a1-0679210f70a3", "comment": "Malware payload (AgentTesla)", "value": "1ff8ca578c970fbcb248f53ef43fb2649fd9909d125cb137552a7e6bbeead611d22330a0b5e30dd8d196173a40ad8c5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252613, "uuid": "3858aef3-a6ef-42bd-b77a-da173fccbc71", "value": "7215BE1535EA9FA3C235CBF5011221A14BFE9E25FDDEE2544C9AB0DEA474F4D8A40E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252613, "uuid": "fa97c621-fac0-4923-9b00-609b4901b523", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252613, "uuid": "7eef3f0c-56bd-4018-a1b9-2cde8b592607", "value": "12288:+mMFe/BZTqb+3RGF8AmSmgrIZhwHDI7rVCYRN2hdqbz7HYob:+mMFqBo+3kF8WmgMiIdCYRN2h4bz7H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623252613, "uuid": "5e6028bf-24b7-4349-bbc7-e40fbaf78c2a", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623252613, "uuid": "2ba2db20-5ab6-4c35-8a81-049a339e2a92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252613, "uuid": "1cf7aebc-a99d-4d23-b14a-95c4934ae5b9", "value": "Bank payment information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509d9444-c92d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623248202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248202, "uuid": "9479fc32-bd4b-4de8-936e-0e1016638bda", "comment": "Malware payload (AgentTesla)", "value": "f20e11c467d6b5ff69392eada7786e70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248202, "uuid": "c7d7f7f1-5d68-4452-b3a6-ccbb72b47a25", "comment": "Malware payload (AgentTesla)", "value": "792289cca0551061d5e855f8315982980a027ffe6f8f9f2eab17e348afffbf6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248202, "uuid": "d40936d6-e75e-4eca-92de-a77b7edd1d44", "comment": "Malware payload (AgentTesla)", "value": "a6ba703ca0ffd5acb36eda9943ea43e1e11b5bdd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248202, "uuid": "c8455f46-d292-4c21-a4e6-b09b8653db35", "comment": "Malware payload (AgentTesla)", "value": "ef196fd133843df35c89a8cbf0a8ec4e5d9e2cb31ead3a50e84eaaaa3041977d44e27d39be873d10ebd29fa867afc43d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248202, "uuid": "5b42a5dc-3ac8-47da-8168-832847e4d5fa", "value": "CDC1533A97ED0677D1B1C7349CF2C20FB275AE537662CF8F68D4031958262506A8277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248202, "uuid": "8652b83f-3b7d-4e71-8362-311a1deb7ad2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248202, "uuid": "a160d408-121a-4089-863b-d6c8cf16c763", "value": "48:6KI4TPvt3L5ToJSYFq0j5bQD2+3B4Fx9MViuBsZuulCSoVzqXSfbNtm:NJLvBLSG0j5bQD2YBsdu2/boVtzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623248202, "uuid": "0148be06-f761-402c-bedd-4ea576bffba5", "value": 5632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623248202, "uuid": "a1060deb-5dc9-4707-86b0-0ffc0ef5d24a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248202, "uuid": "5d15b872-bb26-4a8c-a2a5-5d6fbe2b00a0", "value": "MESCO TQZ24 QUOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df23edaa-c91a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623240281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240281, "uuid": "b62941f7-fda7-4218-aa4c-5999c5e54ffe", "comment": "Malware payload", "value": "b60c9db6ba5b531f5a6336e0ac06e8ca", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240281, "uuid": "cd8585dd-e8d0-432d-9974-3b37d60093f0", "comment": "Malware payload", "value": "7dcadb0e503e51d6f24c3e245cb28443d2ab5b5954454c44e3207d1fbcfdfe52", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240281, "uuid": "7007614c-d9e9-4e53-9664-72acaff82110", "comment": "Malware payload", "value": "46db9edb5d9088f22680949f67d2dd688de6f2e5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240281, "uuid": "29789cac-5e1f-4384-86a7-9b2708f1d349", "comment": "Malware payload", "value": "d3b7226c758ba657a79290f080ce13072a014db7a1d3748f166b37cdfaeca43bb631361aa77428c200b0eb4721ed562f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240281, "uuid": "135f620b-fe3e-4c29-94a7-4a344e505d2d", "value": "0581C63137780903CE5990F2E9B3FE620AE7F12646CB0584736EF5F5031BBA55924456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240281, "uuid": "1c367792-a71d-4ca7-b9a4-ee032b971ee3", "value": "96:qAHvohI1c4eY2+t2+6BOJldi4m9A3z5NtMkoP4t:qAHGI1cBQ2+BJvKU5NG4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623240281, "uuid": "ea7c4228-db97-4e75-9f19-658e738bb39b", "value": 4100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623240281, "uuid": "44fd72a1-d1ce-44c6-beed-c4dbb7ddb6b7", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240281, "uuid": "70c0dc47-bd34-4165-9fa5-f51031dd4580", "value": "ACB_BBL202199837878.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7727bc78-c8c5-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623203599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623203599, "uuid": "417b8718-6fcd-4357-ae13-a2aa93c1857b", "comment": "Malware payload (RedLineStealer)", "value": "59175bad803cf722a922b2a065d6bf41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623203599, "uuid": "b56c2744-e764-45da-b9f5-4ec3b57c18c6", "comment": "Malware payload (RedLineStealer)", "value": "7fac861e207e11a1d8f698c4e9b18724eae674610a738ebec6530843c28467c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623203599, "uuid": "b7dd3427-e68b-4e42-9c1c-f8b92a648d7a", "comment": "Malware payload (RedLineStealer)", "value": "6cd0b6c1225997a1a153cbfc61a77e497530a046", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623203599, "uuid": "7c209318-43f9-4add-9a9b-31b7c2ad28ef", "comment": "Malware payload (RedLineStealer)", "value": "b54dc302cb1f6065937e3d2fe4a5a88724e177c3621808711f4969284831dcda684aa70634cd540342fe6fb7b6e00f56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623203599, "uuid": "05414ff0-1846-488d-8b1f-0ced8e384b3d", "value": "0894C65E3A96BE06F3B927F1C1DB45244374D942E273F3563AE863B80913BA21E452CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623203599, "uuid": "a654dc49-0851-4447-89ec-60009a7e0488", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623203599, "uuid": "76be0ded-9b4d-415c-be6a-d6dbf76b235b", "value": "6144:V3Ja1EUDKREy/1PVLK+SxulmfBs70YpMPwrE3034C:VZRVNPVOrxulmfe0Y2wr40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623203599, "uuid": "742eb848-d496-4c0b-a949-5855cd06d6e7", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623203599, "uuid": "ac69afe5-a5c2-46bb-9564-20dc88f2ff2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623203599, "uuid": "7a355603-dd4b-46ff-8fef-d100debe4c00", "value": "59175BAD803CF722A922B2A065D6BF41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869c1c1a-c931-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623250011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250011, "uuid": "b4106c31-b45f-4e3d-8f05-4a97a4439638", "comment": "Malware payload (Formbook)", "value": "75713d701280405bc3679c0d13b3752c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250011, "uuid": "f80771c3-3273-44fd-8068-23cf8f9721ab", "comment": "Malware payload (Formbook)", "value": "800fc408d38c5b38f1877e30c612b4321e8fb0057ce28a923a19681fd351c5a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250011, "uuid": "200cbbe8-3858-4a89-8c13-6079df6cf107", "comment": "Malware payload (Formbook)", "value": "0ad523526f113865e2a8104145031dc50ea0ae8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250011, "uuid": "cd2a4ff9-ecdd-4b1f-a89e-aece5131a4a8", "comment": "Malware payload (Formbook)", "value": "f48b1d6dac34c280a165ea3d2ed1dd6da13c2c2e45ef41237d3035e4ea57fd35d49657c1d9b354e57a080ef37c9008ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250011, "uuid": "f02eb185-e804-4e4a-9c12-c8c295d01941", "value": "BFF4E13522488A14E57F5335A071520443F4F807E323EB4DFED968EA2EA27C2A76F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250011, "uuid": "41a48a07-d78c-4350-81ea-a081c2395bee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250011, "uuid": "e2dd3605-a52d-4bab-9cc7-8bc23c79da66", "value": "12288:oQkU915tUPvHU8RhAdFlMV40JikjjGrCQ5y4FwMEbymffIOYkL9DRfX0/FSKy:oNq8HAdFUwkjqrJ4YVOyMfIOYkL9Fks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623250011, "uuid": "af76e59b-791b-4d25-951e-83e706e3ac3f", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623250011, "uuid": "91d1fdd3-1c5e-45a9-ae62-64113e28f499", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250011, "uuid": "311f7c02-b4b4-4897-8bb2-44d915e2b2be", "value": "DHL_AWB_NO#907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706aea02-c923-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623243961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243961, "uuid": "cac3cc89-861b-4187-ac1c-caceee88a4f8", "comment": "Malware payload (NanoCore)", "value": "02430d34be900990fbf6a7efe35a7c64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243961, "uuid": "57adcc39-6730-44c5-81de-829b5a93b3d6", "comment": "Malware payload (NanoCore)", "value": "80ca460c629559cf38e1244983877ed9c041c636c1f2e7e388ae2f9ba4d06788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243961, "uuid": "f8d5c397-087a-47db-a8bd-c2a478997b18", "comment": "Malware payload (NanoCore)", "value": "00b40170c46ae026cf518588d5b6177538bb1036", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243961, "uuid": "2b67f401-a68d-4d13-86fd-3c8b3ed9bfed", "comment": "Malware payload (NanoCore)", "value": "5f5d47780a62498198a6db425cbf6a9aa0eb62d8f07d2ce919f4acc512fe5f89c790186bd16a6d4547bdde9e1d2df4b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243961, "uuid": "50a235b7-74f7-4b4a-81cc-876e0ffc3058", "value": "542506AC315075DEC467CE768AA82CA4EA617477570BD203901705EEAA2CF97DF206F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243961, "uuid": "4ffaac05-3151-4d0c-8ffd-af3fa2e8af45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243961, "uuid": "d2ce14c2-396b-421c-887f-2c316d7fb82f", "value": "12288:Rp7kPTkSKoCyFABtnt/u7At0mGCMDXuFbCNbV89+7j2hjTQJpOVi26R8GOYZNh54:PIYo9A1Bt8jzuFbCNbq+YI8Gjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623243961, "uuid": "e052e764-0f65-410f-8970-6340c37ff6ab", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623243961, "uuid": "fd02d28a-e433-4a55-9208-0857a9ecd838", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243961, "uuid": "0f2c841e-c9fd-4472-99c7-9919e71a5bc2", "value": "CONTRACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c4fee6-c932-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1623250223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250223, "uuid": "73751beb-19d4-4a94-ae31-d00b8af87572", "comment": "Malware payload (Hancitor)", "value": "cff55f1f834d01e49035a22f81b08047", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250223, "uuid": "3a00c634-d5be-4b04-aa14-465dd94ee13b", "comment": "Malware payload (Hancitor)", "value": "83409f0bbfb014436c65a34cde617b515838112080afb792160c388156a63077", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250223, "uuid": "ffc2699e-9aad-409c-ae4a-0c4cd6e87f89", "comment": "Malware payload (Hancitor)", "value": "8af6ad1eace9425c925f0f5e274733a4e4088fd6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250223, "uuid": "1177723e-bb26-4743-a814-504221b7f500", "comment": "Malware payload (Hancitor)", "value": "c519268a89cf1216dff974e17bf985f5e448ad44e0e94a8191960b7c7eab457f5848c79aaa2413cac5b6c292e51acb1a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250223, "uuid": "6f2c0d7a-dd5c-45f4-ad4b-51af2842d2a4", "value": "FF94D00132EAF471C016813B8F45C6AA436A7C459FED5D8BB9C86EDF3D2E1635B29305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250223, "uuid": "567e571e-044c-4181-8ee1-00cd08f91785", "value": "1377db7102a7a91f1f40125ba387f9f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250223, "uuid": "0bb3e043-1e2a-4ad4-8833-a4acb3ee38b1", "value": "6144:ERiEKMBQVteGqlpEDaPe+f6tdhKsqUqhNPfiWJ51oXfVv7SUABS:EdBQVtUHNPe+f6VKbUsiq1odEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623250223, "uuid": "7b479602-55c4-43e2-ac8e-8d925e1be42c", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623250223, "uuid": "2bb2cbdc-3432-408a-9dda-ca403a83659d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250223, "uuid": "69a574c4-65c7-4e55-8bac-786430c78633", "value": "omh.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea29bd3-c8d7-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623211396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211396, "uuid": "fe220562-ae95-4b68-bbe2-6f24ee146e58", "comment": "Malware payload (Loki)", "value": "dd82bf51589c92327d915c97dfc8be6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211396, "uuid": "2085d043-3422-4c61-be83-7bbcccc4cfb3", "comment": "Malware payload (Loki)", "value": "83d0361ef20cf8996f35f2cbac3ace14a47fb9a61133bd646754355d1ea86bed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211396, "uuid": "009788e2-200d-406c-953c-3fea3c308522", "comment": "Malware payload (Loki)", "value": "7d64bee0074485f4b385b5d1e2d52f63b29438e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211396, "uuid": "91d3804c-b9f1-4e84-b806-403d7f8dc946", "comment": "Malware payload (Loki)", "value": "f15f1e8e41e5d8e41cfe9416d8bb40512e25a6409fd6f30d8e243070492692df591cca7fb67ba5b160f7b86582961a05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211396, "uuid": "33ea8e8d-c393-42e8-9c84-683b3e6ddff5", "value": "B0444780C3C112E2E4EBEDB6E3924144B5904D4D093F7CB4AA48FD259EB76F772662D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211396, "uuid": "3aa11c46-387f-4cf4-9a1a-df08ab0d78f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211396, "uuid": "252175a0-aaea-4dc8-ad41-9216288c8fac", "value": "3072:hY1f1BB3Eua7EIedol+X6FRGovoBZsJKhp+t/J+sChdWKE7pTlxIqd9Pg8Y:QNDMEFm+Xk3JQ+XJ2NE7pTlxl9I8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623211396, "uuid": "79b7d117-e9bf-4d81-8129-cda3d590dfa4", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623211396, "uuid": "38e32f32-b20d-4733-87f3-0ad8b46cc53d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211396, "uuid": "f6189ba5-6d16-465f-b18e-c1196186aa3f", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d052dc-c93b-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623254143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254143, "uuid": "a59d9e07-d95a-4017-85b7-454ce198da35", "comment": "Malware payload (SnakeKeylogger)", "value": "b1b9afa4415f14b3fdc716efe792ec80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254143, "uuid": "626425c3-fc64-4d28-9738-8b90f4eb9c80", "comment": "Malware payload (SnakeKeylogger)", "value": "845b22426e6b0d0632c1b69f07f27f93f332e0061198cb874d3a3d6fd8a5fd7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254143, "uuid": "6a61113a-9eea-4b2c-995b-af82d2b4b45c", "comment": "Malware payload (SnakeKeylogger)", "value": "458dc3a81aa5b69523e45efdb651032f6f047b67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254143, "uuid": "1d454d11-aedc-4647-8f29-d4231748a909", "comment": "Malware payload (SnakeKeylogger)", "value": "2dfe95ecfc00ff1be5930c196baeb2c98821d6fcd7fcbb9144883485a233514febfb27cffa55ec512d0640b0fa74d62e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254143, "uuid": "10e0a8a2-5c6b-4fb5-a106-b05f3ebfd264", "value": "7C05F1257694E912C3AE2536C9CF402847FA9D0237B3DFA5BCC972CE0902766ED169CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254143, "uuid": "56d55d9a-8c7a-44fe-9a02-0155ce701d90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254143, "uuid": "e3b8f0a4-9b39-4f2d-9547-d55ce9a9b63f", "value": "24576:+3PFLUVYtXiZq81hAuPrNkRvJ5xMSyES1PdWZRI/FK:QBUYtXiZq8ACWJ03ES11WZa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623254143, "uuid": "fe4fad78-31b1-4c80-b552-fdf8aecd9a56", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623254143, "uuid": "96287f55-f409-4d06-81ac-a56041bfa2aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254143, "uuid": "b429b1c9-d34b-47ac-9aed-eac421f11731", "value": "invoice 6-8-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b2460af-c929-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623246395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623246395, "uuid": "856fe07c-c4c7-4e71-be89-c55566e46ce7", "comment": "Malware payload (AgentTesla)", "value": "366e54c4e34da6d9f69bfe9f7e5ad1e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623246395, "uuid": "8ff84b5c-287c-4686-83e0-edde33ec8b06", "comment": "Malware payload (AgentTesla)", "value": "84953a98465f15151a773268a00ac8f73ebe39c14631467f6c468f1e1855cc48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623246395, "uuid": "577cc9b3-3bfd-4712-a921-5fee8fb0922b", "comment": "Malware payload (AgentTesla)", "value": "54c5b7617089ddc6eac4b69c6d98b4d9cf2d57c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623246395, "uuid": "158c96e7-8ad7-4f65-b02f-011bb2f601e0", "comment": "Malware payload (AgentTesla)", "value": "211bfe2ce249574a455fa9b7546206df745fc2538e50d1e60fdfc363866df5e6e09f25b862123261ae4f386f02936b94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623246395, "uuid": "b8d826c6-09bb-4b30-8ab4-0070da600add", "value": "7735399D365072DFC867CD76CA681C68EBA074BB830BD243A45316ECAA4D59BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623246395, "uuid": "5a5cf233-b7b7-42da-aa1f-cf4fcb1178b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623246395, "uuid": "313a36f2-e9ba-42f8-b9dd-f1b87fb6e57c", "value": "24576:hQbgpaAILV4dLCUuXZ19Z9SqALXNhOCu:hQLV49Sniq+nOCu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623246395, "uuid": "ef3778d6-3b5d-4819-98e8-3c6fd19bcbaf", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623246395, "uuid": "e0b2cea1-485f-44c4-9a27-b3cbf70f5054", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623246395, "uuid": "245678bc-562e-487a-a55c-53d935fcfc88", "value": "SecuriteInfo.com.Trojan.PackedNET.832.30137.28177", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59a543c-c92f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623249204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623249204, "uuid": "d082dd8f-610a-4c0c-a1bc-0b7cfa77348b", "comment": "Malware payload (SnakeKeylogger)", "value": "fc589ec950a8b2f12b945c1d22138364", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623249204, "uuid": "c9ed344e-360c-40aa-a4ec-220e324f6ad6", "comment": "Malware payload (SnakeKeylogger)", "value": "850699ad07426aa9a49048d23ad5083682ec2527b8bc5af3aee14149623e6529", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623249204, "uuid": "32a573d8-4fc8-4f98-868e-493f44395992", "comment": "Malware payload (SnakeKeylogger)", "value": "5981d1e83fe4a24b056d404146be0e4141ba03dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623249204, "uuid": "04c34dc8-9e39-4ece-8a06-68fe9ae6d7f9", "comment": "Malware payload (SnakeKeylogger)", "value": "5db95ca746a6bfcc44afc48b299da68b098187d501c3fa28f8ebef1903b82612d6b9e968b5a0c6322d95d492173e2289", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623249204, "uuid": "1eaf9f09-78f5-414c-b127-0d94f25b795b", "value": "0A849F64AF931F5BC6DCC2FE00C6D156C9A9FC5DC2B1291A37B2CA9AFE00544ED2C586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623249204, "uuid": "6942ec1d-5a3c-432d-9363-5a7a631199d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623249204, "uuid": "8be20a5e-052c-4304-a9d8-96f49d81fe91", "value": "6144:ZcUP+EqJULEln0pwXyLVVUIfO1sSX7GRFv:iyZlOCSX7GH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623249204, "uuid": "619fc357-ce3f-42b4-afdc-506f76e74c01", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623249204, "uuid": "d97b3abb-e709-49f0-b2fe-a500a2d224cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623249204, "uuid": "350954fd-18bf-47a0-8b10-3024eb26cf9f", "value": "ZAOGYPGC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2702ff-c942-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1623257372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623257372, "uuid": "c5a92ad2-c749-45d5-8d1d-00838715b66d", "comment": "Malware payload (Dridex)", "value": "da72dd70c39eb81557891d08c868dce4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623257372, "uuid": "9b012abe-f535-4257-af30-1ac4a9ddbd28", "comment": "Malware payload (Dridex)", "value": "85179261d96dc79f1f6521f62b75437f522500107184d2bfe060756cbebe2d66", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623257372, "uuid": "097c297d-f330-455a-85f2-880bbb2a8a60", "comment": "Malware payload (Dridex)", "value": "63a60af74be9e3638e392c075c0176ed4cc8be05", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623257372, "uuid": "3de29393-5f9e-4742-9826-3624ddfaeca9", "comment": "Malware payload (Dridex)", "value": "2bab75166440cce8ac32cd9b37da49df95d1aba138d7ae74755fdf6ad0bfec16526c72b680291658a4084849e4d9072e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623257372, "uuid": "1fcdf8ac-5c13-49d3-bd9d-760047beb143", "value": "2804D180F5CF4AD9EAF300367D9AAAB631543E654F25E6C2CF90D689225BCC7343C265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623257372, "uuid": "82deff0a-bf2e-4232-917d-0f157062d959", "value": "24dc00c1ffa2966f43f61678325f2065", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623257372, "uuid": "6cacc607-087d-4f14-b8c7-778d655b37fb", "value": "3072:/oNQK/z2dvUgKrjbeSUAjnERwDkCWptcvcb8qgAE0A2C8FQUVac8SxrKI6bl/g:waIzLgKrjbvUAjERycp6c8qgATA2TQUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623257372, "uuid": "c33c8d16-16e5-47ce-8644-d5d8ced73a4d", "value": 181248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623257372, "uuid": "3b409c58-d6fd-45bf-806a-d5c4db5fac7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623257372, "uuid": "d1483043-ff29-44ac-82a6-818b224e050f", "value": "46113.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "238d0e7d-c96d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623275614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623275614, "uuid": "db4c1334-e301-453e-b762-71b8f912d4bd", "comment": "Malware payload", "value": "3ef777d81dcd56c6f55f96af7cd76702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623275614, "uuid": "01f70bf1-3a1b-411f-9ade-94dda8a223e5", "comment": "Malware payload", "value": "8567b4850ad107df89aa1cbf9bcac681d6769c9898c3608d2fe1e37c9c7c3983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623275614, "uuid": "bb31fa1c-0d2d-451a-a9a1-e00adc5c75ef", "comment": "Malware payload", "value": "b7e5218b5be326527cfde52fe925d8eb299182e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623275614, "uuid": "01d37dd4-c7f1-4ad5-9f10-0dc6ec434dd7", "comment": "Malware payload", "value": "f8ea7de1e0ce6c699b2ad0e85f417544cde1e37a0f6616dbf884fc5e046c417536e934920e940005965c44c68f0765dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623275614, "uuid": "d4290c0c-60ff-45de-8287-7e7a4395581b", "value": "7435FE6422D9D628EFF69F3AC0D0000891F0EC53E55A6A65F5FAB74626B7FC14127B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623275614, "uuid": "1c946c0a-f6ef-4af5-8e15-8b3c28637343", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623275614, "uuid": "b9db4566-00f9-4972-83a7-a3b9b1999977", "value": "12288:fx2+lMV40JsaTpFPhl1WCd8+BUM3lUSJ63Pgl0MJCuKSyimr:fx2+UeUpFJDNm0lU/3P/yFPmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623275614, "uuid": "5ac9fcf1-c539-4eef-9e9c-530fcb236d18", "value": 1145856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623275614, "uuid": "f3e63968-92be-4e75-9b84-dfe8562fc26c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623275614, "uuid": "10de38ab-d74c-4a65-97ca-74e32947587c", "value": "EXRXO0NQ4idRz0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d99751be-c923-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623244137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623244137, "uuid": "dbeac148-1279-4bc7-87c4-e9db789c8592", "comment": "Malware payload (AgentTesla)", "value": "abd57f2823f0378bc4cada284aba5791", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623244137, "uuid": "ad2808fd-bbfc-4e52-baa3-5b7a4a0bd120", "comment": "Malware payload (AgentTesla)", "value": "87a1d13c8add87133d04b2be6fcef322b160bc39a5aadb90750207742b87ba29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623244137, "uuid": "fc589528-33b4-4889-9165-38822ae513c8", "comment": "Malware payload (AgentTesla)", "value": "537da8aac8460db68bc54efd84629751f343a4d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623244137, "uuid": "3b16db4a-72ac-4a03-868b-46ab9fceb9ea", "comment": "Malware payload (AgentTesla)", "value": "3d6677914573f580b7e6fc7c0d205035684282b0cdf9ad9c60dd16992ed765b6628d86d8ca479190ae33fd18fcd2d570", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623244137, "uuid": "cc1f81e3-6f96-492b-ab72-e4c3772641a3", "value": "72F4E02517489F28E17F977AC065011487F5FA03C323DA8DEC99D8DD2E223C6936FA96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623244137, "uuid": "369d6512-492f-47e3-83a1-94554b8ade24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623244137, "uuid": "f7d84892-306a-4dc4-9d9b-d17ff503751e", "value": "12288:tdWmsmlMV40JfolOMSkQbKJhJXEIaFLkDy3ucTEKJgOYMt9PebbgJko:tdWmsmUloTSKJjOFB5Tbghk9mngJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623244137, "uuid": "9ca020f5-16db-4165-b178-efa9fe557f3b", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623244137, "uuid": "876edcf3-d82b-4e10-9e0c-bcd96c4f08ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623244137, "uuid": "e1c162ee-a961-4d05-a026-fcff49988da3", "value": "DHL_INVOICE.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f2043a-c926-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1623245173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623245173, "uuid": "026dec69-1f44-48fc-91fb-e11a60fba302", "comment": "Malware payload (CryptBot)", "value": "9f70f3c99573438e3a904a056f09798f", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623245173, "uuid": "9b60e9ca-7cba-4749-b7ff-6ff6be67bbd0", "comment": "Malware payload (CryptBot)", "value": "88483e5e82b2362be92c707450c3205427359e6c18bf7ae4d723282451af18d5", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623245173, "uuid": "2cc2aa5b-8c91-4af8-9019-9ae8227e0241", "comment": "Malware payload (CryptBot)", "value": "47bcdc19b767d13515af816b08d95fdac24e8521", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623245173, "uuid": "fca8e033-106b-497b-a446-1d1daff8a0ba", "comment": "Malware payload (CryptBot)", "value": "e999171f7214d536914b05f31eba8341118874654cd35c66d36018127e9d2f30e82af175b70854fad2305501635fb807", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623245173, "uuid": "eee4fc55-ddad-4763-94bd-8a4f6d83dc61", "value": "37F4F100B7A1C039F1F316F589768275A53A7AB2AB3895CF12D617EE57B06D0AC31B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623245173, "uuid": "79d7b70d-1fc9-4904-abc8-1f95a0784149", "value": "e0b3de55276aa032e83213daf189c407", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623245173, "uuid": "e41189a1-e703-4ab4-9531-91aa9a7a6d9b", "value": "12288:imN+J0SqfTKMlI5oQe5Z6yAAHrnvvH7K9G96B7rFAiIuW8+6DH2ukkjAlrfiyo7:XcK9Qe22zH7K896Jai7fPHIr6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623245173, "uuid": "44a3c81a-db5c-4f8c-8802-16708bede188", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623245173, "uuid": "9d557c24-856b-4fc8-aa5c-a07a49a14a56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623245173, "uuid": "cc1d8599-8401-4d49-9089-d9e67d40635d", "value": "88483e5e82b2362be92c707450c3205427359e6c18bf7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2128774-c8dd-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623214113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623214113, "uuid": "bd4f0959-1cca-426c-a4b8-d4a3eb1d7c7c", "comment": "Malware payload (AsyncRAT)", "value": "8455b19ec2041cedfef44a49d528e755", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623214113, "uuid": "3c21ba99-db57-414f-83f2-dbf27efc1c3f", "comment": "Malware payload (AsyncRAT)", "value": "895c6f83a0c08bac0fb11367f58725f8a18e64fd991c10a6e569751d6ad4bcc0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623214113, "uuid": "c8a62154-a488-4615-9af1-8bd6e3af0875", "comment": "Malware payload (AsyncRAT)", "value": "f5da335d295fe6be25c088e70e9fcd8af7895e33", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623214113, "uuid": "9c103712-1221-4df4-aaed-61dd3f69c9d9", "comment": "Malware payload (AsyncRAT)", "value": "885d47fc2d0706094ca0f16f9bca124d4851ea49fbd39d6a9d58739c85b5d02de8a508daf4efae787828235c072dda9a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623214113, "uuid": "4b6f0b30-fea9-49f9-90bf-8f3fde527564", "value": "4105E4AC319075DEC467CE768AA82CA4EA6174775B0BD203901705ED9A2CF97DF206F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623214113, "uuid": "920dccbb-fbd7-4fb5-98c7-82f19cb126da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623214113, "uuid": "98061b67-186b-4671-bcb7-3d0e7f6fbda2", "value": "12288:TkEVnsi2J7BX8AJsY90pjcgNze2or6ktu7rKMKxKBgsM23bKy0EgmnEsNIcygONX:TJVsi+8AJs+0ygNi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623214113, "uuid": "6fe42462-5341-447d-8a35-a16371fd9061", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623214113, "uuid": "65b1dd03-c615-4e85-b825-7c424a222ab7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623214113, "uuid": "5a706acd-c838-4336-9b59-b64050065617", "value": "Product Inquiry - 06092021pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa19336-c918-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623239101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239101, "uuid": "225a994e-3157-44e3-940e-beac93121d7b", "comment": "Malware payload (AgentTesla)", "value": "e4f319afbe994cf0ecae04d9ce4b2b32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239101, "uuid": "55474c2e-b02c-4be2-b67e-63cc45673a4a", "comment": "Malware payload (AgentTesla)", "value": "896d95cd5d8e7b9ba123768c126c9f60288adce1a8b2b125ae97beb76270fab0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239101, "uuid": "c18248bd-feb6-41b1-b166-132d7d85a37c", "comment": "Malware payload (AgentTesla)", "value": "f474f5bd2893b74110d7c10b86a08210cd2d5666", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239101, "uuid": "776d8fbc-8303-468c-ba67-978c8f5f323b", "comment": "Malware payload (AgentTesla)", "value": "18bdfa3d648f137a6583d67591f4af13a58139d251ac59e68f9b121023550b84138042fe72f76e7a3efe062454c8a942", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239101, "uuid": "5c57f35b-e9aa-4cd5-864a-f7ef286b0ce1", "value": "5AD4231D3C0C7A979295387DA5C383858E7F1E871E380E1DB54174A1DCBBE6EACC6681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239101, "uuid": "2fe5e5b7-2c55-4531-a77c-2819c6505e28", "value": "12288:tLDxeqQ555Lm0sumHVFGX5qDEVpo0maU3lucR0WX/OlQFY2:t30X555LGOpq24asJX2lQFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623239101, "uuid": "be5aee1f-b960-4ecf-ab2f-17b1ebbabbf9", "value": 610762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623239101, "uuid": "f35f3d78-3e88-437d-b585-45269bd7a5bc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239101, "uuid": "95fcf604-8696-4e96-a901-f49cb338bac0", "value": "ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e590c50f-c93b-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623254465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254465, "uuid": "5c6e3d81-accc-4810-a6f1-ebe29dd1709f", "comment": "Malware payload (Loki)", "value": "8e88075070a9ee1f8e64d1b54d2fe7e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254465, "uuid": "eb5ad0bc-af17-4f18-900a-221410b6b7a7", "comment": "Malware payload (Loki)", "value": "89ba41f3043886684a8571f3f253273aa7e95922fc9ef94a313cca69d7231f7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254465, "uuid": "3cb7b024-ac0c-4434-a7d9-193d32981c36", "comment": "Malware payload (Loki)", "value": "5b0484739852bb21b1beccfe935e28027508aac2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254465, "uuid": "6369f9e8-5470-4487-b6e9-25b068c976af", "comment": "Malware payload (Loki)", "value": "f0bd4b0393cf93cf7d9f71c89b10fbf36eaba63a15fc2a9b976c07a6cd2fb5390c81cd9dfe40a0c3843f5f03d024d666", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254465, "uuid": "c4de343a-fb63-42e6-bea3-a5864cf48508", "value": "5505CF2CAE44EB87F3BC427594A4953C83FFC82B8B65C4552EBB75DC8A76FA83511102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254465, "uuid": "00d621de-5089-453a-8ef5-76fb958657e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254465, "uuid": "b2f733a2-d64a-40c2-a020-d893bfc06ab1", "value": "12288:Nl4WNhFBhRBlMV40UAmAUoUIfrPRWbxvFpQAgBuV9nm6b+ez2mliwnu:3rZBUU7Kb9WdpmkV5ymliwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623254465, "uuid": "00be1db1-7967-4f98-b464-47aba9d2f6eb", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623254465, "uuid": "b4892450-56f4-4f5e-a177-bf7f54007d17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254465, "uuid": "c8dedf7c-5ff5-4b5d-93b2-aadb342b8840", "value": "SWIFT.PDF.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36692805-c91e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623241716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623241716, "uuid": "96ae4b72-50df-40cd-906d-ccae6bc183f3", "comment": "Malware payload", "value": "d6b850c950379d5ee0f254f7164833e8", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PuzzleMaker", "colour": "#CDFDBE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623241716, "uuid": "b590c9cc-d15d-4764-ae3d-9757085f3fa0", "comment": "Malware payload", "value": "8a17279ba26c8fbe6966ea3300fdefb1adae1b3ed68f76a7fc81413bd8c1a5f6", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PuzzleMaker", "colour": "#CDFDBE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623241716, "uuid": "ca7585dd-06eb-4131-ad0d-9897783b45e3", "comment": "Malware payload", "value": "e63ed3b56a5f9a1ea5c92d3d2444196ea13be94b", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PuzzleMaker", "colour": "#CDFDBE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623241716, "uuid": "a33b35f4-b6c7-472d-a7a6-d06725380742", "comment": "Malware payload", "value": "a5197a2c1f1b8807c3f395fc4410ab9b9ea74c26a31bc5e0547c876af16c50f2767ab365ea900b419082b84355ac3cfd", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PuzzleMaker", "colour": "#CDFDBE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623241716, "uuid": "db472e6f-a91a-4b55-a01d-d7f9e044845a", "value": "F0846B5AE6F048B8D96BC278C9B74716E7B2B8481360DAEF23A456651F33FE1463D700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623241716, "uuid": "982124d8-21cf-4afe-9a69-955ea00737de", "value": "2f923546ce2d1cccd41021d8a3848167", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623241716, "uuid": "67585abe-b1b3-4fdc-afe8-08c1dfc75aae", "value": "6144:5DP0nV6wncqWvi1ENuvd9FNyHEpXxRL6uwmVrtMORWD:5j0nV6wncqWa1ENu7FMH2XX6jOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623241716, "uuid": "8130a8bf-d75e-4b7e-a4fa-d7b6aa84d6f6", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623241716, "uuid": "41144627-749e-4362-8e4d-102d095f0dc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623241716, "uuid": "e12c2531-4ae7-40d0-96e5-6e336d1c729f", "value": "wmimon.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a435ba-c919-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623239748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239748, "uuid": "489ebbf5-d830-4ab5-b7b9-76dd66873d7c", "comment": "Malware payload (Formbook)", "value": "c1015458a6e0a8bee776c5be93b957ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239748, "uuid": "4a138a42-5dcc-45e9-8e12-d6408a882bd4", "comment": "Malware payload (Formbook)", "value": "8bcf318923a790cd2ea149ff65839db2099b15baa3e2d6a1ad24ecd025f4d4cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239748, "uuid": "01025daa-8d19-4dc5-8363-df8d01725067", "comment": "Malware payload (Formbook)", "value": "3ec4316cdda32611c7b72f856f174a8e91d24a1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239748, "uuid": "7717b0d0-e7dc-41e1-a67a-7bf3224e55b3", "comment": "Malware payload (Formbook)", "value": "fbcec2fd2715b6e29e7c6f562725ff236c443b113cccff1493e7432a7fc3123c7fa2f3d17bcd54f495d54e8db977d0df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239748, "uuid": "6e727e4c-9ec1-4cf7-a9f4-437323440f29", "value": "503413472BE1DABBD8A343769D75672AF7FDABE248DB01024F481F5F68610C28513283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239748, "uuid": "c0e8ffe2-1360-4e94-a5d2-32c9daef043e", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239748, "uuid": "82a577be-2f04-4571-94f0-3e75d8a51862", "value": "6144:JPB6W7TrWG73Al/P87hOtLZPqjRSsqrg+mqkUL2s2Kff:F57PWW3oMUtFPqjQsqr2xef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623239748, "uuid": "f5c583de-c30a-4d35-81bd-26c401dc87a3", "value": 238889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623239748, "uuid": "88d88c8a-615d-4734-890c-6aa30ca8d600", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239748, "uuid": "0295ec8f-92b1-42a0-b496-7d87e9253bc2", "value": "\u00a0Import Custom Duty invoice & its clearance documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0ea10b-c92b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623247388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623247388, "uuid": "2bd19075-a12c-4d2c-98e5-e457a79f6479", "comment": "Malware payload", "value": "bedb8a90ae824d2c579bb5cccac6da63", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623247388, "uuid": "41c8a012-0324-46bb-b9d1-0fd1bfb7f5b0", "comment": "Malware payload", "value": "8cb6d0ac34d090ebf86cc3b0fb51dc57b89b2429627dd15170b29ee29d02ad08", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623247388, "uuid": "156661be-d02a-4ade-9de1-811112096532", "comment": "Malware payload", "value": "9b6b1be7a02d139fd518b28523678bb4752c17cd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623247388, "uuid": "ad701be1-7231-4cd7-9896-407dcd51dca0", "comment": "Malware payload", "value": "a251ae308e64504d32752594c3d85a94300b39d65b87635f3d361e5f785a464f6326748b3f8fc62f86b0af9853dd4f35", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623247388, "uuid": "8e83c71a-24b6-48f3-98ac-3979591a844f", "value": "24659E2076D6C036C4BE05703A6ED76B157E7E700BB188EB63D81A2E1EB15C25632F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623247388, "uuid": "d710d38e-8daf-4642-8733-be97f57b4463", "value": "24576:XB16NC63vosTi0cNOAqJAkMpYkXztdfG8NQGa2A+Ivn9pBo5MTGq5YVJrTsgsFHS:R1JCvosTi0sOAZnWkDfNQGRA+Iv/Boak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623247388, "uuid": "15c49132-23bf-4062-b611-5ebb4d584013", "value": 1429504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623247388, "uuid": "bc9fe080-d9ff-4749-8ca9-e493c3c6c7ec", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623247388, "uuid": "5b708581-eee0-4f31-9fa4-ce4e9895c6ee", "value": "Nota Fiscal Eletronica 00111834.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f22a5a1-c8d5-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1623210511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623210511, "uuid": "06f8b465-85e7-47ad-8305-5fb09f2e04ef", "comment": "Malware payload (njrat)", "value": "593095a3ccc60efd1c671f02faae1c5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623210511, "uuid": "b8ba6cc2-8be4-479c-b29d-b8d413dd8eba", "comment": "Malware payload (njrat)", "value": "8d321787a86e3f17808ab77a4b1a19cb006b3913679fd88d948555116b368e97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623210511, "uuid": "5ea6b4ab-0057-498f-acae-4b0b9b806b4c", "comment": "Malware payload (njrat)", "value": "a8b2cd8c3a79f1231ebfebe79668b03315c8780a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623210511, "uuid": "e3ef00ba-3fa0-478a-a528-7559f4368b74", "comment": "Malware payload (njrat)", "value": "0d1153223b750a55b79e10ba49bd1e8a7930f287ccd5f37888a97c622be639d0b5bf85b26fe13b70f6e18b52cf60dc1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623210511, "uuid": "1b012b38-25c7-4346-92a5-e73fcd6eb6e1", "value": "4C637C56BF8BDE27C50E037B81B29179403695132A52F7B7B8ED2FD289327DC0282597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623210511, "uuid": "c088a1c2-0bdc-4c57-a2fa-d66aa23f4ec0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623210511, "uuid": "34a870ae-4ba9-4fbd-97e4-34ec93cc8e5b", "value": "1536:atd5UMo6L2HFiMBkqBNPeudnrWuoN1XBoaGdKL:atdbo6L2HBBkqj2uEuoRgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623210511, "uuid": "568d4171-8e22-4034-85eb-863d75041796", "value": 70656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623210511, "uuid": "055b3564-404a-4b9d-b0a2-43787b0d4c09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623210511, "uuid": "abb9912f-78a4-46b6-b7cb-2e9a28e6169b", "value": "8D321787A86E3F17808AB77A4B1A19CB006B3913679FD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9292ab86-c95f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623269788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623269788, "uuid": "ced5feb1-c76a-42c8-ad3f-151e5bea6579", "comment": "Malware payload (RedLineStealer)", "value": "bfbac8b214706deaacdca4340102de04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623269788, "uuid": "2025908c-7473-48c6-83aa-ba965f7990fc", "comment": "Malware payload (RedLineStealer)", "value": "8f76ea98651e914e808bde9f0e491a4252bc218c5ef40f800cceefdccac002c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623269788, "uuid": "abbccf91-5f1e-4457-a1b4-1d8cb649a7f8", "comment": "Malware payload (RedLineStealer)", "value": "d8f30f7fe05c7417a61ae015840e3c47eb2f8b32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623269788, "uuid": "1e670c07-4c8b-4bad-8598-1f83c3bd0032", "comment": "Malware payload (RedLineStealer)", "value": "abfc67cd57be3859a5381220d13e7bdc812f01d3b21d27499346042a730c731758cbbf44d01ed8738e6f0de9737e6870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623269788, "uuid": "f2dd8d11-0933-4007-b55d-44f551b0f88c", "value": "92167C26B281653EC4DB3A35476FE674473BBB6129128E1B17F84C4EBF31583392A247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623269788, "uuid": "fb7c80a3-84f9-4dcf-8b33-651056337e28", "value": "7e40e6bd001f395b44e832c22386c61b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623269788, "uuid": "16c44e1d-6c01-42b7-884b-522187ca1979", "value": "49152:Rx/JrgCWB6P3Uf8S5WemJ5jNz/5i64Tdi:RxRrp3E4Lz/5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623269788, "uuid": "384e8e8e-ca9e-4f29-8741-e1434fa58433", "value": 4194304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623269788, "uuid": "ca225132-74d1-485d-a337-2529f9fdafca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623269788, "uuid": "15e4254a-bee3-4b3e-aec7-18d63b5b3774", "value": "BFBAC8B214706DEAACDCA4340102DE04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64debaa8-c8ed-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623220749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623220749, "uuid": "be5cc153-c16b-408a-be03-7d71e0728588", "comment": "Malware payload (NanoCore)", "value": "61de33a77d34a313df07dc2bdd28140a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623220749, "uuid": "aa681518-1c8b-4b8e-a33e-ce68c2ce53eb", "comment": "Malware payload (NanoCore)", "value": "9037afbf6a54684a77a6d0b204daa0a843555e01a9bd600545d8ae252b88fad7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623220749, "uuid": "e4ed6219-e603-4f8f-bf11-8dbbf5124235", "comment": "Malware payload (NanoCore)", "value": "2690f84adb2c6174aab432a61737ca892af2d206", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623220749, "uuid": "201198d5-6f6c-4489-b8f2-81a14156d072", "comment": "Malware payload (NanoCore)", "value": "0ffc628d17e60543919fb57a4264faf0916125bd9141e2548267074d2cf36ca68f0e6e041b721a01dd9f7541911441c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623220749, "uuid": "51a6e8b3-9808-4d13-9a46-a6e52d0c86d4", "value": "28F4DF6575F9AFA2D135C7F5165011818FFAA72AB8DEF2080CCAE0DEA570F418D80E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623220749, "uuid": "51dff44a-4640-4e4f-ae34-8ddf03a25121", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623220749, "uuid": "7a5108e9-0b3f-4c79-9e31-3c2831ed9f70", "value": "6144:x2j8F5ve0At+vWlrOXMRzyeYlDW6PzaIm8MI8x39qflzAQnT6kygum2OMidd8P99:sj8FU9qXKueqZPeLhI8N0MQn5zdd8ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623220749, "uuid": "2e764253-6127-4130-b5e7-b978e827a6ef", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623220749, "uuid": "67a30e7a-e7b7-454f-a164-1b0d5dfe3e10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623220749, "uuid": "9a073337-9a69-4f18-98be-345e77865562", "value": "61de33a77d34a313df07dc2bdd28140a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44056452-c920-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623242598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623242598, "uuid": "e7e6910f-7154-4b75-91dc-7bc1adbbba22", "comment": "Malware payload (Loki)", "value": "4aea2a0f7a66d26b7a790d176ca48a32", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623242598, "uuid": "89b49545-7e0a-482a-a513-80222a531e9a", "comment": "Malware payload (Loki)", "value": "90fae7829904a5b7ee85cd953124bac939546445e5397cc33e36c0978eaf6923", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623242598, "uuid": "9dda14b4-c011-4878-871f-5c842ac2e202", "comment": "Malware payload (Loki)", "value": "324fd308c5a0ac9888c49c032f03574ae2ef2fe2", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623242598, "uuid": "89952fe7-ea7f-4043-ae4d-551c51fc2074", "comment": "Malware payload (Loki)", "value": "c4cd083e4873fe138c36f2fb77f14024c4bc57dc118a5a5fb3f1b27b8845a96c382a73fcb3462d451f6c404afe4c3679", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623242598, "uuid": "629126c3-ef38-45f5-836a-2eee752a4aea", "value": "DBB423AB0C2F9D2AE85C98704CDC2D72E1ADA180644C94936DB0C9E75F7E3893FE9645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623242598, "uuid": "38bb5dca-b9be-4bfe-b292-73fa15b8a0e9", "value": "12288:IRsDsoo9AoaS+SBiy3A/H8iSMeDvmWxGcW7xy:WsU9AoaSZBiyiHmxDeWxFWty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623242598, "uuid": "05141b0a-da60-48e1-86fd-6ffd163256b8", "value": 497063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623242598, "uuid": "ac519cad-b663-4f67-ba07-fef899ba4437", "value": "application/x-lzh-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623242598, "uuid": "b55f98f3-cee5-46da-af5c-14797dd57806", "value": "PO_210513-LG01.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9473ff5b-c91b-11eb-875b-42010a9c0053", "comment": "Malware payload (STRRAT)", "timestamp": 1623240585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240585, "uuid": "9cb6bfbc-9c81-4529-a8f0-c53281afbea9", "comment": "Malware payload (STRRAT)", "value": "eea14a16697f39254b109e80476df4ce", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240585, "uuid": "7b1d15fb-7889-4890-825e-2aa4231ff3b1", "comment": "Malware payload (STRRAT)", "value": "91450c079b924cdbe85c774ac414ee8824cb4182764c51c11c7f0a6fcf11b800", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240585, "uuid": "f139e22a-7280-4d3b-ae42-b08c36db597a", "comment": "Malware payload (STRRAT)", "value": "b165b2f689c77bdd872aff204a2549a144ea2671", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240585, "uuid": "649d8872-88ef-414e-8e32-3a6f6ae22d23", "comment": "Malware payload (STRRAT)", "value": "a0f0ce5b6dd2e870b95cbebe4ac800ce18938c5fa9566fd5a838155fd4a562b903d3eb1fdb92db6921dde1111f30ab5b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240585, "uuid": "232342a4-56cd-483c-96ec-9eff0f84114c", "value": "BB93CE1BBDDAA5A6C00755333946823AAE0D7698DE1EE80F69FC47851C74C6C4B07E8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240585, "uuid": "3cb119c5-6b21-4c36-a0f0-2ae8e9b18de2", "value": "1536:yQNjoSgSLJjjI+hWd7GVb1uWVFXUymCUt8meAs5uPruO8hNsgVJ:y4TxDPXfmCUKGFuO8hNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623240585, "uuid": "8f089fe0-0b59-4c4e-9870-ab3795468d61", "value": 90608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623240585, "uuid": "55a3d366-4ff4-44d4-80f1-fd719cbd643b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240585, "uuid": "61716dc3-cb51-42e9-899f-d6dbb3379e36", "value": "customers copy.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba02edf7-c8ee-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623221321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221321, "uuid": "0b9dc8fe-82f2-4d5f-afe5-eb592a170088", "comment": "Malware payload (AgentTesla)", "value": "93a2cc94d062ace0fb1225f6f1b6540e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221321, "uuid": "cf67176f-905d-4a8f-8ee2-7000449f8548", "comment": "Malware payload (AgentTesla)", "value": "925014ae4a425d2c1cef1c4ba45eff87d388924209c4194339d9770491d9fcae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221321, "uuid": "cd77db8c-b595-4e04-91a5-b37855873c4f", "comment": "Malware payload (AgentTesla)", "value": "2f3b4985f975deeee3bfd84d6cbfbb0d3cb4f00c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221321, "uuid": "d5e38b88-22d4-4fde-bbe9-82c944f9aae0", "comment": "Malware payload (AgentTesla)", "value": "5db559355cdc3e6dc4d88ca4bb78f0977cd73d344881fd12cf6b084336c07063701b47d011e85f6a14a857c8f1a63c9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221321, "uuid": "47784292-683e-4457-a085-047e9f5d46b2", "value": "3E2506AC31A075DEC467CE768AA82CA4EA6174775B0BD203901705ED9A2CF97DF106F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221321, "uuid": "51d2e7c9-e389-43ea-a6c9-3cce7e279383", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221321, "uuid": "e84eaf63-e9d0-42df-9742-b01deaf4816c", "value": "12288:4UExjPYRd5JEOs38WDt0+eH2gcC5s9zMNvsmzny004N9W3wVxeFOxc1hwsMS5gG5:GxTYzrRsMWp0pWgLKmzny0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623221321, "uuid": "bf940f93-b946-477a-80d6-50ab10096ddc", "value": 982016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623221321, "uuid": "4fc71017-b6c9-4eba-b142-86003110fa07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221321, "uuid": "2f0116e1-c56e-438e-aefc-f19e8f61f425", "value": "93a2cc94d062ace0fb1225f6f1b6540e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d3e97e-c8e7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623218123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218123, "uuid": "fbbc179a-ae1e-4705-b39a-6257a9a3c4b5", "comment": "Malware payload (AgentTesla)", "value": "1863074c9f92832958a1b9252ba5adaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218123, "uuid": "f0bcfd17-d25f-4595-aa76-3935b6ff95d0", "comment": "Malware payload (AgentTesla)", "value": "92a8eaace426530cbb98518c69d0430cd7b8e8ac9d0b9f77f7d805b58d15432e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218123, "uuid": "5229f5f3-21b0-4092-bf06-2f96c0a26892", "comment": "Malware payload (AgentTesla)", "value": "a55a9ea6605ec8a4db4bc486b1d1d898f3e96a34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218123, "uuid": "e5f13a66-dfd0-4b58-96d5-89fb6bc72b7e", "comment": "Malware payload (AgentTesla)", "value": "4838a8d944b3ce1cdff0a575b7ce309eaa562ca9a17ee498c6aa1d2b6ffe4e743060c1fd3749051c9f1c61f4e64988b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218123, "uuid": "46ea3e79-9430-4c5c-8f60-1d1674c644c5", "value": "6325F6AC319075DEC467CD768AA82CA4EA6174766B0FD203901705ED9A2CF97DF206F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218123, "uuid": "751ba410-8878-4fc7-9643-7bdfb0ff70b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218123, "uuid": "2c6254d7-d7b6-44db-be04-9de6fe6654b9", "value": "12288:bP44f6L/8LVgIDKVnjKcZSQT/buil1SkQAIwnDLsnlxMtKVbTiYnnDDcfzpqjDDQ:b2L/8L2IDK4cZn/6ijSgIJEtKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218123, "uuid": "f0670915-d917-4e7e-8fac-9b2f0f1ca3ec", "value": 997376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218123, "uuid": "9c6949e6-7544-41cc-b8e4-d973423f86b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218123, "uuid": "58c3370f-d54a-4ac5-ac13-bc497e2fe0f6", "value": "1863074c9f92832958a1b9252ba5adaf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c399e2-c8e7-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1623218225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218225, "uuid": "33fc0fef-2012-48f9-abc1-c47d270f83a9", "comment": "Malware payload (ArkeiStealer)", "value": "8ff0c7a773e43b074e955c2fc0d240c1", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218225, "uuid": "371a13bc-e9cb-46c4-a3e0-fc4501263ea5", "comment": "Malware payload (ArkeiStealer)", "value": "94278b567995f430d6b0df8293a3677cb71cd20ff18f47c747d255ff156d23e8", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218225, "uuid": "49744a50-4915-45e2-ae36-8e1543a2ae65", "comment": "Malware payload (ArkeiStealer)", "value": "b3983d459025b3614f9d796b088368f486202d1c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218225, "uuid": "cdb16836-3282-4328-87c3-4e2afcb9c8ee", "comment": "Malware payload (ArkeiStealer)", "value": "74e2dda2707f80c2dc10af7689a03bd41c26a6555222bfce3d88dd62dae119c2b2f240fa3eb1560040ffbda5a6346a6b", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218225, "uuid": "8c3ec7f3-274b-4c08-b941-ce87f53eaeb6", "value": "A8050100ABE0C035F5F71AB45AB98369953A7AA26734D0CF62D966EE1734BD0EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218225, "uuid": "4b5b2a2e-4cde-46c3-ab06-666bd5749203", "value": "c80a947a474c831077263a43b05ed845", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218225, "uuid": "01729b39-5cfd-40a1-80cd-7cf324c8c64f", "value": "12288:apogMkuwl3XzvCqfFqXcE44/rUJGhjIh5JJdtOEdoqiy8s1XHVFvMPtyB:IBagvfYcnYql5JJdtdq/cfvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218225, "uuid": "204cb812-c2f1-4345-a134-f2317063ae0d", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218225, "uuid": "bb03404d-6253-4c4b-85e2-172d9751be21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218225, "uuid": "1188a60e-1fcc-4486-9788-efd92653ce87", "value": "8ff0c7a773e43b074e955c2fc0d240c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101bdb35-c91f-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1623242081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623242081, "uuid": "6cfdc7ad-298e-4c91-9878-78e37e2db97f", "comment": "Malware payload (njrat)", "value": "ba229c713c2c1a120abe0958bf8fa625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623242081, "uuid": "0c6ba775-20d2-430b-8bd8-c80323f8443d", "comment": "Malware payload (njrat)", "value": "953dd19700177beaf848e510418db83c8481ce466819c7052be8d93974ce3191", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623242081, "uuid": "2cc91e1e-fdb3-4c84-ba18-e35dc612f5ec", "comment": "Malware payload (njrat)", "value": "a85418cc33dc3810074728e5d0c1bd27ce298981", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623242081, "uuid": "2ca57a3f-c2f1-4bf1-a5cf-f8aa5f7ad4fe", "comment": "Malware payload (njrat)", "value": "5e56d3f7e592c7a0d9a988c6ce59427d35ce5f87a90c5e4b86a082ece2d69731f2e3172a1243b9622388db396e4b00ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623242081, "uuid": "3f0b1143-9de0-4ca2-bc10-86ef31975a1d", "value": "9C353355FBA72849CEDDA77BCF0D8810D0CF261DC7D9980A2B532BA95302057DA9BC78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623242081, "uuid": "b39c04d8-57f9-47c8-b151-c306d372e649", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623242081, "uuid": "93856c02-d2e0-4c67-a569-5388f605dd2e", "value": "24576:pw0w7pjUdaC5UmqG4df/362G0SW09PQu5PilAbbdNx5iSCTJJAm5f1:pw0y45I9G0SH5p5PnXYAm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623242081, "uuid": "12f7d8e6-4318-4f20-9aeb-cc822666bb32", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623242081, "uuid": "379b36fd-3fa6-43a9-8e6a-24b65f52eb46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623242081, "uuid": "617b84fc-3db8-4866-a061-983b72277a17", "value": "953DD19700177BEAF848E510418DB83C8481CE466819C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0f6937-c8e6-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623217994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217994, "uuid": "535c5178-ac53-463d-909b-29b1bb79420d", "comment": "Malware payload (Loki)", "value": "1789a025243ef7ae00c62c9713e6037c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217994, "uuid": "8aea3d55-079d-422d-a12f-16cc5ec357d4", "comment": "Malware payload (Loki)", "value": "95fa71402c83b8f8b69f5c4452a527051062b60cd48d9ac5addaa39dfbf65199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217994, "uuid": "1904fe53-2c02-400a-91f4-63763eab52df", "comment": "Malware payload (Loki)", "value": "e64947d09563ed52953607efebb99448688d2a61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217994, "uuid": "78b779fe-bbdf-44f8-9f79-0313862525b4", "comment": "Malware payload (Loki)", "value": "87790d33f46a2ec8b05c88afe9670923a9ac70b2e4328939954974a0b9d9e4685b54ccc4a56bae1dfefdbfaa56fb86fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217994, "uuid": "70d0fc8f-0d6f-4d15-a4b6-f7142d4de3fe", "value": "3B041237D9C2CDBBD56B053206B347BEEB7BE30B4155160B5790AFDF7A61202CA08286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217994, "uuid": "6aedad2b-6d51-48f1-9b23-4ff7f9dc52ab", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217994, "uuid": "5ba4f02a-b240-476e-9fa6-73b05b4b1775", "value": "3072:JS8BCfoDaXJnMzVRZYioXoNXYSQAVLJ9d8KadjOgt6zbwS0BRar18d8PrDQwFKCX:JPB6WZTpNXYSQiLJ/8KadN06Rk+OPHP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217994, "uuid": "537744b4-efdc-4e6e-b7f5-87a0a90d11a0", "value": 181282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217994, "uuid": "e1055981-764b-4212-bd05-af3749d9738d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217994, "uuid": "0b7f81c7-cabf-4ce5-9ecf-43fb0188098e", "value": "DEMANDE DE DEVIS 09-06-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7444d0ca-c92d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623248262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248262, "uuid": "62feca19-8d45-40d8-99d8-da9763d493cb", "comment": "Malware payload", "value": "01c793c4d7bfbd8adf279f0b5ceb2445", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248262, "uuid": "6c7972b4-afee-435e-a163-f0a28ba87bde", "comment": "Malware payload", "value": "975cd8e2eb0ded6996c8fc026b29bed2a937407db6d0e9fc2147f8f41f55ceb4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248262, "uuid": "9642bd73-e198-4a06-9a3f-a7ad1dfa9a25", "comment": "Malware payload", "value": "0b8735b3f53705e96e4f675a92e3b87f4846ad23", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248262, "uuid": "ee8a3cad-86db-4f41-829d-2ddcd8cfd0b4", "comment": "Malware payload", "value": "8164fa7947ab33b1b39c7e81f94a628372ec584af591806366e1e8cbfe596e177c118e763ba4a3a1c5098797ba28e570", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248262, "uuid": "d6c4a1b9-13cc-430c-b355-59f1e0317ac9", "value": "75D52303B2C74B36C49356702BDB936546B6EC784B62802F235EB21E2DB3554B7A73E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248262, "uuid": "07e4fc16-8ae7-4f1a-ba9e-fcf4bc05401b", "value": "49152:E4JuI3MlBMGrnwNuNFeze9wzSAVli/J34Dox1Wgi8bWY5A3:P3Ml5wN6FezeCzSAXix34DoTi8bWY5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623248262, "uuid": "3019aa09-6a7e-457e-886b-25b089490bd0", "value": 2833408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623248262, "uuid": "2496a8fd-4059-4dd6-b8b0-b8d41f0d0560", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248262, "uuid": "c4efd81d-4eed-4ecd-94e2-3ef9aea29439", "value": "MsWordd.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b203f89-c8e7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623218236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218236, "uuid": "16199845-5ebc-4932-a10b-d990079c5187", "comment": "Malware payload (AgentTesla)", "value": "562fa3094479fa6fd79ecd755f56ffa9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218236, "uuid": "0f73be0d-4c76-42c9-8601-c8cc45f3317e", "comment": "Malware payload (AgentTesla)", "value": "97b04e5a3a6a7c803bacf16e1b423a61c48377dd362258127b613a68d75eb342", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218236, "uuid": "18349df9-ab61-4fb4-a791-1b378b6570b2", "comment": "Malware payload (AgentTesla)", "value": "35e3189d167e4c351d50ed716948dc02f3295f17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218236, "uuid": "eecb564d-05f5-48fc-911e-2d731a873631", "comment": "Malware payload (AgentTesla)", "value": "4330b57e3b0e051349740ec74e720fac7ee126baf712397e224a227b7fd10f6b6af7c6d5ba448f786ee0fb27d24a1483", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218236, "uuid": "392c0496-131a-4eed-b76a-5c3838a8af84", "value": "63F4EF3523888A55E57F5335A0A2550443F0FC07E362EA4DFEA874D91EB23C2A76FA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218236, "uuid": "d6411a58-bf73-4c50-afca-708af43d1021", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218236, "uuid": "47f86fee-f0be-4fe8-8b7b-44890e585130", "value": "12288:jWXc15tRPvHIVN7Hv0OmEo1lMV40JYd2+cs10k35bhE5pIz6C6sHl3v9WS:j0VN7HvxmEo1U2d2O31Ye6gl3v9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218236, "uuid": "bbeccfc8-d876-43e1-9795-05450e8e4dec", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218236, "uuid": "3050f7c4-2ff8-41e8-8362-e1f98343b293", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218236, "uuid": "5d80dc79-f2f4-4ff5-921f-39d49946e289", "value": "562fa3094479fa6fd79ecd755f56ffa9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248643de-c91e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623241686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623241686, "uuid": "2a3d5d67-ff87-48aa-9e74-08361fd18558", "comment": "Malware payload", "value": "09a5055db44fc1c9e3add608efff038c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PuzzleMaker", "colour": "#CDFDBE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623241686, "uuid": "5efd2d34-bd1d-4806-9523-6e7df91b39c1", "comment": "Malware payload", "value": "982f7c4700c75b81833d5d59ad29147c392b20c760fe36b200b541a0f841c8a9", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PuzzleMaker", "colour": "#CDFDBE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623241686, "uuid": "397f0da3-e52f-4e74-9668-0e8be4e0fcde", "comment": "Malware payload", "value": "bffa4462901b74dbfbffaa3a3db27daa61211412", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PuzzleMaker", "colour": "#CDFDBE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623241686, "uuid": "13475ef3-665e-4b0b-8162-47a16d312f2a", "comment": "Malware payload", "value": "cf6ed5f5fc894f65c279846948f234e6e8d29cdbdce83f6cca22f637c903ee3fddbeccdd0c703d00760415b2f6508bc0", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PuzzleMaker", "colour": "#CDFDBE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623241686, "uuid": "b60dfa22-7484-42aa-ab06-ed25afdcb3e4", "value": "C4E36C5B73A530FCE17A8235C8A12606F777B87117619B6F0768026A2F237909D3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623241686, "uuid": "b2eff160-dd96-4fc2-956c-6aa8b2a5f1ff", "value": "5ac9fa75bb39d618a49bffac337f096a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623241686, "uuid": "9074dff8-6e64-4b86-a596-fee8e5a69498", "value": "3072:/LTiyzWdI/8CfsmYtI3RhDLWrNmBvFGc/+u:/LT0LCE/mBsrz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623241686, "uuid": "77e80ad1-b1ea-49ff-bbab-6fc7454fd490", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623241686, "uuid": "93ad1331-6f7f-416d-9db7-6cd226db47b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623241686, "uuid": "3f219779-2a46-4619-b560-97c0f4c6813e", "value": "WmiPrvMon.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7b8dcd-c969-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623273942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623273942, "uuid": "b7e198c5-f469-458c-a0a4-15ce2994cf6d", "comment": "Malware payload", "value": "690cc36d31247b140e0265f24028bd6b", "object_relation": "md5", "Tag": [ { "name": "other", "colour": "#452133", "exportable": true, "hide_tag": false }, { "name": "tag1", "colour": "#C526B8", "exportable": true, "hide_tag": false }, { "name": "tag2", "colour": "#6401F7", "exportable": true, "hide_tag": false }, { "name": "tag3", "colour": "#B2ECFA", "exportable": true, "hide_tag": false }, { "name": "tag4", "colour": "#884843", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623273942, "uuid": "32c8b838-0f3c-4ea8-8e8d-ff27e63d699b", "comment": "Malware payload", "value": "99d8929524fbbe2784fb3090477a7b59966f15590b59925f7f7ce6be11d5404b", "object_relation": "sha256", "Tag": [ { "name": "other", "colour": "#452133", "exportable": true, "hide_tag": false }, { "name": "tag1", "colour": "#C526B8", "exportable": true, "hide_tag": false }, { "name": "tag2", "colour": "#6401F7", "exportable": true, "hide_tag": false }, { "name": "tag3", "colour": "#B2ECFA", "exportable": true, "hide_tag": false }, { "name": "tag4", "colour": "#884843", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623273942, "uuid": "096698b9-b4ac-4ca2-946a-78d7865c3ed7", "comment": "Malware payload", "value": "c8fd06819a44f3623badfffd9ac19bb5c2603dc0", "object_relation": "sha1", "Tag": [ { "name": "other", "colour": "#452133", "exportable": true, "hide_tag": false }, { "name": "tag1", "colour": "#C526B8", "exportable": true, "hide_tag": false }, { "name": "tag2", "colour": "#6401F7", "exportable": true, "hide_tag": false }, { "name": "tag3", "colour": "#B2ECFA", "exportable": true, "hide_tag": false }, { "name": "tag4", "colour": "#884843", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623273942, "uuid": "15b76a54-f43c-43f6-8dbd-e6d6e1329fef", "comment": "Malware payload", "value": "169345dd8df1aac5293a9b1b6b59c3bcf97214c37d53e55766a01ad58cb7d5dbb46fc0e2ce5d1eb364f285251a0a38f3", "object_relation": "sha3-384", "Tag": [ { "name": "other", "colour": "#452133", "exportable": true, "hide_tag": false }, { "name": "tag1", "colour": "#C526B8", "exportable": true, "hide_tag": false }, { "name": "tag2", "colour": "#6401F7", "exportable": true, "hide_tag": false }, { "name": "tag3", "colour": "#B2ECFA", "exportable": true, "hide_tag": false }, { "name": "tag4", "colour": "#884843", "exportable": true, "hide_tag": false } ] }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623273942, "uuid": "11f4dabf-cbf2-4ef7-8b84-dcbf4437e850", "value": "3:XA+Ruw3A0kqHGAFyo:Qu58KGgr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623273942, "uuid": "9d7e6b8b-5b75-4668-bfeb-1632f0983300", "value": 44, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623273942, "uuid": "780c12ef-fef4-4c92-a905-1190f7234161", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623273942, "uuid": "08d21e57-f4f8-40f0-ab72-2545c0f99325", "value": "test_file.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9467ff-c923-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623243924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243924, "uuid": "8e2c28c9-2536-4c0f-8b33-506786bbdd82", "comment": "Malware payload (AgentTesla)", "value": "8dd26cd2953399ee89526dd3b13f2e37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243924, "uuid": "2355d87e-5f70-4aa7-a74d-b5256279672d", "comment": "Malware payload (AgentTesla)", "value": "9c2582376fbfe87d35b10d515bc3f9668b545b461317035fef4fbde46926617a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243924, "uuid": "70b3cbeb-704a-433a-bc6f-3a26bd8b6728", "comment": "Malware payload (AgentTesla)", "value": "d228498c396b55ea421d0699cc5777676d231a30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243924, "uuid": "4f3eebcf-9e36-4051-ab34-e362125c52e9", "comment": "Malware payload (AgentTesla)", "value": "892d2ed15d961f6103b026e6d97684b8cfebc5644c9ea42cbd7584ea406eeca37d1c90a5f563550b276675c3a3fddb56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243924, "uuid": "6137119a-4fb1-474f-95c1-8065809e6402", "value": "D654129479C70DDFFAC3857029F5178DEBBEE79814278F174BAC4F9A3A120420A116B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243924, "uuid": "9f732efd-a0c3-4cd8-b964-0a3c6a0cb9e0", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243924, "uuid": "b4023bc7-0a79-4d33-937a-905d5447971a", "value": "6144:JPB6A3DzLHiHi2hWgG8h0DcRGOfHtdVlyppinRvK1kPPh7zcUKpLr9UaMcm:FDTzLC1YnD0vX/qiR3J3Qrmcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623243924, "uuid": "a1b4b801-bf9b-471d-ac2a-2dd944df0c87", "value": 295329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623243924, "uuid": "df21d7ba-47cc-46a3-8b56-3680b2f97a78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243924, "uuid": "ba5e3b7d-4981-414b-a35e-1d8afa137a47", "value": "PO 18-3081.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b41063d-c906-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623231497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623231497, "uuid": "8ee0a53f-3a5e-4286-a260-b621d84fd4ec", "comment": "Malware payload (Loki)", "value": "56c02792785ff8854c691d1e874376c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623231497, "uuid": "f4a849e6-6bf9-4ac0-a428-c99c7abc67bb", "comment": "Malware payload (Loki)", "value": "9c6820c272c99c423cdeec4f7ec725d82725dfa4df3174fbf0097551e0de5c53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623231497, "uuid": "8d21bf46-5bf8-4732-b726-543b3277a90b", "comment": "Malware payload (Loki)", "value": "ec4c962959582152193ec5dcebb7d73a25e13e26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623231497, "uuid": "d3a1249f-f841-4c5c-9d5e-299a05b7a92f", "comment": "Malware payload (Loki)", "value": "bbf489628b15b3efa953cbd01f90e349c51e2b4a4339f7240160cdb768fe128384c651c1df06463c36a46f8acdf487ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623231497, "uuid": "15751755-e967-4943-bf10-0799ac920b22", "value": "DE0412153BD1E777F586C2F10A32F739EBB7C612495246179BA06FAF3C101938E18A62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623231497, "uuid": "34b559e9-738d-4ea0-859e-3ebb6198040d", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623231497, "uuid": "49822a5a-a6fe-458a-931e-9261ac00895a", "value": "3072:JS8BCfoDaXJLM4luu+rAEaUymeiZovk3Rr+U/p41j8OwcuVG4NINRreWC16V8lt4:JPB6ybrAEaUyjiS831Ppn93MreWC16VZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623231497, "uuid": "00686280-dd74-48b4-b94d-5e2d20a80ab7", "value": 180977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623231497, "uuid": "0bdbd017-eb21-445b-863d-33bf3ffa222f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623231497, "uuid": "280f42c6-a5c2-4d89-9d61-ad01151399a2", "value": "REQUEST FOR OFFER 09-06-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d8993e-c95b-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623267986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623267986, "uuid": "fd8a4c4b-21bb-4147-86bc-f9f6337a549b", "comment": "Malware payload (AsyncRAT)", "value": "998b270527d87bfd4553043e1755c7de", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623267986, "uuid": "f524f48f-9000-4f90-aa0d-51ab465db1d6", "comment": "Malware payload (AsyncRAT)", "value": "9c68b6653a635642cb8a9579dcdf8b0f7eb7c84fba5605894eca91eaa093886e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623267986, "uuid": "784a551c-ade7-4301-adc1-c37acc3ab021", "comment": "Malware payload (AsyncRAT)", "value": "4948a16880a9981440c628481e143bd3d3f2fcc9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623267986, "uuid": "2efd0654-e3f8-4ff2-835b-1df3303cd137", "comment": "Malware payload (AsyncRAT)", "value": "f1bd112e4138b6cb2fdc5c253afb3ef12aa4b97f5ae36a0231c14d9e1ac85c950c199efc8ea114fa44ebff8cb92e1a97", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623267986, "uuid": "ac10df8a-a373-435d-904e-1b97f904e6c7", "value": "5C54D02175D0C2B3C4B3113444E68A7A9B793132576AA1E7B7DC2BBB6F212D1A3352CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623267986, "uuid": "5c7c41bd-ac3a-470a-b962-c088d122e7f6", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623267986, "uuid": "c6729ac0-f915-4154-9b9d-91de2b33564c", "value": "6144:vDKW1Lgbdl0TBBvjc/Zi4pRO2zmcPS9irKijAgN96dNOI2:rh1Lk70TnvjcBiAR474rKi96dNOI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623267986, "uuid": "853a5918-1d78-45f0-a10c-442f30fd331b", "value": 279552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623267986, "uuid": "1379f1a4-94e3-4065-b6d0-d7167e59da29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623267986, "uuid": "af6ca330-88d0-4c54-b060-37dac8e44aa0", "value": "998B270527D87BFD4553043E1755C7DE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c16dc72-c8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623217351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217351, "uuid": "32853041-5cd3-432d-befc-3c20b830753e", "comment": "Malware payload (NanoCore)", "value": "dffc9e820070887fd0e4a4973e847a36", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217351, "uuid": "495a344c-56fa-4a65-9266-0fa1c6855d23", "comment": "Malware payload (NanoCore)", "value": "9d7b5114111ce6382d022e2e43344b2608db07ecbbf13da758dd220e8df90394", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217351, "uuid": "7ba425e7-5296-49a0-ba8f-d200fa1aea09", "comment": "Malware payload (NanoCore)", "value": "32c5185f4aa508cc60ad331e4b3046dce732135c", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217351, "uuid": "1f831f04-5172-49d6-9d15-0eaa0290ffcc", "comment": "Malware payload (NanoCore)", "value": "9821721fbd99450f2d6954448b87e52354856be182c5359aade975b5a9fd5146e8a531b60dd5c5eb8d7699348ba74ea0", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217351, "uuid": "160e850f-d067-4645-82e1-f0f686812ec1", "value": "D94533AEF0E2D363F55F3274328D80956E41EC537A189A923BDE3B15A6347B1835370A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217351, "uuid": "4bec4ab7-3b15-4c81-901d-1bc8e8b7436a", "value": "24576:ePrkOTZ/gbYRYYQjrX/4k0msjwet+bybolCT6ntNMdVGPyB:Arx/gbYRY9X/4k0ms7+OGCsoa0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217351, "uuid": "8108742d-2a90-40b1-9a37-d2f00c762d07", "value": 1250304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217351, "uuid": "c8a2d2ee-baf5-421a-835e-fcab02c7f4ab", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217351, "uuid": "66958e99-84c8-46db-a524-e0c41868404c", "value": "Ref 0180066743.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c21075-c946-11eb-875b-42010a9c0053", "comment": "Malware payload (ImminentRAT)", "timestamp": 1623259160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623259160, "uuid": "1a232628-b4f1-4397-aa8d-94f4e748204f", "comment": "Malware payload (ImminentRAT)", "value": "a853becef668c582b4598a48ada05331", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623259160, "uuid": "d3830c3b-6ab9-452a-a72b-48b3e315a427", "comment": "Malware payload (ImminentRAT)", "value": "9f505b6b238543bdf2f4dedea6e0d2d2b72f285ebcea82b76311878975857b62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623259160, "uuid": "265f6f49-fa0b-44f9-b779-ab82dc158c91", "comment": "Malware payload (ImminentRAT)", "value": "65c1c65209bd2cf45c7ec167de57eefd549ae92f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623259160, "uuid": "e2556d45-3773-40da-846d-ab5f87cc7376", "comment": "Malware payload (ImminentRAT)", "value": "a2f4487901180d36a92fad8574147ca00bfd2e29d474a28144164a806afc57524bbba18466168c2989d0920dde61375f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ImminentRAT", "colour": "#70C7AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623259160, "uuid": "40ab8738-501d-4b78-a59b-db1135a39cef", "value": "8815F13513488A14E17F9335A071210483F0F517E326EA4DFEE858DA2EA27C6A77F697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623259160, "uuid": "fc3594e1-b366-4e5f-8e98-545dde72a753", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623259160, "uuid": "b339307e-b788-4355-980d-78fe369ff1b5", "value": "24576:bbAG1vjqUpzWV+uL9URqBEdANSav9BG2:ZHpqVWqBEyNSav9BG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623259160, "uuid": "748186a6-d233-4824-8069-9a138024e7a5", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623259160, "uuid": "fc0b7ae1-2167-41b7-b0bc-136965ae502f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623259160, "uuid": "b03b8da3-4a7c-4782-9060-638a1438e31f", "value": "a853becef668c582b4598a48ada05331.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0abf05-c8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623217273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217273, "uuid": "419c2a88-9128-4ae2-a4bb-2586fa6be1a6", "comment": "Malware payload (AgentTesla)", "value": "45e6b358df3071ae86302aa727671102", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217273, "uuid": "dba60f5a-7d9e-4f6f-bc71-86d3d79ad094", "comment": "Malware payload (AgentTesla)", "value": "9f5e5e193854fb9895b76cd77311d035898e962cad0d1b2b29b47d6c6a7bb762", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217273, "uuid": "7525ac3e-c01f-4373-9059-1e6c9b69d744", "comment": "Malware payload (AgentTesla)", "value": "15f29f1df4f7f2f66b166536a5e729fe3a5563ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217273, "uuid": "be58288c-e9d1-45af-87ae-90b77608b2f3", "comment": "Malware payload (AgentTesla)", "value": "d3bb7801ca72c2c40dd33121b22263b61f14079e0280e40b7a0adc05b758afffe5d97a22b67c22ef049c0bd7aa3bd563", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217273, "uuid": "c0fb1aeb-c07a-4b24-9c83-cda040a0911b", "value": "ABF423F786F38175C71AC1C371E334AD406EB1361911E8AE6AB4247D1E17A293BDB29C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217273, "uuid": "dc6fd599-6875-43e3-b231-9e85c6600180", "value": "12288:Q6akRV0ZVc6r+CDoxTbtU5ppRSMYnPd0C1sMEIZFTChrpF324f9F7F:Q6aKWACcx/tU5fcnvjZF+hrL324Vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217273, "uuid": "18097217-c420-41df-b532-c55f813ad0a1", "value": 766698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217273, "uuid": "f35a3c14-4dc3-4264-a233-f59805176fc6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217273, "uuid": "8bc78568-a8b8-4f33-975b-7f041e5b71f0", "value": "SWIFT Msg of USD 78,000.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d689280-c8d7-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623211153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211153, "uuid": "405e2608-7b29-49c7-958d-189b463cff0b", "comment": "Malware payload (Loki)", "value": "24dd4963d365c33435f58adaebb1ef26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211153, "uuid": "c81c7ead-28ea-499a-881b-2cbe02121422", "comment": "Malware payload (Loki)", "value": "a1b5a409baecc58b655cafee130c86297f979e65ca1ebd430755d378ab76f513", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211153, "uuid": "e3bf0020-3fde-4145-a761-d58ce9b42984", "comment": "Malware payload (Loki)", "value": "7161c5d5e1ddd50bda8bdc0e1103e2c7f3df14f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211153, "uuid": "73fbce59-8f06-41c9-90c6-6163c3a030e8", "comment": "Malware payload (Loki)", "value": "c676c4ba1ab05ea5e1eb5194cf7fc5e2947ea080f3624c15e1d613048a4251bc118a5ad77b96aab4572713fa3a8b9066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211153, "uuid": "bf29f73f-730d-426e-a39e-30d0b3b1ec03", "value": "FC04120B1BD0D0BBC2E1C2315EB1676DFB77948A46D52F0F57252FAB9F276059842388", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211153, "uuid": "4bc24ed0-4eb5-43d3-9028-7a833c8ddfec", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211153, "uuid": "86baad0f-3153-4413-9387-66b8cb703f14", "value": "3072:JS8BCfoDaXJnMUkMagUiz0g9EDpyujez1T5du0bgGBoFJRcKUCJaHKZAiDZqVW:JPB6WUvxr4g9EtUT9bgGBoFJiCJa+Xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623211153, "uuid": "193d9630-7a17-4e7a-9e29-45e4436d6317", "value": 181387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623211153, "uuid": "78d21703-0adf-4372-a808-3e3973e57042", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211153, "uuid": "21295154-99f7-45a7-93cc-8066255e57a3", "value": "Proforma Invoice\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ce5efe-c8de-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623214200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623214200, "uuid": "f36ba395-1dd5-4f57-97fe-e4aba01bfae5", "comment": "Malware payload (Formbook)", "value": "3c5d10029243f5d439c17c0029264706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623214200, "uuid": "f1387bc5-60f5-40ea-bf5e-4a9fa54248f4", "comment": "Malware payload (Formbook)", "value": "a2188f5cec31614ed7c703daa97120e115d18d6887a0f9f6061278ec0cd88fdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623214200, "uuid": "3e531187-c246-45b7-b05e-b6e20f14303c", "comment": "Malware payload (Formbook)", "value": "b2c6cb734091355db701e02f6c50ab572b885f41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623214200, "uuid": "aab34152-e16a-4d8c-b8f3-ddcf4fd726c3", "comment": "Malware payload (Formbook)", "value": "d24340cd3ec65f8780af24abed9202ce39e0a3aac07556b6b706e741d95c3cc978bc8587baabbce0cb87c6e3fc8fc0cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623214200, "uuid": "854b761a-5957-4af0-999a-c1971eeee0df", "value": "61F4E039168C4A54E17F9335A061520443F1F503D362EB4DFEA858DA2EB37C2A3AF697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623214200, "uuid": "0000b23f-094b-4b9d-8510-f31e2af16714", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623214200, "uuid": "d7d09f92-974a-4f5f-8a64-1cc4fc4b8113", "value": "12288:zVsf15tGPvHTvvROsUsl/lMV40JSoohfU/7a/c3gM7wXy+CPu8IcDsbIm:z3vvBl/UgooOeugM7hPZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623214200, "uuid": "14e1eab1-c5ed-4d1d-afdb-39da9ba9c93b", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623214200, "uuid": "8ec7b65b-f0e4-4931-8b8e-3f4fcb5397c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623214200, "uuid": "c54dd5ac-1c20-445b-b3c4-a3e5c5db8457", "value": "SecuriteInfo.com.Scr.Malcodegdn30.18039.27312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af13764-c91a-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1623240032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240032, "uuid": "0784795a-43ea-4b84-8307-e7f4e6be9512", "comment": "Malware payload (Quakbot)", "value": "8e00b19c5b385f5eca67899ea5a40147", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240032, "uuid": "df92f8a0-cd7f-44ad-af79-65c1cb65d34f", "comment": "Malware payload (Quakbot)", "value": "a3531db118df0cbc5396d5cfb7ea56c07b2b5faebdb7d3cabc50efc6851b9e2c", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240032, "uuid": "5e0cca94-354e-4b69-8899-a62a781b8c98", "comment": "Malware payload (Quakbot)", "value": "162dae69ed15d3e44fbaf4fe7f3dcab410cda413", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240032, "uuid": "1e7c2e47-84a4-47ce-866b-58ca5bfb299f", "comment": "Malware payload (Quakbot)", "value": "211535f2e714d92ec11aaded82b232bf8869d8fa6d1cfb80cb0e1d330d36d260872368583e75d0dbab6a263bda22a771", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240032, "uuid": "bb56a69e-79c1-477c-9ef9-22fbb3414f85", "value": "697412BEE78166F8C335C93EC680D1E18251F1D040A7722D07DD3619A7532DFAA9E2DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240032, "uuid": "c57e688c-4da4-488e-a597-a857168b08ac", "value": "6144:JGRMlgE+mJ9ABc/nv5k8IKAhBfsOwmLgzLc1pTcsGEdDIPmhsB0vRakfzeQZNWD:JGRMmEv2Bc/nvm8IKABfsYOmauFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623240032, "uuid": "a0784d47-d20b-4f9e-84ab-a3c99985ea32", "value": 346686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623240032, "uuid": "d2cee583-2cef-4427-861f-53a0d2450ba8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240032, "uuid": "391a4141-c9d9-427d-a155-b1c1d842d989", "value": "Cancellation_Letter_631338423_06092021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411e7526-c97e-11eb-875b-42010a9c0053", "comment": "Malware payload (Pony)", "timestamp": 1623282966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623282966, "uuid": "8294f580-e1f1-4af5-b5d8-077af4413d25", "comment": "Malware payload (Pony)", "value": "e2a95182089c70372ce941d776b50cd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623282966, "uuid": "2be59348-02f9-4c31-8fa8-8b7a6f7cba15", "comment": "Malware payload (Pony)", "value": "a58340193e6e70a1471519a3ee4627dc5a5f0a7ed346900963977592557abfbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623282966, "uuid": "5967d4ea-c01e-419b-aec5-9c9b817b5cd6", "comment": "Malware payload (Pony)", "value": "ce6ecffdf4a8aa430ea8cfe64fc5eaba06d96b05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623282966, "uuid": "9ca85c4f-13a7-4c43-b2f4-1d17c5de45b2", "comment": "Malware payload (Pony)", "value": "e8c406bcd207603970da5a574543a61ba560f57b6f2829111557c40a63ccaece3d0dade8dad576bf8c171c324e3a7d66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623282966, "uuid": "d7e11169-dc5a-464d-ba16-f1139a99f796", "value": "4FB4AEFBD4865838D1A04F329CED25BE03BCBCF6640A4F932A5BC5278610175D6E7B86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623282966, "uuid": "1c6ee895-12ed-4e7a-a907-b6477241dc6e", "value": "954cb6070dbdd1e04cb8b926e773d26f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623282966, "uuid": "937511a5-7f88-4b6f-bada-86cff99ae5a2", "value": "12288:du1/86NSNYukizOpI34k0S/jILlc4mjrazDci6Mo:du1pwqiC6I0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623282966, "uuid": "efb01e71-544e-484c-8e3f-402044115bb6", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623282966, "uuid": "d2ab97f3-a528-4c2c-9d64-80ebdb2a167c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623282966, "uuid": "21331e90-33b8-4f94-a005-fac980885e40", "value": "A58340193E6E70A1471519A3EE4627DC5A5F0A7ED3469.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90163e37-c8c7-11eb-875b-42010a9c0053", "comment": "Malware payload (Pony)", "timestamp": 1623204500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623204500, "uuid": "72aa48f0-0896-4eaa-8c08-18deb7eb3d41", "comment": "Malware payload (Pony)", "value": "44521342fecc70605fa4fc225a0d7223", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623204500, "uuid": "10621f1b-7357-463b-b370-11b3a59509e8", "comment": "Malware payload (Pony)", "value": "a5f5fc2f6e2c6e6318be4a81aff84d55ecdaa21e6ef6871c44fa409ebdada7e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623204500, "uuid": "5b72deb0-d8bc-4fa3-91a7-ef867996cbe7", "comment": "Malware payload (Pony)", "value": "41b3e6a73059b974b02ff36c2913ceb3a63428fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623204500, "uuid": "8c2806de-5bd7-4918-b0be-bf97c7d42b76", "comment": "Malware payload (Pony)", "value": "e049b7e6f127946f130f4c720b6642f334f09ffcbfb5c95e0149cf80ef61a0396af716f3a64eca14587ed3c142279ed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623204500, "uuid": "05342830-86ee-4d1c-a61b-f956231126d4", "value": "B684F162AFD86211DA4C8C736C825F7E22747F625BD7524C288D3725ADF82B0C3B6572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623204500, "uuid": "645aec05-7f6d-4fff-b9ba-445c599f97a0", "value": "2164c6b0b37c4beb6989f333b81396eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623204500, "uuid": "38322b5c-0dbb-485b-a115-ed10fc56582c", "value": "6144:vHT8yWPzB7IrpB6HMODHCXtttttttttttttttttttttttttttttttttttOBfyhP9:vHTSPzB7IrbKDic8h3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623204500, "uuid": "3c3fc617-038d-43e2-ac2a-2cfa21bfad0a", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623204500, "uuid": "16331960-d02c-46e2-9ea7-8dd0718f8957", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623204500, "uuid": "a3ec6353-49f5-474e-82e2-50f1bf761f31", "value": "A5F5FC2F6E2C6E6318BE4A81AFF84D55ECDAA21E6EF68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbaab819-c918-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1623239362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239362, "uuid": "8b9f21e8-2282-4a46-8b2b-5a9b50f5cf99", "comment": "Malware payload (Gozi)", "value": "9f07670d0192eb4c2fa2dbafb6b3dddf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239362, "uuid": "ac31ffb6-832e-4ecb-920f-b84e76112880", "comment": "Malware payload (Gozi)", "value": "a62876ad5b23476a42760a93bd502ce8d91d86a1fcbfa0f9edc673f4243a08f3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239362, "uuid": "38a4cd0d-d117-4efb-aefc-382af082131b", "comment": "Malware payload (Gozi)", "value": "0fac819049810a6707ce2269dd9cee6347b8ec7b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239362, "uuid": "b9c4e346-182d-4d33-9572-e2f069103540", "comment": "Malware payload (Gozi)", "value": "4a0b2ec69d1562474bc04c36e813c713373a5781a63d1dd06a7e5a3033e8158b93e408297f15789ab444c857ea059bd8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239362, "uuid": "7410fadd-f1c6-456a-943b-be815c88b48e", "value": "BC23F2116F405837F987A4BF0276371E954B9314033B58CBD3728AC8AEEE9DA6C79903", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239362, "uuid": "c51eb151-e9ca-4c55-ada8-fa818cd54bf4", "value": "6e9163c62b29a1ccabed40ce8621a95a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239362, "uuid": "c38a61ad-4033-49b0-ba2c-2901bf0a59f0", "value": "768:ufl+nrGv4FYhg2VvNBNxilnq/zXX7NO2Qa6V6nHtpbWG3tC683xLp3YhL+yxM:ut+nlFBm3/zXrNfQlKZ9tC6sMtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623239362, "uuid": "b7660106-9304-496d-837a-c50f1f585be2", "value": 48780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623239362, "uuid": "66cbb5ed-a7a2-4d3d-9cdf-c80feff4f514", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239362, "uuid": "6a35dd18-00bc-4170-8e32-a4c6d9b05d8d", "value": "2ff0174.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d264d13e-c91a-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623240260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240260, "uuid": "d81fafa2-def9-4fbf-9904-2186d803e31a", "comment": "Malware payload (SnakeKeylogger)", "value": "dd7adda90cbf0f8f251eb0cd95207281", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240260, "uuid": "3432b2d8-4427-4a88-be7a-e80990efd169", "comment": "Malware payload (SnakeKeylogger)", "value": "a6324c952b09c1e68fcd2b459d5a6a24a9ce35a743685a1c2e43960c47aecfc6", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240260, "uuid": "1de97666-7842-49bc-9942-278ca963fe2d", "comment": "Malware payload (SnakeKeylogger)", "value": "8ad15c4fb494223bafc4859c6e1729811bec5459", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240260, "uuid": "16e52bbe-b601-41ee-ae87-11a37e3394b7", "comment": "Malware payload (SnakeKeylogger)", "value": "14e9027c686adc295d5738145549311d42c22b1fec6cd84832d534ec03a88f2e424749c2579ac1dab447cb8194dae804", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240260, "uuid": "acba4caf-b2b5-4b08-8d92-e5467da44456", "value": "3FC423D8EAE47D9BABBECC53892B4700A4C2E59EB9F7E89C63F9CD540191103F934152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240260, "uuid": "b6632888-6ffa-41cb-90cd-944adbf046b0", "value": "12288:8VoRA/tIqdAPH611j12B8B8/Lwr0HvBgGqEL8Zq/jyQbZU:1ARdAvKEB8B8/LLvfAZq/jyQb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623240260, "uuid": "74cb7df4-6a98-4660-98e9-922b92ac0e59", "value": 561326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623240260, "uuid": "9e2123e7-e185-452d-b563-2ed5a78728d3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240260, "uuid": "5ef5d91d-325e-4187-8216-5df4bf3133c2", "value": "Quotation.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4b6295-c917-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623238825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623238825, "uuid": "6626275e-9150-4b6c-acaf-1ad8efa2e0e3", "comment": "Malware payload (AgentTesla)", "value": "aa7583b9ff14b0fca0c9077c49fcae54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623238825, "uuid": "50deea70-0e2a-4295-a83f-f814eafbf3bb", "comment": "Malware payload (AgentTesla)", "value": "a79d71fc7911e4ffa5241183a432c833289085f62099a62948761499427f8510", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623238825, "uuid": "fbe8b71e-c734-4e93-b5dc-7d2b2bd7c959", "comment": "Malware payload (AgentTesla)", "value": "5118fb1536d907bacf728627aedcef54dec8a26f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623238825, "uuid": "715ff0e5-d7b8-4852-beb5-821aa871163f", "comment": "Malware payload (AgentTesla)", "value": "1b755c686f40e14fc3a2e1f78c777ed1296a2e9fa655e28ed6a1f84a102224755270a1254c186d1bc6d053713ebf69bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623238825, "uuid": "70326ab3-d57f-4a0f-aaa2-b3af7eeda860", "value": "C55423813D123BDD80E1A52785BAEFC0FF649E3A06DE15A79D89D19CC12C4A9350EDB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623238825, "uuid": "0671e96f-f8fb-4586-a8ca-a9f358245c15", "value": "6144:02QVv80Qt1m9Gr65/OZpvfNHwBnljCVbr9LNWwtXs+xpJhDNCSX:hq8nzm9GO8ZpNynljCV3PWwt8IJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623238825, "uuid": "99adc6f4-8353-47e7-842e-3039d326628c", "value": 301046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623238825, "uuid": "576db36d-9cbf-4f00-b704-ae1b3c91381f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623238825, "uuid": "227076b6-44bd-4761-8ce1-8c9bc3f611a5", "value": "\u4e2d\u56fd\u6d77\u5173\u65b0\u89c4(English and chinese version).gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a718bd15-c922-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623243623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243623, "uuid": "d81cca24-1878-4627-87f1-29f1be505705", "comment": "Malware payload (AgentTesla)", "value": "afccab798f9f548f1c7f31b81b8dcef6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243623, "uuid": "911eef43-3d97-4a87-a9c2-c559a382a9c2", "comment": "Malware payload (AgentTesla)", "value": "a7f3aeae178c063964966201605c994a8b4881f45ff0cd1a0a36bdf46de2fcc2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243623, "uuid": "07175b8a-a8b6-4878-a58e-90d732481aa2", "comment": "Malware payload (AgentTesla)", "value": "03004b255393eb4aa3fa9305ecebda57c2cb7d2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243623, "uuid": "b108757d-87be-4649-a30d-787e192a719d", "comment": "Malware payload (AgentTesla)", "value": "7d5134daa195a5c50a0bdea92578bcb503ff88bfcb1f736f1fd2a751f5c184f100bf9ee528bd3d9d32ea0354d597494f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243623, "uuid": "11e2b6f9-38e5-404a-82d6-a8713f0ea6b8", "value": "2BF4DF2417049B28E5BF8776C0A1441487F5E503D323DA8EFDE588DD2E323CA97AFA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243623, "uuid": "75c49d00-5133-47f7-944b-ad52af2f2026", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243623, "uuid": "6083b01b-09fc-4f24-9ba8-4593dbe85cb1", "value": "12288:rhCPlMV40Jpw3IJ1Qf1LUpJtHU1BupfTHBx2D/iV9jjVvleIYkfYPe:rhCPUeC1QfqpJ9UaVHz2WVRJ4YQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623243623, "uuid": "20dbd77e-b258-49db-b8cd-837c85702e45", "value": 751616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623243623, "uuid": "9ed082ed-2eda-40f7-a242-7046e548966a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243623, "uuid": "8c5b9788-8695-4108-b303-5b696ed55708", "value": "BP4w3lADAPfOKmI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d938544b-c917-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623238983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623238983, "uuid": "91046c10-52e5-4d16-b161-e1a0f93de2d3", "comment": "Malware payload (AgentTesla)", "value": "718febb859cf92c8ad495f4f93667ba3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623238983, "uuid": "faaba024-a997-44a9-9b36-5545a9ed495e", "comment": "Malware payload (AgentTesla)", "value": "a89c131358983a06582cd4a95be4dea9f056f731aab7c07cec762678aa386a6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623238983, "uuid": "d6500c4b-4bcb-4f89-946d-04f61b313c52", "comment": "Malware payload (AgentTesla)", "value": "0bdb18cd2035f2814462bb73232b3cbfc2b81ffa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623238983, "uuid": "76c5eec7-abaa-4396-9434-11ae79b7f5a6", "comment": "Malware payload (AgentTesla)", "value": "8d7b669869bf494e30040476d12977deb3e16006dc6ed86340852cf7229c40056ba2b5a262541cd488333c12e5528649", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623238983, "uuid": "51d0ad77-e3d3-4a02-b0fb-b613ff8ea382", "value": "F7D4231D3C0C7A979295387DA5C383858E7F1E871E380E1DB58174A1DCBBE6EACC6681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623238983, "uuid": "37bfff14-be0f-41a5-a650-1cf7f28fb328", "value": "12288:4LDxeqQ555Lm0sumHVFGX5qDEVpo0maU3lucR0WX/OlQFYr:430X555LGOpq24asJX2lQFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623238983, "uuid": "e6de5631-4caa-42a0-9315-d9fcd56b1324", "value": 610766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623238983, "uuid": "38eb53ef-5060-4cd1-b48f-81642aa6bb95", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623238983, "uuid": "d017c663-4ea7-4539-874c-ba5e67f4126f", "value": "TT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da65301-c932-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623250318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250318, "uuid": "1c5b85cc-8f37-42a0-91ca-a2f0f582c5b2", "comment": "Malware payload (Formbook)", "value": "2a87fe7c5112f193a03be441706a83fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250318, "uuid": "9951f99c-4de5-4898-9b7a-7d63aea1a9fe", "comment": "Malware payload (Formbook)", "value": "a99cc9a72844d9e0ae08307714e5541a19e3ba9a5e5fd24a8deff56303ae60a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250318, "uuid": "5fda9026-c6eb-4897-aad2-8d2d9a0ea170", "comment": "Malware payload (Formbook)", "value": "bd3d79b6fcd00f3c4638c5bc0afd9bfadb395f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250318, "uuid": "91853734-b83a-49b5-805e-263792425c81", "comment": "Malware payload (Formbook)", "value": "eb5cb6aa7ded641ef8753e714450bf313eacb75b48b305cbdf4fcbba5b34b2c5139e9616e4c8efda639572cb6b252593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250318, "uuid": "96ecd6ab-8d09-4506-9591-87687bd4bf9a", "value": "FC25BF423144DD99E07B5BB254AFD52053F8BD4FC221C60D7E86B92A19F338222AF75E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250318, "uuid": "94862c34-e6e3-4504-a85d-54d587a0ceb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250318, "uuid": "4ffb9a49-ff55-4395-9eea-14c7dbd1b30c", "value": "24576:tXBicUG6gUZ+tpV8hkJ43WNNJGxUch6nYd8:24W+LVm843uDGxUch/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623250318, "uuid": "10e0cfca-0191-4c0e-951c-992ff597d852", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623250318, "uuid": "762dad75-8e02-48fe-b6d6-807bb523e2e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250318, "uuid": "033a6fed-4559-4387-857d-778ba0c9604d", "value": "PURCHASE ORDER. ZIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7f793a-c923-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623244006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623244006, "uuid": "b4317de2-ee5a-452f-bc4f-581b701a3937", "comment": "Malware payload (AgentTesla)", "value": "62a4a25d69407bd16da1d7e753362d3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623244006, "uuid": "4ede6523-670e-418c-912a-d8ae14338575", "comment": "Malware payload (AgentTesla)", "value": "aaf8ab71ced38032d556c579a0589e0bc57252024b8ac324048c965e8d4d5023", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623244006, "uuid": "a5047c81-310d-4b72-8c5b-94d91da16df7", "comment": "Malware payload (AgentTesla)", "value": "cd2a1b32df47f3c4c7d056e30ff387aa4ddb32e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623244006, "uuid": "2788f472-da14-4bd3-98cd-826d5af497a2", "comment": "Malware payload (AgentTesla)", "value": "4f4c690d266130f47181dd60602a625008a7c85bc109dcb9586a61e762026e866be07cf01befdc1ee9ebd696c2c192ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623244006, "uuid": "dfda0842-c62f-4597-960a-7488e11b82cb", "value": "42F4E02517489B28D57F977680A2411483F4F603C723DA8DFDE998CD2E227C6C35FA9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623244006, "uuid": "449feee0-d08e-48a6-9ef0-e6325fdc9886", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623244006, "uuid": "3452f79f-06cc-4167-8516-e65f63baa49f", "value": "12288:7BrdMlMV40JGAyIPbkXTMWd70+lldxIML8fxk1XqMB8B5Y3j/Hs:7BrdMUfyIE59jhIMsxOqMsEjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623244006, "uuid": "4d991cd8-7b06-4382-b4cc-f02b8557795f", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623244006, "uuid": "de555fd1-98f0-494e-96cf-bcebd9b09da9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623244006, "uuid": "2e9574e2-1c1d-4062-b0d2-4bc162683e24", "value": "Trial order 20210609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3bd26b-c93c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623254745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254745, "uuid": "f96d6189-5db1-47a9-8913-a7b09833b14a", "comment": "Malware payload (RedLineStealer)", "value": "cf89ccd91a0582286a6d6fbb4721c99a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254745, "uuid": "c9653457-cef4-4c8a-b601-82fe6f03a786", "comment": "Malware payload (RedLineStealer)", "value": "ab1b7bb6e9ab4d236af50fde41238818522f92ea990c2190af88b6514bf5559a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254745, "uuid": "68451b80-5d99-41a0-a862-526ce06b9f7b", "comment": "Malware payload (RedLineStealer)", "value": "8a1d9e9a449f81293e1c861c7fb495f265343d00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254745, "uuid": "619059a2-7aa0-4584-b776-280356fae354", "comment": "Malware payload (RedLineStealer)", "value": "1c3e3ddc9227423e1dea0f0ea0676e06ff55f3a4e85dc36b2214006e544b61fa032aa55c6d27b77f4a533839959c0ec9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254745, "uuid": "80badb1d-e09c-463b-a727-ffc33c6fd15e", "value": "AA058CF4F59899B0C15EC772C7919CADEBA211FE5303891C0AB9DA8C1F03B9A8F5D845", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254745, "uuid": "42ce71d3-646f-45b6-82a4-0968284572ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254745, "uuid": "baefe39f-f939-4af7-bf53-835661d6a6dd", "value": "12288:rGsBEe4fqTvTBO+yc2LSz6hmgdq7sN6POKIW95Z+9kkblVyndVUp5:rGsBEe4gO+yc2m+hZHnWXoEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623254745, "uuid": "4ff6a37d-2798-4462-bdbf-f8306211686c", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623254745, "uuid": "4202c1cd-650f-4912-871f-abf8c21e71b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254745, "uuid": "f0372840-e90b-445d-88b2-f769b5e25404", "value": "cf89ccd91a0582286a6d6fbb4721c99a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48188351-c904-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623230579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623230579, "uuid": "47ee1aa3-73d3-4c9d-9a88-b2a9efa07e47", "comment": "Malware payload (Loki)", "value": "7867e22d8d4f8d526a5891a732123f83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623230579, "uuid": "d968ced9-3800-4712-8440-24b0f4c5098f", "comment": "Malware payload (Loki)", "value": "ab1dc966ff5c4fc71691599fa1598cd34068bc757f4a9636cbef884eabc66e7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623230579, "uuid": "c47d0ca6-d3fe-4af6-835f-75529165cfb9", "comment": "Malware payload (Loki)", "value": "1ee7b7a5a55918d0bcc19ce9e896298648177aa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623230579, "uuid": "ed60e29b-3fd3-4f7d-b9e1-69b0cf5dfcf8", "comment": "Malware payload (Loki)", "value": "d0f0effd685e81d78ac583ed1b124be4b35be8e6c875e938aa177edc533b35f25be49ac4e1ca5f67a84fbaf7bc0880a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623230579, "uuid": "1adc1576-d2c2-4b12-964d-97b9c03d5127", "value": "0F04128BAFE18473D153967009F2A77BE3FAAF964161521FCF811F2DB450583862A274", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623230579, "uuid": "81a88012-2fc9-4ea7-84ef-45f4eadaee39", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623230579, "uuid": "3f79641f-9522-4d2c-8e5e-b7fd1e46438b", "value": "3072:JS8BCfoDaXJLMbXhfPR5VaQaAwtHyjQHhAz4TgZlqRIY80W/KL1m/:JPB6y7h3xaQItLHizw+4FvW/K4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623230579, "uuid": "010a50c9-acf5-49a0-a0be-1e92160a9a56", "value": 180826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623230579, "uuid": "962061a5-3f5c-4e3a-9ac2-c2b3fd0de78a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623230579, "uuid": "3b01ac65-d07c-4674-91a1-aae85e7bfc8c", "value": "REQUEST FOR OFFER 09-06-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388e88b5-c8e8-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623218527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218527, "uuid": "24752fee-3ca1-46b6-a892-72974e4c6294", "comment": "Malware payload (SnakeKeylogger)", "value": "015e5abad6989953d17d4ad7bbc606b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218527, "uuid": "8566924d-560a-426c-9f85-b906facf8725", "comment": "Malware payload (SnakeKeylogger)", "value": "ab74bc0055021acfabe6b05c55f5dd39ba805c770825ca887c1ac6c135f4bd99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218527, "uuid": "2d984fc8-1f60-4663-ac91-59691b0604bb", "comment": "Malware payload (SnakeKeylogger)", "value": "133b16a9624794681ce3f6f85a67bf30f1f14893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218527, "uuid": "3c0b213b-d869-4865-962e-86df5f006e7e", "comment": "Malware payload (SnakeKeylogger)", "value": "3c4baf6816d979c60abd8ed937ff6c201a8777d7e3ee45082400f494bf5f94f4c74970a539c5dd09a3b5deb8339725f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218527, "uuid": "1a0c8084-5004-4605-9fd0-2cc003e95c57", "value": "36742377B2D098F7E1D3DE72873F4635D3B8798A21E31EAB1B145F27183809562E6602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218527, "uuid": "794246c6-6d45-4423-bf81-7e8344452ec2", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218527, "uuid": "72369d91-e8ec-4cc8-a5b1-dcd51f0df17a", "value": "6144:JPB6WvfmI5xKl+xyjZiuqqayELhCdn6WFexd5VwVIwfTzHeNaS1VCh:F5nZWMuqquLQn6WFKCDfTzHe8S1VCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218527, "uuid": "81fd5776-3525-4ecf-840e-6b45a0b02243", "value": 344435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218527, "uuid": "cdb811e6-f4e0-47db-9d13-ce1d1e3498b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218527, "uuid": "9ba841f8-a9ef-4dc2-8c64-bd6b2575de7f", "value": "DOC09009000.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147de9d9-c93a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623253685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253685, "uuid": "ac1a4329-7179-4460-bc77-a7c3ac1ae752", "comment": "Malware payload (Formbook)", "value": "901e550a3ae2669166c6372d002be680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253685, "uuid": "d46ac44d-8fda-45c7-bb39-fe81ec4694ef", "comment": "Malware payload (Formbook)", "value": "abab32a4fb448379543c71311eb003788c326cdf25f368c92f56fad47d7a51e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253685, "uuid": "455b30fb-bdde-4265-bbf7-83e7d44b9bc7", "comment": "Malware payload (Formbook)", "value": "dc0e878caf15d4d5cb188ae9d100b54aef4ba996", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253685, "uuid": "3c98f3f5-7366-423f-9f83-ded952a220bb", "comment": "Malware payload (Formbook)", "value": "2df74c065829c88677c3b87225dc4792947ccdc844a72fbdf4e6c69050dbcca8f60fdae80f8ee0f4ad314bea9cb08cd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253685, "uuid": "5b2f5be6-15eb-4ba1-90c3-f647a95aaea6", "value": "89F4E025274C8E54E17FA33690A1510443F0F507E362EB4DFED424DA2EA37C6A3AFA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253685, "uuid": "0b4255bd-6ae4-473d-9b0c-d4f21971c88f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253685, "uuid": "6b9f4c06-9dab-4cf7-b278-c0a71c85d2dd", "value": "12288:5D8O15tDPvHDXbwaSwwlMV40J7iP+SdWlcQa5titllBgdwOq3kpZraVTSI8Wc+tU:5d/SwwUJId9vitlodwzkuv8D+tGP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623253685, "uuid": "d2d3bd71-9749-4e55-b6f5-41d46c37427b", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623253685, "uuid": "fe614b79-ba37-43a2-8832-7962b1f84191", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253685, "uuid": "331f621f-5e36-4150-96f6-06c6bc017b7e", "value": "kmEVWJjPV6esObh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833d6be3-c8fd-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623227671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227671, "uuid": "64c25063-9bd1-46ac-aaa6-91ae6a52a1e2", "comment": "Malware payload (NanoCore)", "value": "fb1eb909e34c22f21310565cf4b71563", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227671, "uuid": "867d8f6e-805b-4c9b-bc11-3426bde7be07", "comment": "Malware payload (NanoCore)", "value": "acfd6ceddcb0f24e6a170eb64cfbbb1af4876bcda5fb572c36330b1f6208a84e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227671, "uuid": "64f0ea82-aff5-4309-a41b-434932339770", "comment": "Malware payload (NanoCore)", "value": "f301810874ac9b59aef7c5ca3d8377e35e4906ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227671, "uuid": "8f1436ac-b490-476c-982e-c6d9d2f93be0", "comment": "Malware payload (NanoCore)", "value": "52fb147248f1a50ae8a8728fce45dd58e0cf87ed629a27d4dc52405a55d886795d23db07a9a0225934cc12a05af3f9d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227671, "uuid": "f2543f73-0cf4-4f46-8ef3-894f9df4070a", "value": "8A15BE2321CC5AC5E1BE5B349C65F30C43F9AE069312DE09BD98F489297278252FB57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227671, "uuid": "07bbceaf-25c9-46b8-ad88-c9edcbd53d25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227671, "uuid": "0e5c1c2b-654d-42b3-a88a-d6c32e1eb35c", "value": "24576:SRjfsacU2VITgLiflegZKnWV0trUGrO2:QmITtZgWurnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623227671, "uuid": "a13aea1c-031b-40c9-a090-3e109dbcb787", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623227671, "uuid": "371f2ff6-b0d1-44aa-a6eb-e6af70cced0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227671, "uuid": "02801e06-b718-4817-b1bc-8d1a97068363", "value": "POInvoiceOrderIuVvcl0VWEOAmXy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40996b3a-c969-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623273945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623273945, "uuid": "f3754f75-1a55-45ab-a20e-a4b59ed15191", "comment": "Malware payload", "value": "512cf85441dce35303b3b20ba8ca243e", "object_relation": "md5", "Tag": [ { "name": "tag1", "colour": "#C526B8", "exportable": true, "hide_tag": false }, { "name": "tag2", "colour": "#6401F7", "exportable": true, "hide_tag": false }, { "name": "tag3", "colour": "#B2ECFA", "exportable": true, "hide_tag": false }, { "name": "tag4", "colour": "#884843", "exportable": true, "hide_tag": false }, { "name": "tag5", "colour": "#003DDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623273945, "uuid": "aa5f4665-cd49-4ade-9334-17d31a86239a", "comment": "Malware payload", "value": "ae279e72474eb0975e925d56b6a1a04892fda829de2cc30a227ad00f2925e959", "object_relation": "sha256", "Tag": [ { "name": "tag1", "colour": "#C526B8", "exportable": true, "hide_tag": false }, { "name": "tag2", "colour": "#6401F7", "exportable": true, "hide_tag": false }, { "name": "tag3", "colour": "#B2ECFA", "exportable": true, "hide_tag": false }, { "name": "tag4", "colour": "#884843", "exportable": true, "hide_tag": false }, { "name": "tag5", "colour": "#003DDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623273945, "uuid": "22f73d4c-d6e1-4cd8-8565-e03329d937e4", "comment": "Malware payload", "value": "45a4902f45dcf9e7b4bbf485b204ee8d88518052", "object_relation": "sha1", "Tag": [ { "name": "tag1", "colour": "#C526B8", "exportable": true, "hide_tag": false }, { "name": "tag2", "colour": "#6401F7", "exportable": true, "hide_tag": false }, { "name": "tag3", "colour": "#B2ECFA", "exportable": true, "hide_tag": false }, { "name": "tag4", "colour": "#884843", "exportable": true, "hide_tag": false }, { "name": "tag5", "colour": "#003DDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623273945, "uuid": "6a1dd426-4f06-4bad-a7c3-247f2d301e4f", "comment": "Malware payload", "value": "6d72c0563f735cca0fdcfec105e66720319d3580ffc5f3ea3ec86691ba0371ef8f90821a821a065f50ffe1f35de3a95d", "object_relation": "sha3-384", "Tag": [ { "name": "tag1", "colour": "#C526B8", "exportable": true, "hide_tag": false }, { "name": "tag2", "colour": "#6401F7", "exportable": true, "hide_tag": false }, { "name": "tag3", "colour": "#B2ECFA", "exportable": true, "hide_tag": false }, { "name": "tag4", "colour": "#884843", "exportable": true, "hide_tag": false }, { "name": "tag5", "colour": "#003DDB", "exportable": true, "hide_tag": false } ] }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623273945, "uuid": "aabb741e-97ed-4479-902c-2598120eb9c1", "value": "3:XA+Ruw3AaHoFH6XuGAWL:Qu5p+Gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623273945, "uuid": "a779127c-0f0a-4ca3-bd0e-dd1770c0944f", "value": 47, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623273945, "uuid": "705f24b9-0ea5-4735-b946-e16739828c28", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623273945, "uuid": "0a9f5a4a-a1b9-4ed5-af15-49b37aa943c4", "value": "test_file.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8373d13c-c8d8-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623211780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211780, "uuid": "b09a20cd-82a7-4bb4-aa8d-728b1aab249f", "comment": "Malware payload (Loki)", "value": "2a3e7dcff0c7b3ddbe7c95134ab5c36a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211780, "uuid": "d091e564-a67b-40e0-a13c-4f5192618057", "comment": "Malware payload (Loki)", "value": "b0240656b691131cf8d6c013a40b4041f5d229faaa16d9fddd71c18a1b73b0e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211780, "uuid": "d2b6199c-7f8f-459c-b368-3591626625fb", "comment": "Malware payload (Loki)", "value": "39a323ca08d068691e8fd5f1c96c4fffa162ce8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211780, "uuid": "02aa9eed-34f0-4e22-93e2-30aadc1aaa8a", "comment": "Malware payload (Loki)", "value": "163cba673fd45b5fd94011741105006ffe5bdde93595e2d5fa667129d97008e67053f618c1fefe8393a3f55b1daa8cc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211780, "uuid": "765692a1-7c76-4521-a198-fb56a795787c", "value": "A1548E00B7F0C039F7F316F859BA8269A93E7AB16B2490CF12D51ADA56746E0EC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211780, "uuid": "b08cb935-170f-481c-bbce-0c9d9417686a", "value": "724fc268cccef646d4517481c9e2932b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211780, "uuid": "9e9d732a-84dc-41a0-8397-77eebc1892b3", "value": "6144:yE0D6yhRo0fK3YMvaWOdc96y+safVRBAAGPEwB:9y6yhRo0/Mva7c9vta9RE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623211780, "uuid": "540d41c4-e72e-4e26-9965-d8415b1ea122", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623211780, "uuid": "d785890b-35ac-4f60-9603-2dffcf93350a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211780, "uuid": "7a7f0d56-61fd-4c47-9313-0b407c9b7a61", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1cf1681-c932-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623250567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250567, "uuid": "7540c3e7-9c8e-4f83-b783-16969b27f4d7", "comment": "Malware payload (NanoCore)", "value": "c89c05d0f2853fa30b535aa2544006e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250567, "uuid": "d00a3041-2938-4aed-a293-08836921c3b9", "comment": "Malware payload (NanoCore)", "value": "b2ec2e506bc9741873e39cc6fdc07802a1180136657582ae807d5f6112cfc02a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250567, "uuid": "03eee63e-a087-4f63-936c-2e5d8fe15aeb", "comment": "Malware payload (NanoCore)", "value": "2e3a6adc296d26732a3c61ac761052b8793f7da0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250567, "uuid": "fd4ec2a2-1a91-4912-9baf-c2e972de948e", "comment": "Malware payload (NanoCore)", "value": "d08f053b222aedf42300faf8707d0ab08ac83522b5f3ecaba125e5fe82c77494c415e30d31848f03721768a05d7cbce1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250567, "uuid": "650e987e-28df-42c3-b2d6-213d38e40145", "value": "6845225166FC9766D4FD9BBE5074042003B8BA2A7D22D7ADADE075EE08F2760C1C4B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250567, "uuid": "111af63e-708c-41a0-ae01-1429ec49bd33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250567, "uuid": "a62b9b8f-0706-4488-82b1-a6baa08826ba", "value": "24576:4ZBPnHeenJNTfyZbKldRTBeRmZPpYKH2k4mLM:4BeWTfyZbqdR1eCYQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623250567, "uuid": "57443aa6-791f-4f5a-8ec9-6b5e63af3aa1", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623250567, "uuid": "3e4c530d-bef5-41ab-af0c-cb0a57967b38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250567, "uuid": "46ef77ab-4c4d-4aba-8cad-1fb233f81f07", "value": "c89c05d0f2853fa30b535aa2544006e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9c5671d-c903-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1623230340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623230340, "uuid": "818f0f80-76a2-4b72-bb28-57b10cac6d68", "comment": "Malware payload (njrat)", "value": "abde9b8ab7e745c9362cd202d0211ef3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623230340, "uuid": "2c1cf0a2-c203-415c-97b1-c376e8e3d833", "comment": "Malware payload (njrat)", "value": "b3aad2ff8f877167a6ba3bed832724b96c27705851a39a7e190f2dedcda5825f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623230340, "uuid": "28e7fe6f-a984-4c0f-8352-6477efc70d20", "comment": "Malware payload (njrat)", "value": "7653f211389630e1fe890ba6249a350f16a48bff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623230340, "uuid": "3367e612-411c-45d2-b04f-531f0af06335", "comment": "Malware payload (njrat)", "value": "18e7514daee39df71833dd135ba386334e37d08963a9adc383d49507bf72fb68f718ade584ca893c7d32a02d4fdce8af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623230340, "uuid": "f835d940-6686-4d61-8fef-a7a3c11fe9b6", "value": "07D38C5277884362CD382DB5C0EB216513E2AFCB5A33E6853F4D97AD1D033B28E95B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623230340, "uuid": "2bee6bc2-1a39-42dd-8a2f-4b9b6429d2ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623230340, "uuid": "145126c1-55c6-447c-a617-8a6439d539d6", "value": "3072:TQEE9kJXh9nailmKcNjkXBCePDEgb+YPGXrerE:REWJR9tlJcNHgDnPGXKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623230340, "uuid": "8871483a-aa09-4834-8679-505844155ece", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623230340, "uuid": "47b6c941-4bc0-4e4c-9c62-c776df2fc3e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623230340, "uuid": "e2483b2a-57fa-4dfd-8bec-a531c807106e", "value": "abde9b8ab7e745c9362cd202d0211ef3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ff7441-c91b-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623240339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240339, "uuid": "9d30a077-63b6-4e6f-b7dc-40ba700451e7", "comment": "Malware payload (SnakeKeylogger)", "value": "5ef6708d657d269a9344ace2d90dec84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240339, "uuid": "10841c8e-89dc-4c3d-ba41-5ce0aac34a76", "comment": "Malware payload (SnakeKeylogger)", "value": "b4856be8a9819aeacfe55c1063fa15b6acbe2f9691131e9cb12bf846e175af13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240339, "uuid": "b747b173-39a1-42ce-9341-99ec656491e6", "comment": "Malware payload (SnakeKeylogger)", "value": "84f06e8eac68916f480bae6b7a93913c5dd0aa45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240339, "uuid": "d45432c9-2caa-44d8-a1e8-1c9c1ce46b89", "comment": "Malware payload (SnakeKeylogger)", "value": "1b70349cef80db8215368e6c9a1dcfa2ad42fa5d50b24f4528ed61e8267120cc1e0f8add252450332b39b1e06861667f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240339, "uuid": "adcb5819-cb86-4682-b67a-7f494e55f16f", "value": "75F4E0211748AB28E57FD779C061111483F4E913C323CA9EFDA598DE2E223C6C66FA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240339, "uuid": "d49f5692-4db5-4a43-a4f9-ab8124a14793", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240339, "uuid": "febe90ea-68e4-42a2-b3e8-dab0533e7cd0", "value": "12288:eJFQlMV40JLjXH8YuK2eTdKKILyQyPryKymqe2U/Yk:eJFQUpjX6xeTT/QQryKymKU/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623240339, "uuid": "7ca18cd7-f3b2-45e2-aa09-f8fd84f92b1d", "value": 736768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623240339, "uuid": "65395eba-3a35-49df-9a38-86cea38fde64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240339, "uuid": "31acf8e3-fea4-4447-b944-f104fddc1cad", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee5022e-c8f7-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623225248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225248, "uuid": "b61bdf24-9bc2-4e06-8ecb-8df4baafd1cf", "comment": "Malware payload (AsyncRAT)", "value": "ee6d2f06ce4476370cb830acb3890dca", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225248, "uuid": "7c251be2-54d4-440a-a6f9-0189c728bf2f", "comment": "Malware payload (AsyncRAT)", "value": "b51c07d9a4e50ac499514d378320260821bd7486acd1077a6bddf8ab70c6a2b3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225248, "uuid": "6de8f7ba-8ce8-43e8-88e9-1836d6645d1a", "comment": "Malware payload (AsyncRAT)", "value": "1c1544fbad9dc1abe6585e85ce686bba5f5e85a2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225248, "uuid": "e9b4f521-7704-46ef-b183-ee104e1c9deb", "comment": "Malware payload (AsyncRAT)", "value": "61d3c431c92f401c25d30601558dc60042d392a9f197e91a9aae14c28a5af675d733c7c087d4bbb4e326c9487b4ea24d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225248, "uuid": "01ea96b9-1678-4a98-ae85-55a4a48fd275", "value": "BF13C5A3B291D916C95907768CE7CAD26623BC51AF73938B3245F70E1F72AC08A03657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225248, "uuid": "05e2a0ce-92e6-4666-8432-5e3f68ca7f01", "value": "768:L77k3hbdlylKsgqopeJBWhZFGkE+cL2NdAJD+5HHUqCmTdSai/aFJnHKN+:v7k3hbdlylKsgqopeJBWhZFGkE+cL2Nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623225248, "uuid": "011d9532-f10f-40e6-b20c-c2c6fb90ea75", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623225248, "uuid": "2f1df5a9-b97a-4761-affc-7057b9f455b4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225248, "uuid": "35c1a3fc-8f90-4015-b19f-acb0fa515300", "value": "Doc2000120201.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ce1fb9-c91a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623240138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240138, "uuid": "28349757-0597-4518-a0f8-01c47be9ce94", "comment": "Malware payload (AgentTesla)", "value": "6e6ef72550b02dcfa7c1fe89b32dd63a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240138, "uuid": "e357d618-7bc3-4bfb-8d25-c2b9b6092073", "comment": "Malware payload (AgentTesla)", "value": "b693435c2e25b7487a709da8e4619aadd289f055f66e7c78bbd198925080434c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240138, "uuid": "7bb1ae79-2e3e-4efe-8572-616c19d5f049", "comment": "Malware payload (AgentTesla)", "value": "d33b49851e209b02e56780fe42f27958d21bd54c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240138, "uuid": "da30ec54-c41c-4b54-8a10-602c5ffaadf6", "comment": "Malware payload (AgentTesla)", "value": "a6a1974ff2fcce95e2b456dc643ffea3a2d5e1d2106bda2fd4b650e95985fb7e749c1c8a27e7253178925e36aab20cd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240138, "uuid": "069cd48f-80ad-4040-b266-09fcbeb5e8db", "value": "5425F6AC319075DEC467CD768AA82CA4EA6074775B0BD203901705EEAA2CF97DF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240138, "uuid": "1c998327-7b5e-44eb-bedb-020e0ed8c4ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240138, "uuid": "5d67d182-dcf5-4894-8b7e-8515dfa4bcb7", "value": "12288:SbQTt7D42PcDEZ7HNMf655GTvZbQaDdzBbDfwldAcb92XaZ9h1ZHTPk9PF6k/LJT:9TBDL2WOxcaDPPfwZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623240138, "uuid": "b75db8f4-bd2a-4e6b-a861-74fbb42a5ad8", "value": 997888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623240138, "uuid": "ed279b98-cb7c-4baa-ada6-ea62fdcd2a9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240138, "uuid": "c22c353c-25b0-4867-bc21-208e656ba837", "value": "Chinesse import-export customs regulation updated 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c3dbaa2-c956-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623265751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623265751, "uuid": "b58b3e63-ac07-4755-86e3-a884ff8f3db0", "comment": "Malware payload (AgentTesla)", "value": "012a51422994556bb61d7c5db88c9665", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623265751, "uuid": "68f52d2e-44e0-4878-b592-6cd215e90d5a", "comment": "Malware payload (AgentTesla)", "value": "b6ee611d5102474af00c6b53f17ca9060318c9a7061b69e958eeef41724fd62a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623265751, "uuid": "24a84ceb-7863-4824-84db-a19c4147a17f", "comment": "Malware payload (AgentTesla)", "value": "38342f0c4406bf487f92b8fc0920bc0a8ae979f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623265751, "uuid": "728c6a86-d4a8-4a0a-b579-16fbe8e4aad2", "comment": "Malware payload (AgentTesla)", "value": "ae5f32fd577bea344d130e4b7d0657b24f80068521f457cf94d61cbf7300718c9fb7f4781d0f9fb80fbc30c69655f14e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623265751, "uuid": "b285305e-c63e-4ba4-a2da-9c14f2f54d42", "value": "794549AC319075DEC467CD768AA81CA4EA606877570FD203A01712EE9A2DF97DF106F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623265751, "uuid": "586092c9-17cd-4e1d-b642-4f60ad0e3db5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623265751, "uuid": "caea7cf6-0a4b-44b6-b0b9-77ad0ebad760", "value": "24576:sBilGvLNxEy/AnNgfCiDT5fTxvm9I3mlasDK/0Q3:a7FYC5fThm9zl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623265751, "uuid": "1c394bcc-c34d-48db-aa7a-62ea413b9017", "value": 1259008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623265751, "uuid": "2f92ce00-9de1-4be7-ba56-85c503fde36e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623265751, "uuid": "a1656e9a-dedb-4dfc-b0f5-83d47abe6e55", "value": "bank TT slip pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ea8dfc-c8ea-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623219304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623219304, "uuid": "97d5b4dc-4ad5-4a88-b657-19a9974c1c27", "comment": "Malware payload (AgentTesla)", "value": "8e244a30db4f13b3c7ade1b5373995a6", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623219304, "uuid": "ffa83edc-88ee-4b4c-ba26-a2a3a4ac513e", "comment": "Malware payload (AgentTesla)", "value": "ba0083d512b563b83f2ebb09a124c41bb42ba9fb92490e8efec111037e4171b5", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623219304, "uuid": "39893af0-e1ed-468c-a84b-93455a2e44f5", "comment": "Malware payload (AgentTesla)", "value": "045336fcb60af32d49e3fca8ce8f6b4906f50a1d", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623219304, "uuid": "49465ab9-7ed3-4764-bbf9-e3d442ac06a3", "comment": "Malware payload (AgentTesla)", "value": "a3e9bf659ab8a2bb4fcb11eaa7894616c6932e7ef407f477a513dd7847efc7f600676d49fdc01f3337d98ba4241d0360", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623219304, "uuid": "16ed8f29-c40f-423d-92cd-97a3f2052776", "value": "B8F4E025224C8A55E17E9336A0B1110443F0F547E722EA4DFEDC58DA2FA37C2A36FA57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623219304, "uuid": "d8cddec1-2934-4c34-9f61-89623ad55265", "value": "12288:yyUkX15t7PvH8bFvfsujwF3HlMV40JllefiJlY9jkMyVCcCLl4+8Qo7WdvnaCU:y/v4F3HUSirYRuvCRL8Qoyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623219304, "uuid": "66c99768-8cc8-4566-9d5d-2d97394f9e9b", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623219304, "uuid": "0fbc418a-e3f3-4057-bd0a-3c7b764c1d67", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623219304, "uuid": "c2ad5f20-b9c2-45c7-a381-5696569dffff", "value": "Bank TT Copy.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13fae38-c90c-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623234218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623234218, "uuid": "8233befa-78e9-40c0-bcc3-9c17caf354a7", "comment": "Malware payload (NanoCore)", "value": "372a0f073e924d0411a1fb660840a4cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623234218, "uuid": "8c9d64e0-d4dd-4845-b901-df6f583cd18a", "comment": "Malware payload (NanoCore)", "value": "babc65e527c875dbdd52604ef5ff4d2549958aaa59807a513d9008734754198c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623234218, "uuid": "55fc73e7-456c-4e6b-9789-e8c5b5dee115", "comment": "Malware payload (NanoCore)", "value": "4d7784beff50b79d456d7d18eeddf8fbaf66afb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623234218, "uuid": "f8af518b-a43c-4401-a7b4-4713de1abeab", "comment": "Malware payload (NanoCore)", "value": "1fe5014622f294ae488559e4a0fbd7873d6407759ad57727f796c621dc38ba99441b809f9db61d8444bee70c9b29f760", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623234218, "uuid": "61e5d624-5eb1-46e3-9914-bd3d1b2c5124", "value": "8215AD2322CC5AD5D07D57B59C61F60C83F8AD12D222DE48FDA4F98A1C3228295FB57E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623234218, "uuid": "ffeb6f92-92d0-4676-a119-1f69a726afa8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623234218, "uuid": "e360a8df-c854-420b-a41a-59ab128b1a28", "value": "12288:LSZ+XlMV40XINxqkNgCrmpa5aFW5JV9JINdEW0YjrzzyKVfUhweevXTxh:LSZ+XUuqGmpjF8JV9JINSUjrzjUueeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623234218, "uuid": "e0dfab4e-bf21-4aec-8166-257d0052ab16", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623234218, "uuid": "4c15fd67-8509-4f83-84ac-db7addad3229", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623234218, "uuid": "98114f3f-e28a-45e1-beb6-a674835ca37a", "value": "InvoicePOzGlybgcIc1vHasG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b7dfdc-c965-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623272258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623272258, "uuid": "d655f119-bc49-488a-8202-2f56b10e7cad", "comment": "Malware payload", "value": "345117dc6b1f6d8aebfafd1599741701", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623272258, "uuid": "1fa624e0-7e27-4196-998f-28438924d980", "comment": "Malware payload", "value": "bb8b5c172c6f3488c24d9bfdcb00a75ec7f3b611f2940806bac2a1b438099c71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623272258, "uuid": "0d649ca8-26af-41d1-858a-7f038ee761a6", "comment": "Malware payload", "value": "32e8627a9e9cdef2839e2095de34f6b253b740a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623272258, "uuid": "0befa1f4-5ad2-4f20-b4a1-60ba50bc8ed2", "comment": "Malware payload", "value": "3429942f5217045fe58602321c1ddd23f64123e20a8e4a7336ab56021da23503e61ee542055af84a4791b18c232c3d57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623272258, "uuid": "d070f73b-9a45-4220-8f00-316865096fb6", "value": "E7935B3D73AC9E15E27D0AB9B57112A543F1E0DE1111EF8B8EC074EE2E667C11A189E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623272258, "uuid": "cacdc667-0bca-4011-a4f1-35fa172161fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623272258, "uuid": "a182f6ac-57e7-4b89-835c-c0e47ffb01ef", "value": "1536:iD5OnOE5vO40Sjn8yl+4HNmDR2D8F3l/tny97m9bPLbY3FH0XyFJdBBSx1EvJk:iDAlO/oljowohl/ty97mNyFHSyndX3vG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623272258, "uuid": "ff5df7a2-e3f4-4b00-9c56-c4e995427149", "value": 97280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623272258, "uuid": "d85869f0-381c-44dd-a48c-49c41e34214c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623272258, "uuid": "b8742b13-1860-4c5e-85a8-db177b262a9d", "value": "Sneakers.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d897bbb1-c953-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623264751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623264751, "uuid": "1ea492a5-e458-4ddf-91ad-bd56342dca44", "comment": "Malware payload", "value": "3d7f01b8215fb447a4786b40f937229c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623264751, "uuid": "b1049258-1995-4053-a3ca-5a13db5c2f05", "comment": "Malware payload", "value": "bea4b9483f25ce74c1116e05cc655c4735bf33ef90ded340c56e55218c26b0e7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623264751, "uuid": "59a69257-3f86-4eed-8e42-c503a3d0de0b", "comment": "Malware payload", "value": "694ecc170b043fe3bcca0e79f93221046685b49c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623264751, "uuid": "3614ecf3-1ccd-41d8-9874-3648b7cecf4d", "comment": "Malware payload", "value": "62a30e9d1bebf66bfb39de3fee7930084c68d8258232204957e4ce1c1b75ef7e543164bb3456b173cb5f8799e665a33e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623264751, "uuid": "833b20ee-551e-4ce6-9cfd-9ceac15f3be0", "value": "90F4AD0179C5D032D13215325E55F2F11BAEBC300E245AAF77D82EBFAF786824A2576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623264751, "uuid": "5198beaf-01a8-4935-acd9-b83e239a4c30", "value": "6cd1f53d4cae43713389ad164e50d9b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623264751, "uuid": "0a12e8dc-74e9-4f7c-88f9-738997df2a88", "value": "12288:PGSo5NbVfaqzIIjF70wfPcS8jRjfcnbKIalaiSZ+P56IRmAAHtdGNLWdzriRHoc9:PGSo3bVCqzIIjF70wncTjRDcnbTaWIg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623264751, "uuid": "5c3e30ef-69a4-400c-897d-99f8c8a4554f", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623264751, "uuid": "961dba2e-5b77-47fd-9ece-287ccb18014b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623264751, "uuid": "1b4187a5-2f78-4ae0-af80-67653d472d35", "value": "Ivan.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ad8fda-c928-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623246253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623246253, "uuid": "4dc9704a-a3f5-4e05-94bc-1dbd08e45c89", "comment": "Malware payload (Formbook)", "value": "4bf290783f7ef4353baccc6dc17d6704", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623246253, "uuid": "2354f936-75f7-4215-8801-54ec23586a65", "comment": "Malware payload (Formbook)", "value": "bf299d24600936c9f0f4da127632a2a28c4f5243c23a87ee11a6a96b4d7727a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623246253, "uuid": "fae15205-289f-442f-a28e-683e9926dd31", "comment": "Malware payload (Formbook)", "value": "3bcb216a071185251456f0deba1c7771ace92975", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623246253, "uuid": "0b16ab69-8e8e-4952-9cbc-fdada8d228ae", "comment": "Malware payload (Formbook)", "value": "0c78f293a6e273662ca0ccb8a66cb635a3a73e88f8fcd7f447a14153417f45567f53c9a9875a746a7a26ff5a4564a971", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623246253, "uuid": "e1b1dd56-a919-47b3-af7d-b585400e586f", "value": "03F4E02517489F28E5BF877A80A1501487F4E503C323DACDFDA5889D3E223C6D7AFA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623246253, "uuid": "41e5e91b-52f0-4539-8be0-015bc68b184b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623246253, "uuid": "7d4eb960-b06a-48e1-836d-8ed0ec1ede8b", "value": "12288:U+8QlMV40JhVV1LqiIuNabDHvSGm6XtL1bVM3xEtt0OPSev:U+8QUvrhqdEUTmGRpqa/PSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623246253, "uuid": "85354557-d9a4-43ba-b276-05b2272f99aa", "value": 735744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623246253, "uuid": "9a626428-5dfc-4ba4-b4c0-4f044bd7777c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623246253, "uuid": "d90c86e1-0dec-48b2-b366-fc82315deecc", "value": "New Purchase Order20210609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecd5f89-c8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623217490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217490, "uuid": "39130d44-d219-42d5-90c8-22b434978795", "comment": "Malware payload (AgentTesla)", "value": "96517dabca465b10969d394a98dc5952", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217490, "uuid": "148afbf4-4f07-4d59-abfd-e4140eda89ee", "comment": "Malware payload (AgentTesla)", "value": "bf34fa3c5af0d5c9016ed0875a716a7dee35b6bac88ff33cf9bb6dbf67c0af91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217490, "uuid": "c697a696-ea7d-49a8-8021-fc0794755bcf", "comment": "Malware payload (AgentTesla)", "value": "903ae906b86a3bf22c636bc98dcf24a0cecc0076", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217490, "uuid": "43ca7a3b-41dd-4057-9e61-6619ba693bec", "comment": "Malware payload (AgentTesla)", "value": "7bd02459176a72823d8c0fa485e02c65abdd6d373d6662a6b314ddf964365a53fc4a6d5b7427ab5a527b9f3b6ab092ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217490, "uuid": "b61a0b3a-7ef9-4227-8ca5-a564dcdcd531", "value": "D9150FB4702EC61CC8A0F5BDA180F885323BC76A74660ABEF57CD67525D58FEC1A894C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217490, "uuid": "d9a0ba01-aef1-4acd-9b9f-f7d0bac2a0f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217490, "uuid": "d4d96782-4f58-4ce7-b9e8-a7feb136b862", "value": "12288:VR2IG1FPorDdYU99x56WmjWhPUXOK/iRMIVhErxD5E8U3SHWnuv36wSS9mdgnE5X:+z//cCrLDP6Lxy2sj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217490, "uuid": "adb906b5-ebbd-437f-a186-8e9fb857e444", "value": 937224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217490, "uuid": "e2ae26a3-c2e5-4537-b059-053a985a3f9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217490, "uuid": "f22aaa6c-492d-4afc-82d4-600cbae2e970", "value": "CCSX09B00730_drw-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8749619d-c935-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1623251730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251730, "uuid": "5d7b19f6-543c-4cea-8ea7-c8585eaa842a", "comment": "Malware payload (ArkeiStealer)", "value": "5cd48d56c69f4fa2f560f2df7f8eb110", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251730, "uuid": "7baed069-3889-41bd-8a6e-dd38ba186526", "comment": "Malware payload (ArkeiStealer)", "value": "bf54a62cb9f9b1f1649ca279f20b14e78f7d311772f74511957b25c8597d857b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251730, "uuid": "97f71cfc-4986-40ae-b5ca-e92b9a7f6ef8", "comment": "Malware payload (ArkeiStealer)", "value": "029f619decae29fbb138ce6480ff40a2fe1b8614", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251730, "uuid": "e17007b6-ee8b-456e-afff-2f1f400c398f", "comment": "Malware payload (ArkeiStealer)", "value": "840d3def31d4698e0eab7c6aa59ba7dc165f16b8d2081e3ca8882fea86ff7638ab24c7ab568fad746d505dc5ba3540e8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251730, "uuid": "19561b57-51a1-49da-b806-2b782f08c2f0", "value": "DD0501006BE0C038F2F716F55A799769A92F3AB1677442CF22E556EA5B38AD0DC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251730, "uuid": "1606ef27-eea3-483a-a7e9-87eec26da498", "value": "c2b6debfb2dc5536955a66c0d2d22e05", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251730, "uuid": "aac23870-c9fa-43ec-8a8f-a9363251f76b", "value": "12288:04XqrIWvnlYnBYbxalCSAzryvuZDop7YT6DeCFOBqcwBCsk2TdijixnBEf+KylMB:ASBxvU27jwqbBNZhij+OmJMB+Bvock/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623251730, "uuid": "1131513c-ff66-4930-850e-ee5d418de668", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623251730, "uuid": "81bdadc4-43fa-4b08-b225-237c66f9ef61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251730, "uuid": "ee080b97-428b-49f1-8168-74325962c62a", "value": "5cd48d56c69f4fa2f560f2df7f8eb110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34d45f1b-c932-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623250303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250303, "uuid": "cc4dbb9e-9455-42aa-8fd6-839014aa728d", "comment": "Malware payload", "value": "d350346b22f5c0831723fa5ae916890b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250303, "uuid": "f38556eb-1625-4405-a1fb-c17a0eecd301", "comment": "Malware payload", "value": "c48e509f7139d0ee5a09d1807e73783e0948741c6f90f1dbc8096318e7d6dd3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250303, "uuid": "869ebd34-f4b2-4557-bb59-1fe308f03f01", "comment": "Malware payload", "value": "2a091b127b7a0ea335f4423030fedf649027f139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250303, "uuid": "b393d09e-39ab-49f6-8d72-43ced34a1324", "comment": "Malware payload", "value": "c0cf1b0a21fe024e8ab4fe12c7a7ec05cbf2cd1fd812b317a4b1643e9e5c54bd63e60a567489e326e638dcad3211ded0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250303, "uuid": "164e8343-7ae9-42df-a8bc-7759958bfde2", "value": "2E130965579D9C82DA5242B9C4E66B20C6B5933053A3C787370C3E4BBFD0E4B6A06BF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250303, "uuid": "426a955d-ecd4-4eaa-a947-b87180432ce0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250303, "uuid": "c94ab271-d9f8-46cc-a4a0-3b3ebe966875", "value": "768:kw2eMe/yb9VA72aUDDxqXpxDu8WQ8iBqsJzS3L:kTeMue9ZxqZ1WQ8F7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623250303, "uuid": "8b89fa97-b984-401f-8fd0-e5ab300a0e9e", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623250303, "uuid": "bad7104a-6e8a-4567-b374-509a700bad45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250303, "uuid": "5249b725-db2e-4b7d-bbd3-3064d233024e", "value": "SecuriteInfo.com.Trojan.MulDrop17.50581.24010.2253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2864517d-c92d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623248135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248135, "uuid": "baa37c3f-1f12-4f7d-8bd3-248f8e2bd56a", "comment": "Malware payload (AgentTesla)", "value": "a878c5b06e4b276899e1e9397422007b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248135, "uuid": "519bd996-77f2-4747-9bc2-58a0b2bea081", "comment": "Malware payload (AgentTesla)", "value": "c5908d00b5b5f8cf9ceb036959a9761ada0511033c3e1f6ad54936d75bb0ca20", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248135, "uuid": "c97c0f84-b1c0-4d6e-bbb6-2e72d9e23636", "comment": "Malware payload (AgentTesla)", "value": "7fa408d279baf724c98f16a882e5dca3dc017778", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248135, "uuid": "d5ba24a8-c66a-40d9-a4d5-215ee1f98c3b", "comment": "Malware payload (AgentTesla)", "value": "95de1cdd8d8241ba65605e882cf810890b674b47450b1deac2129e94c57469e061c981659cbc67652c35954e55a8ae1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248135, "uuid": "c79dc362-682a-4da3-9dd1-9285600c43b1", "value": "31F4E02517089B28E17F93BAC4A5011487F5F503C322DA8EFDA5C8DD2E223C6D76FA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248135, "uuid": "72f36590-55ff-4309-89a2-187b2b85f171", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248135, "uuid": "f5c76020-ed66-422a-8a85-9652317eb00d", "value": "12288:CJ01lMV40JKf+xsSrnhRuxc2UhHSQ5q7YoRg5IS2/NeoQ6vRm45Y1tiv:CJ01Uu+dCxnQ5CYoR4CFeuvF5Ybi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623248135, "uuid": "cf27f40c-1261-449f-ae76-64951e62bdca", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623248135, "uuid": "8467ae27-ba5e-4fe7-bee9-f2f8f553861e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248135, "uuid": "8d4f003c-4443-4f08-8d3f-3dc6b8345443", "value": "G8mumaTxk5kFdBG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f44aca-c8e8-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623218440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218440, "uuid": "a52b51e5-8f62-41a1-a8d3-a49f273ddded", "comment": "Malware payload (RedLineStealer)", "value": "84482ccc25d8732c2a33b2e731f53368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218440, "uuid": "71350fe2-9ce6-4ac8-975b-4cf1ea9c93e8", "comment": "Malware payload (RedLineStealer)", "value": "c8cbc34e33ac2d253932ce0767a96d461b40e70c0dc1dd0e1ac386d262328fa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218440, "uuid": "be3a2b7c-5cf9-4439-bd2c-dbc3470633aa", "comment": "Malware payload (RedLineStealer)", "value": "24668ee2537bc9a1130a39a57a6905a3b2ef4542", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218440, "uuid": "1df65345-1ebb-49d2-8b60-ef7a19a2b88b", "comment": "Malware payload (RedLineStealer)", "value": "8f6dc90005d467efbf654341e8b81b38f6bdb6e52b807750bce500e40ff015bf3972e06ad1f0c9d360d7e4ee34c800ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218440, "uuid": "8b5ed25a-e639-467e-aa41-ea0dd63c7741", "value": "79749E00A7B0C039F6F356F45B7692F8A93E79B1673490CF12D526EA5A34AE0AC31717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218440, "uuid": "2235680f-9380-419e-8602-01fe8d267518", "value": "6b67c02601b2c0552b5d5c2fd43344bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218440, "uuid": "a14f1ef1-8b6f-4136-9966-755fc89f2c08", "value": "6144:P0qy7ZRO1WzS+GHeAPRwNBxcHZjbtNWtvFWoundc6sP:PLy7ZROIS+GHbZwNByHZlQtpBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218440, "uuid": "71de0575-453f-48ea-9f52-5e8fd7e3652e", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218440, "uuid": "e87237b7-717c-432b-870b-22b3a22d16cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218440, "uuid": "c520c725-24da-4ede-8ff6-f53188378e25", "value": "84482ccc25d8732c2a33b2e731f53368.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80902c98-c93d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623255155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623255155, "uuid": "f8e24c1c-11ad-4f71-854c-8c2b5f6d4195", "comment": "Malware payload (AgentTesla)", "value": "fcc97fda1dd765bd785799f6be008b30", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623255155, "uuid": "c4ebcd2e-81b4-46c1-a74b-951fc03e65ba", "comment": "Malware payload (AgentTesla)", "value": "c8d062b3595562cdcaf7cf2248be18b5361830347d9fe0f68eed823156101a7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623255155, "uuid": "f056a74f-4c9f-4c32-8842-cd06f759152c", "comment": "Malware payload (AgentTesla)", "value": "8b6d1de440c1705baa1a4f481bbe1180d1b41c59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623255155, "uuid": "56f7a36e-5980-4dad-a287-c2a4ed917721", "comment": "Malware payload (AgentTesla)", "value": "b1236dc1f3bb1359d4793aa0301ed370f688f66fb25aef7c30093d14a383018d760bb50fa7e5d9a2f8931be3fb933a05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623255155, "uuid": "8322418f-2b8d-4ac0-b417-5a038bd4ff56", "value": "D4F4332D68DDF60C25FA1DF4A59250E21DF1DABBD47E424323862EDF2F962CE9A05C01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623255155, "uuid": "276e09b2-1609-4c5c-b103-30551e7db800", "value": "12288:YvkXdUwhSrVPNMze90x5O1eo2ccOFEQm6gT4EhnmCeXfezo/IeXKnkB7x+z/BBt4:i0qrdNMy90x5O1h2lOFEQm6gT4qmXWzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623255155, "uuid": "4d59f283-d2d3-4001-b627-aaa924140e79", "value": 750344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623255155, "uuid": "c2779f5f-b301-47be-82ee-325218d6dded", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623255155, "uuid": "b1718670-4724-495f-97dc-fb0123ba8f7f", "value": "PURCHASE ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b2a67e-c8de-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623214197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623214197, "uuid": "0cbc3a87-e517-48e7-ac0f-73458cf2fa2c", "comment": "Malware payload (Formbook)", "value": "2a42c97cfa40bb431d835ca585bf3bd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623214197, "uuid": "ce9475ff-fc19-4c6e-b68d-39199dda717b", "comment": "Malware payload (Formbook)", "value": "c96cb19ea3541a6591f2be3cfe048a63b84fcd538f023144df86694a34d06934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623214197, "uuid": "5ab0e32b-dec0-4f61-9f0d-a48bf504ed8f", "comment": "Malware payload (Formbook)", "value": "499bedc56d7506abe8235a83907fba3752520010", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623214197, "uuid": "9ed57258-0ffa-4726-b006-d4fd505f488e", "comment": "Malware payload (Formbook)", "value": "70cef7b4b096e3eb79ef575172ace2783fe4256398fe05252b0736d1375df9a32b62ab427341c769d946fc5470b77aa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623214197, "uuid": "2bff9a10-c82f-4500-bf6c-2437f36fd1e1", "value": "13F4E03517488A50E1BF8336A0B1550443F4F507E322EE4DFEE858DA2EA27C2E76F656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623214197, "uuid": "06de91c1-fc24-4206-8109-19a97d425b7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623214197, "uuid": "7c500b59-b2c3-4432-aafd-b9ead73f9e87", "value": "12288:yHk+m15tOPvHPsvadflMV40JlRrjMPdZ8UQQp+S/TuMWlREuVsOFkEWK2/g:yfMadfUfRradZ8GpF/ToEuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623214197, "uuid": "d5716204-da51-45a2-bc4f-8908b20e6a08", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623214197, "uuid": "24585735-2af4-4984-8964-6de3053538be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623214197, "uuid": "5348918d-4921-4e37-bafd-56cd7440623a", "value": "SecuriteInfo.com.Variant.Bulz.341181.29867.9465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8648ee2e-c922-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1623243568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243568, "uuid": "162fb849-5339-4808-9aaa-13b51997d56b", "comment": "Malware payload (AZORult)", "value": "5bf02cc35236c071ddc613c9f8e2e3e0", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243568, "uuid": "a9272c42-ac10-47a7-bdc9-7ab4642d50c3", "comment": "Malware payload (AZORult)", "value": "c9b953819c70ac96f71263660fc31b2ade6faedf1525df3ec4263a6ac625563c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243568, "uuid": "07cdb1ab-2823-483b-b881-93a76c34b2c3", "comment": "Malware payload (AZORult)", "value": "b69843e1c1dad4a134c87370fd6d101d2bde33a8", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243568, "uuid": "8ab09f66-1178-4c04-954c-542cd4db9b02", "comment": "Malware payload (AZORult)", "value": "011a1019676af4b1d6005ccbac2cee6e97c44394a29e7433d1524f21842ca2c5f6ac4c79a2277c8db4992946550a76f3", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243568, "uuid": "b8626e58-1415-4f60-85f1-9c45f718e29e", "value": "7C14122BA7E6856FF08306300B705FBDF776E55A58BA3617436C0EAB3E235D74822641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243568, "uuid": "3f181213-cb94-4e22-9a0b-40a08b0d3f9a", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243568, "uuid": "62e80fdf-eeea-4e07-8b20-670322ca3509", "value": "3072:JS8BCfoDaXJnM7RsCgsaAce9LDXNrWWD4EDVLXOFa2UVeR8MAyi4s8cx5pgpk3:JPB6W7usagpNrW+VLP2FYX8c1QO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623243568, "uuid": "4f7ef7b9-e07a-4253-ad3f-ee01bd874858", "value": 191360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623243568, "uuid": "66159cfd-ad53-4579-8624-6942c2e9fa57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243568, "uuid": "63ccd44b-0b53-4917-b301-2746b35f8a98", "value": "24220216495_20210607_16374513_HesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93986e0e-c94c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623261629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623261629, "uuid": "6ea02067-119d-4d76-b692-0880cc8d7e1f", "comment": "Malware payload (AgentTesla)", "value": "85b8244121b53f69b9c00410c0cbb4f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623261629, "uuid": "125bcf71-6bda-4ea9-b96f-13cc13811a57", "comment": "Malware payload (AgentTesla)", "value": "cadf8b35e70d4c8b4fdadf65f6cbfddce7ad4e0319ceff8bd68101db962f9395", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623261629, "uuid": "f2570c22-8acf-43a7-ba67-f1fec6e2b0a8", "comment": "Malware payload (AgentTesla)", "value": "88d20e57cc24e2189eb54476f0d76759e115e8a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623261629, "uuid": "af68f611-1b15-4605-b841-437e51d0fea1", "comment": "Malware payload (AgentTesla)", "value": "9ca6a1406bbe90ac3dc25274ff5ecde4973f377959e26db9620c3d6abca79c9e83455b71b652fe19be1cbbdfd5f4b0f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623261629, "uuid": "2fb7dece-f3a5-4683-8310-e798bde272b5", "value": "0C25F6AC31A075DEC467CE768AA82CA4EA617477570BD203901705EDAA1CF97DF206F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623261629, "uuid": "6715e3e0-1e1d-4c8a-a7bc-8aa64d8c6b2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623261629, "uuid": "13de681e-2ca9-4b28-9d72-ccf2790b3004", "value": "12288:YPlGZU7w0VrkkGELScuKqEa1DefxLU1N29RL3XD91kKX9j/K0/bvhx1pWqwyJwfb:YP/MOeELHapud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623261629, "uuid": "f47b77cd-4eb3-4b4a-bd6c-d79bc4efa80d", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623261629, "uuid": "596d7ded-6fd2-4ff7-8a3d-fb402578acb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623261629, "uuid": "057766b5-bb49-49e4-a739-cd7088e5a372", "value": "SecuriteInfo.com.Variant.Bulz.508094.29431.22440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30464a77-c92f-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623249007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623249007, "uuid": "4887f0a3-3b53-40d4-8511-e0ce72c8e638", "comment": "Malware payload (Loki)", "value": "fed69be98b804cf78ea42ed4c4d8cd21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623249007, "uuid": "9bf34716-077d-45d7-b6d6-505c2f17e234", "comment": "Malware payload (Loki)", "value": "cca420691dab75ec42400b9c15d2ca037361c29d4660da0bf70a4cf499cffb8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623249007, "uuid": "00d55cbb-948b-4852-8fbe-976e5549e777", "comment": "Malware payload (Loki)", "value": "63d7c21fcf7c079ef008956979a5e05254e241fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623249007, "uuid": "506e5075-a963-4fdf-b117-1ad56a179155", "comment": "Malware payload (Loki)", "value": "bd71b08fcda4e69a3cd73e82eab28bc1bc549483b90f881ea2787e45c0561e32bdee9d542af4fc24e7383b7666724c37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623249007, "uuid": "ebfd925d-e57f-4636-a3f9-21e40c2a1d4b", "value": "C444024354AC9181F6B556BECC23EB3482996C3698F1A7DF7BCA7382DF726D19223140", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623249007, "uuid": "21e5ba89-fcc3-48e2-8c7d-539c8ea8fdd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623249007, "uuid": "d8e62b69-a92e-4df3-a2c0-31443935f59c", "value": "6144:NZLIHrL8LrKPqlLzXr7shNGgMK42hTetHAgBS8:NJqr+WCl3r7sT/MKyHAgBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623249007, "uuid": "706224ac-b7ff-4964-b02b-f7581b62af84", "value": 276992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623249007, "uuid": "9b42053f-b651-441e-a092-d44c8ae73910", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623249007, "uuid": "ad4922e0-3d3b-45b2-943a-4f132da34b93", "value": "ODC18523669120PK.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e55ac5d-c8e8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623218644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218644, "uuid": "421a81bd-0c95-47be-b882-21c25b45e65d", "comment": "Malware payload (AgentTesla)", "value": "eeb921c4968ce94b853986c2157ddba5", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218644, "uuid": "2b62730b-d205-48be-9646-e4d5f8db9d65", "comment": "Malware payload (AgentTesla)", "value": "ccaf0ffdf34b0ba7b1d23643c2ebccf38aadfba5531ee170b39649f87e19be4a", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218644, "uuid": "a46c87fc-125d-4794-ba91-187cfef1c6fd", "comment": "Malware payload (AgentTesla)", "value": "11b3e4bdff3db32faf677123bad57b4ff0c762bb", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218644, "uuid": "f5170ea1-e020-46a5-be5e-d6d4daaf1f2f", "comment": "Malware payload (AgentTesla)", "value": "dc4c7003e968b81ccbea2e9fb57d8fdcde1c46d2b70a1ba5aaa21167335f3279b1d2ae319313d8e58ade316fb7905941", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218644, "uuid": "75c5901f-3b03-47b8-81a1-3d4d8b3a2b17", "value": "DED423B84699E06A4DF3C4BE75926C0CF25D60458FBE4715F51F0E582A90FAD0BF08AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218644, "uuid": "21c44d54-f76c-4694-8495-e2844705f432", "value": "12288:hWPrlQooyLs+JzHERDx7hPA5Q/bzivRMbbupS+qbtR52N:EPrGos+QRlhPAmbzivabbupZqT52N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218644, "uuid": "0d480f1d-1307-4efb-affb-8ddbbccb0817", "value": 615258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218644, "uuid": "404b555d-c853-4d7f-888e-cb4ab48433ed", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218644, "uuid": "bc215aff-2329-419d-bac0-f3997dde2247", "value": "COMPANY DOCUMENTS.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fbc53e-c8f2-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623223133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623223133, "uuid": "6020fce5-0e08-40f7-8f61-d1b7cce68a21", "comment": "Malware payload (AsyncRAT)", "value": "4b28814eb8a1d4e18e4320601eb5ec5d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623223133, "uuid": "a053ac46-b9c1-4287-aa78-94b191d31f52", "comment": "Malware payload (AsyncRAT)", "value": "cce53a67bb01a8f71b21fbdbf1b8a32345d81bbec12df26d776a745c64d783cd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623223133, "uuid": "de3b252b-ba63-4a3f-8f28-96425978c1bb", "comment": "Malware payload (AsyncRAT)", "value": "54295aebf91619c97aa5ca2f74e9f8474c066de4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623223133, "uuid": "7193d924-d92c-4435-a33f-ff473626b879", "comment": "Malware payload (AsyncRAT)", "value": "1bb6a5d28bf2fddd2fa75f5cfe4c38065534acb0821ac5cf461a2b8039e377a289df903f569606c993eab0fd05d1092f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623223133, "uuid": "571c2bd1-b6d2-4249-918d-12f3ad695062", "value": "D5C4AE5575F9AFA2C136C7F5161011959FFA962AB9EEF2080CC6E0DEA470F018E80F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623223133, "uuid": "74c83d3c-db08-4f31-9746-9c5c13ae9f56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623223133, "uuid": "fc0656c7-37b6-4554-b004-69728d886637", "value": "6144:fwtl8je0NSpME5ujj09hvyJV6t/bmEYwsYxZg1mHirHA:ItlNhpMuw06JSYxYUmHirg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623223133, "uuid": "e4598ef3-ce3c-4d10-abfb-1c752034a62c", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623223133, "uuid": "34007dfc-c79e-4bcd-a785-1fb389d732b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623223133, "uuid": "e8a8cac5-55d5-42f3-adb6-55588af35ae8", "value": "cce53a67bb01a8f71b21fbdbf1b8a32345d81bbec12df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741bcfa9-c922-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623243537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243537, "uuid": "f30c7e3f-2c4f-4b25-9d25-98be9dade846", "comment": "Malware payload (AgentTesla)", "value": "43a4559bd2a691156420a1fc69c07dd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243537, "uuid": "de2e2022-09d4-4dca-a510-9236c82cd2c7", "comment": "Malware payload (AgentTesla)", "value": "cd39caf7a8e34a6f771e0461e5ecb7ff3d74bed797ceba7bfb8ee391bcc5563a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243537, "uuid": "f19fb4b5-08a1-476e-9a70-55042b460213", "comment": "Malware payload (AgentTesla)", "value": "f02401023462c2999c0853526bc1e14e54ad836e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243537, "uuid": "d5cff21e-4e7b-45a1-a686-65bb83f2a237", "comment": "Malware payload (AgentTesla)", "value": "9346aa23450c336139888fe2c47c16563dba2e8382fd61969f28d18158186fd168c3b22ef4ae8319536ba4ceb3b32230", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243537, "uuid": "b8ecb79d-109d-49f9-839d-085f958bb54d", "value": "8C15CF12B6B5DE23C3F925BBC48A30184FBD9E4229B2FB54798D7188FDB3A52D8015C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243537, "uuid": "f903471f-969a-40a3-aafb-734dfc6245db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243537, "uuid": "5f7f7a1d-e14a-4f57-9a3b-8ba3e2773ff6", "value": "24576:5HUVYtXiZrqOCweFUkFzLUgu2ir3Lvk3mlRn:hUYtXiZ/7eFUkFdinvkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623243537, "uuid": "a1a45e51-c3f4-4c08-8fe0-8839e46c241a", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623243537, "uuid": "e1552cfb-9ca5-4cd7-8704-ec59ef0743a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243537, "uuid": "92386db0-74e0-4a0c-b02f-fb6c800276ec", "value": "LPO_2550120.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f36c9e0-c975-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623279124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623279124, "uuid": "1847bcf1-d5ad-4b91-8301-3a16d78bf030", "comment": "Malware payload", "value": "b8eb5ee73ced7f4a535c4da5cb36a737", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623279124, "uuid": "bccea1a0-d5ad-4cf5-8bca-d37ca5b131de", "comment": "Malware payload", "value": "ce10ba646288c5d971b29dea47dddf38a2ed848ffd9e734c02e17a9cc5fc6055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623279124, "uuid": "c67e2d62-8fa2-4f30-a6d8-d16c1c6a5ad3", "comment": "Malware payload", "value": "e9b716a119c02018870de035cc859cdc663d4fd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623279124, "uuid": "a72e14ef-ae25-406f-a9c2-cdc79e474036", "comment": "Malware payload", "value": "0de96f8b12b3db76f68f3e370cecb71d5d4c47d0cc3b786e2f5fe82b0aa59a6319afe8baf973bd32fbafabb2e3cdb863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623279124, "uuid": "c15bb1a1-9e37-47f3-8b17-4efff7bcb3b1", "value": "83C49E1238E180B7C79381304EF6E7B6E6BBE8600B274A435750BF1C5E349D9AB2E559", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623279124, "uuid": "8e2b5283-ac7a-4a50-a73b-0b802507e10e", "value": "2f1d3b096ce4c20b15cc60b0dbf40e59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623279124, "uuid": "69cbc7f6-f0d2-4139-acaf-731c2063b4ba", "value": "3072:bezr5TVdaytLcU298jbrOyT2gtP3w3JdcOktmQBZUnKE/258R/G9JBRgKsCTEsW1:M5WytLcWjbi+nIgFBZtMR/GcKlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623279124, "uuid": "320bd0cd-80a6-4f5f-a3f3-37a51febec75", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623279124, "uuid": "b6fc607e-4df5-4994-8db6-613ba8484851", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623279124, "uuid": "12c601bb-15da-4ad6-9483-4a8586db7b47", "value": "40\u540d\u7537\u5973\u96c6\u4f53\u5f00\u623f\u88ab\u6293\uff0c\u9690\u85cf\u6444\u50cf\u5934\u66dd\u5149\u5185\u5bb9.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c9f7d2-c954-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623264966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623264966, "uuid": "750b9130-dc17-447d-b199-1f1c77ed19d0", "comment": "Malware payload (RedLineStealer)", "value": "5fb2367e126c51efe76c11d70e7f54b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623264966, "uuid": "b032d20f-9eba-4089-aac0-8e1c0a78ec2f", "comment": "Malware payload (RedLineStealer)", "value": "cec06ee6b4ce08a5597b0ad5e5adaa1f94fd743d9cd5c9f627603b2bd16dc6f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623264966, "uuid": "f3984cc2-8f37-4747-8af0-5284788edc2f", "comment": "Malware payload (RedLineStealer)", "value": "42af06307d49c1eaa522736045e435ac65789899", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623264966, "uuid": "cb36b597-d6d9-429a-aa3f-452f0a12f422", "comment": "Malware payload (RedLineStealer)", "value": "96e6b1f63e9cfccbe8acd47a8b2b6664f4f6fecd71e6b5c08a69e7fdfc77e093078ff1898ee731b051edc2f52b0dba14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623264966, "uuid": "25b93472-94a1-409b-9594-c92712d069a7", "value": "C4E38D4CFB759AA2C7984FB78823540886F3445BE231F2961EED2ED60E35745C40FA6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623264966, "uuid": "c0bebbc3-335a-467d-adf6-d05438908124", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623264966, "uuid": "eb969a18-8325-4d85-ae2f-ab5175d3b64d", "value": "3072:O9ocA4pm6rbcUQ6wJ7K8RR0k4+w+lx9SpOOz1yiofN8R6xjY5:OicA4pmQIUVwR21IYMaaGR62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623264966, "uuid": "d5d6bae4-bb79-43b8-b982-0abb6faa5869", "value": 148352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623264966, "uuid": "c4e7f7a7-850d-4d0c-aa9b-dd2f00277733", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623264966, "uuid": "a9dfb88c-2ed0-4378-aee2-98653674bf7e", "value": "cec06ee6b4ce08a5597b0ad5e5adaa1f94fd743d9cd5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7261e789-c93a-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623253842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253842, "uuid": "2b093c88-0de5-4481-a400-223749f77e2d", "comment": "Malware payload (SnakeKeylogger)", "value": "ef666d1235bc6e01bfeeb1d3b7c2c505", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253842, "uuid": "ba776812-f817-4676-809c-a61c6f72e3f8", "comment": "Malware payload (SnakeKeylogger)", "value": "cec1eed7c94e2dc76b564e983d2839223f27b3a9016a4fac3e239492624cde81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253842, "uuid": "489594a2-368d-4bb5-b4c4-4f1f48c12f37", "comment": "Malware payload (SnakeKeylogger)", "value": "53b4630d05cc1a76e6bc0e76b69e95243aae89db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253842, "uuid": "e8da0835-5c54-4d69-acf7-0ebf1769ad14", "comment": "Malware payload (SnakeKeylogger)", "value": "10197a4d193d512bd7515c9ed7f84fb212f1494800f55454e40c6de2744c4d0bbaa423ed86e7b1f6afb0c198b4c6f024", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253842, "uuid": "59c0f2a4-7e42-4570-bc2b-f1f2a25d9f20", "value": "E1F459032EC4DA8EF0D55A7D05FC50227FA3D882191E9FC769CB77AE05E1A46F620A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253842, "uuid": "4482afea-3c08-4662-9e58-9c58c1c72e4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253842, "uuid": "200caf4e-e29d-4ec5-b1d9-f9ac89505274", "value": "12288:IYJWNyUVYtXiZIXr3Uz1zkfsBBbARVhOkRM/vR/pGsQnw7BzQIPvrtfBm3Jx:ssUVYtXiZIbkyf6dwnXhnenvrtfBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623253842, "uuid": "e36f5772-8834-4b2a-aab1-19f8fab8def5", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623253842, "uuid": "a5386f12-ef4d-44c5-ba6d-63a61734e311", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253842, "uuid": "7e61e15d-e71f-4d8d-8005-79332cbac009", "value": "zO14pquamGURTsd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42215075-c969-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623273948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623273948, "uuid": "60bcda9d-9a4e-40af-a85c-f3abf423c611", "comment": "Malware payload", "value": "9871f0fe2f758f16f8d4d80ad438b2cf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623273948, "uuid": "4343af0f-2727-4316-8fae-540e1b9ba2c0", "comment": "Malware payload", "value": "cf9ae559523b2486d2112b080939f95f23b1726b0233073b95b6249c1174cdc5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623273948, "uuid": "a827fdbc-18bf-4422-8c39-373f6e95618a", "comment": "Malware payload", "value": "5ab04d0727ecea7e021c365f55446099b4b50cbe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623273948, "uuid": "53544911-1d43-4b46-ba15-022ec33fd48e", "comment": "Malware payload", "value": "6fb7df33bfae979a496b3a87c933862956e12be11c5f4b4055188ba6790e6fca47e60ddbce6f965d18d1b29b78d893a0", "object_relation": "sha3-384", "Tag": [] }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623273948, "uuid": "31dce727-216e-4431-b09a-3f1f2b27fa2a", "value": "3:XA+Ruw3A0+Jn:Qu5WJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623273948, "uuid": "629c8a2a-d4a9-4c63-a2f8-04129e8474bc", "value": 37, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623273948, "uuid": "461f21eb-341a-46d1-b430-4ead66d354c8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623273948, "uuid": "dfdeb992-632d-4a53-989f-633d714133f4", "value": "no_optional.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350434da-c927-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623245579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623245579, "uuid": "cbdee5d8-1015-4fd3-824b-f752cdbc9603", "comment": "Malware payload (Formbook)", "value": "e8aad64db5f688d6ac4d7daa7dc9eba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623245579, "uuid": "721f0bb4-8f10-4d58-b2fa-852195be5b4d", "comment": "Malware payload (Formbook)", "value": "d040f18bcf1d59a6372cdd74ec22ba8908ca7c6e7c5a01e80053433277e16d1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623245579, "uuid": "9fc2f812-34df-4ea0-ad16-04057624ce5d", "comment": "Malware payload (Formbook)", "value": "8f4c98213c98445fdedebd5227455c9e4122ee3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623245579, "uuid": "f7675224-b84e-4603-b20f-850457156893", "comment": "Malware payload (Formbook)", "value": "4d21d77cb650848415e7d13c1a02963a6a621abbfbb563bb1813c6ec434c6b1be761b2845cb35c9e5aba9b17ae93ccfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623245579, "uuid": "c4080088-d94a-41ac-94b3-58967af3f882", "value": "15B402A371A1C8BEE85901FF0D51B6525DEFFA20876C51DB3F64A35E9B605C0CB2A306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623245579, "uuid": "a69fe5e9-387d-4f2b-b45a-c341aca7767f", "value": "c5061f564a0283b1f0fcad4d9984534d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623245579, "uuid": "94417225-a3f0-4a1e-bee7-494ba980eb71", "value": "6144:yyNiVY4SJ/Wfg821yAqoGXrLz5ZvOoNFRQJ12MeIan8hB7OJzIma5hl8b:yyNiVYvKgTsAQFR9MeIaQB7OJEtlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623245579, "uuid": "fde7f828-c67e-48b2-99b9-04113249228f", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623245579, "uuid": "cb9086e7-fa78-467d-801b-effcbd106196", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623245579, "uuid": "ae42aa64-e0ca-478a-83c7-1a7dd2072908", "value": "mam.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361102af-c8fd-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1623227542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227542, "uuid": "3c7d399d-0f61-4379-9729-0f63db2b2255", "comment": "Malware payload (LimeRAT)", "value": "1276e815c54ab13a18f21118dd3c6bbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227542, "uuid": "c9ea36e5-165f-46f0-90e4-91054769195b", "comment": "Malware payload (LimeRAT)", "value": "d2d5f495be99faf5dcc31f16b20d08b31802215621595e3ffe3a56a2f69c5817", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227542, "uuid": "998358b4-fa90-4945-bd55-b994fdafaec8", "comment": "Malware payload (LimeRAT)", "value": "9202801947ebf5b8d5442aaee94d5e32c4c02d20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227542, "uuid": "9fa4343c-4ae7-4367-8bb0-10dde8b50e30", "comment": "Malware payload (LimeRAT)", "value": "65b2265ad9053bf05a22c8bb6da8acca5680e57a54a07796fd5f6a2b1b92cbb70a0e90ab1ad2662116a8e32ee74c06d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227542, "uuid": "5d218075-d90e-49c3-b0c4-53cfa2d411e2", "value": "06B3F75437F59A63C3895B36D4D22394273AC90E3A92F79754946E3C2E833EF6C18983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227542, "uuid": "57d4afda-197e-4037-8b8e-d39e5c944ddd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227542, "uuid": "46031ac4-aefe-4ffd-8634-cd00fff0944d", "value": "1536:W85j51OntvCY0GW/DkhglxD4wlfVeE6QlAy8VB9qgCzn6OF8ZJjpIDv:rH4tvCY0G0jEwlkzrVB0gM6C8Z9pID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623227542, "uuid": "991514fa-76a9-4edc-8dcd-91f09a2143d7", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623227542, "uuid": "560161bb-5ace-46d4-8b50-5220960a8590", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227542, "uuid": "556d379c-12ab-46ed-8453-520de9961307", "value": "microsoft.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84632d8-c90e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623235062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623235062, "uuid": "8f8f90fc-7645-4122-9b64-4c0f13b6a24c", "comment": "Malware payload", "value": "d2fae43dae770a5137fbecaf84892701", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623235062, "uuid": "2dff7e41-e523-41f6-a94e-230384110a80", "comment": "Malware payload", "value": "d47d868a221e3bd4e601713b96ed659a6640057abf8666fb320275c6c25ad721", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623235062, "uuid": "8368e816-ed98-4aa9-978a-0e86b53e373f", "comment": "Malware payload", "value": "2c25322bfee47cde1d77b93ffe24bdf24d5c8812", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623235062, "uuid": "760fbc12-5cc9-4648-81fb-0028bf37aed3", "comment": "Malware payload", "value": "4157b52034ec09e98130ee660433a469e2513580126d90eb848e0113670b3deb804282af2996970e6c712495cb2399c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623235062, "uuid": "bba34e43-1776-4f37-aed2-c3538bd2a27d", "value": "2593E76BE375847CD095A5F119DB9270EAA032F68737118FB5020B7A7F21ACF0726AD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623235062, "uuid": "f775d5b4-448f-4174-a43e-fabda46cd3ab", "value": "1536:SSLZTxidlizUg7xEz5D466HZ63KO8+v0L:SqZTxidexc5M66Hsap+v0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623235062, "uuid": "dfa3685c-3de6-4e57-819b-1ed442705c59", "value": 95544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623235062, "uuid": "257541b3-77ae-4c8d-81b9-3ee151271155", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623235062, "uuid": "e0af4d2c-792b-4931-9efe-d1ebd5bf5354", "value": "now", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eba1ef9-c8f7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623225087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225087, "uuid": "84877bae-c201-43e4-b912-fd19f861d5ef", "comment": "Malware payload (Formbook)", "value": "122a2281166f13fa8fdb4ce60315721d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225087, "uuid": "f16b5c48-5f8a-429f-bc9a-c620a6d3be09", "comment": "Malware payload (Formbook)", "value": "d4aed6a18f9def319cf3f848c48ed92d19c2b0c3fbacbe3d4a59df7fed6c239d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225087, "uuid": "0d7377f0-d354-4335-ba9d-5602b47921b7", "comment": "Malware payload (Formbook)", "value": "ee0f9c1adc8f7ea19b2edcede7b89689cbbed65c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225087, "uuid": "6e60bcd2-84b5-4935-91b5-a102afa6c71e", "comment": "Malware payload (Formbook)", "value": "784f19950874bb27eb2066a76f853a9e778843979b206adc8659dd91409f7e93ebe9e7164478822ae02102d024f93e6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225087, "uuid": "529ddd44-7727-465f-b24b-2c7a36e9334b", "value": "A505D02962404A20F07E4737C8944454D3F9FC07D713C9AEEDE578CD6EA2BEAE12A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225087, "uuid": "a4ca3c43-17e9-4dad-9822-04d93ff2f178", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225087, "uuid": "a163f8c8-970f-4392-bdd0-d09b91fc8823", "value": "12288:IDCkYNAGdc6elMV4095kDvvVbd9kLNzyGFUSs4x6m1q5xIEjR1d2mnThS:IdguUgDvVJ9kLbUL41QWEjXvnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623225087, "uuid": "1dfd62f9-7feb-41f4-827e-7995c2384847", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623225087, "uuid": "e8ff7423-6699-49f3-b59e-61b6b6aed45b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225087, "uuid": "88bfc7bf-219c-4b8b-9f17-6f3897651b30", "value": "919780-920390.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638288bf-c91a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623240074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240074, "uuid": "bed0868d-7ed8-4157-bd70-404b4812712b", "comment": "Malware payload (AgentTesla)", "value": "71082ca96405e969e3659700dae261c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240074, "uuid": "945e8890-b491-4b0b-b3f2-a1d941b7a936", "comment": "Malware payload (AgentTesla)", "value": "d4e52e8c388c81d1054407cd293be0049e28f9d4860f214797869254f04b1421", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240074, "uuid": "947e476b-40f4-4c4a-8ff1-0fe841975da7", "comment": "Malware payload (AgentTesla)", "value": "1830850e3ac60a6f03cb116a3b095cc765c36be2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623240074, "uuid": "feea0c4f-71eb-4976-a7db-15c20c3e5989", "comment": "Malware payload (AgentTesla)", "value": "efd2f748e267f1eb62ef941e025ed9f314ce169af9b9a2545d015ec28bfef5143b04720cd5c4fe1bf0aea42ba4599bc9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240074, "uuid": "e6f6761c-da8d-4219-9f65-1b3e4f18461f", "value": "6DC423F61BD3DA5C7CE81EB24AF7681D638A86BDCCE08C159408977DF958C9332835A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240074, "uuid": "ba282587-4f7e-474e-b013-2ab2571bb682", "value": "12288:9avwGfyR2VNyZjhgcWCcKGEe7MN4K05H0CmVI2AOofk8V6fOEev/pgK1B:VGfyR2qycWCcLEeEJyZmV4vGWLv/pg8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623240074, "uuid": "f8cf5289-2622-4043-ae09-c4317f3a3683", "value": 568397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623240074, "uuid": "3890f44a-dbbb-44c8-b3aa-9f9a4e99a8fd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623240074, "uuid": "04026772-4c73-426a-bf25-ef9a25e50548", "value": "Chinesse import-export customs regulation updated 2021.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d19e872-c92d-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623248170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248170, "uuid": "f127ac2e-71a8-4747-a9c6-6f83546490d7", "comment": "Malware payload (SnakeKeylogger)", "value": "773753db9f27b5e5e3cb544725942730", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248170, "uuid": "d212bb76-aad8-48f2-9ed1-ad1ce0e0757c", "comment": "Malware payload (SnakeKeylogger)", "value": "d70277fbc9c357c139e002ff8ab9e0e5444790440802b1cc8583c9df6df7084d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248170, "uuid": "8e28972f-1fe0-47fa-adcf-9ba17261e0d0", "comment": "Malware payload (SnakeKeylogger)", "value": "92445c954defd491ee0fff50c6039184ae17d820", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248170, "uuid": "7dd42e1a-d7e8-40dd-9ab6-8ef97d9aaf9a", "comment": "Malware payload (SnakeKeylogger)", "value": "d7fc68dec556e0c4346ed7447a99a79e952db97339b6da6eeb8f1ebeca2c2caa80e88c9efd72d144dbb83a7f10eeea6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248170, "uuid": "04b45cb0-bfb8-4c94-8aa3-2741765efee9", "value": "F0F4D0352B449B28D17F877AC0A1010887F4E503C327DA8EFD9998DD2E223C6D76FA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248170, "uuid": "04d6cd90-e096-436b-8512-e45afb9a9c7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248170, "uuid": "efee636e-399e-4ff3-88e4-2a2ceb83da3c", "value": "12288:6SJfglMV40Jy0BcKgMYrpYbhJKtCeBcxoS//Tf47iuzRiJw2w+KvVw:lJfgUbuKgMHJqp7isRiqr+KvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623248170, "uuid": "d5457f32-b4f0-46b2-946a-ac9499840536", "value": 726016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623248170, "uuid": "5575f359-dc4b-4600-bf5c-7cc7f4c6f571", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248170, "uuid": "d00effbb-85c9-442e-a58b-0ac702bfdc0e", "value": "Payment double code.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30383b2-c94e-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1623262568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623262568, "uuid": "a2a2a4eb-3d85-4951-a049-f5938709d6f0", "comment": "Malware payload (IcedID)", "value": "4ca603fb87d28b9da39f1174a426da43", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623262568, "uuid": "ff77238a-b40c-455e-953d-02913a2f6f26", "comment": "Malware payload (IcedID)", "value": "d7b9ef581459a0d8f94b789ae07a9e0892c0f0d0bcc7416a45471fe817ce377d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623262568, "uuid": "4cb9c863-e5fe-4fc1-98fe-665a985e5e48", "comment": "Malware payload (IcedID)", "value": "d265a8d6da40244503867c8d59d8eeb136544a3d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623262568, "uuid": "825ee5b1-ae01-4326-9d3f-199e8eee22e5", "comment": "Malware payload (IcedID)", "value": "9c8814810bc50d0e7e66282955c0d0eeef78f8e5aeef92a35c4080bde58ea23b48afa2fae3de16802d41989738fdfbe8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623262568, "uuid": "9b4ef974-3c34-4f74-9e04-8534edd0307b", "value": "0CB44A47A2A947E5D0FAD03047763993FAA27420417086BF87A6491E5F3B3706DAF31E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623262568, "uuid": "41ab9ed3-698c-4bcd-ba3e-43dd93c63548", "value": "2fa12bc5d8b96628e299895086c0fee4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623262568, "uuid": "f64cbba4-ec32-4ebe-bdd3-ae22131cb458", "value": "6144:rwULPg+Ue2T6yrBCgNj6oKUE2iijYBheGRMaD5yqDamdohfzq8a:t082TLrbNGoVMjPR5DxDRoF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623262568, "uuid": "5885c200-51b5-47e6-83e6-9e633a601870", "value": 531585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623262568, "uuid": "cca20738-1228-4b25-9933-0e170f5e498b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623262568, "uuid": "d5c4d674-5a60-4d1f-ac73-821cd6087cdb", "value": "d7b9ef581459a0d8f94b789ae07a9e0892c0f0d0bcc74.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1337773-c93b-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623254458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254458, "uuid": "913360a0-0844-485d-958c-55ff11a44a44", "comment": "Malware payload (Formbook)", "value": "ea6b36cff730a4a59d9a20b29b844f4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254458, "uuid": "5be35fc4-2c4b-4879-8a06-2b721ede984b", "comment": "Malware payload (Formbook)", "value": "d8e4dc4fe121eb0ff7e9c07069d94de902b3aebd7169cc44c02caedea8dbefd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254458, "uuid": "b2aab076-a28e-4a53-8ee6-cd3164162fae", "comment": "Malware payload (Formbook)", "value": "dfbea8c0c6e63c83f65fb56d4031cc0d968a30b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623254458, "uuid": "d81230e9-55c9-4dd5-a131-b12f6f800638", "comment": "Malware payload (Formbook)", "value": "553aedd7ad3c1d47219ad97e4e65354ab7d5a038d2f1dfe12aaeb75fc43e407761773c57d10eeae25de6ad920bcfd1c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254458, "uuid": "c4302d78-3672-4ba1-838d-099f5efb03db", "value": "5205F1263654EA11C36A1932CCDF500847F99E423A73DF3A7DD9318E1513BA3AD1A8ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254458, "uuid": "76f7aeb9-ef15-4b74-b98e-19ef7812feee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254458, "uuid": "cc37e803-d83f-405c-b115-a591e8a4b65f", "value": "24576:/8O6wudUVYtXiZJEZYsK8i/pyq8UYQt6uL+ZRI/FS:/8lVUYtXiZmZYsKp//8UYzuL+Za9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623254458, "uuid": "64aa0555-e3a0-4551-94c1-af5e28ca23c9", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623254458, "uuid": "404ca1f4-9cbe-4ad3-8538-7162d55d4aa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623254458, "uuid": "5202fc84-0052-47a4-add6-aa3a7077b70f", "value": "scan copy.rr1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dca2799-c8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623217166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217166, "uuid": "2c1d2c91-1fab-457c-b232-3d930e75e4a2", "comment": "Malware payload (AgentTesla)", "value": "95297ed280c6ef8e60198f5d588ac38c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217166, "uuid": "d7210cbc-37c4-4c59-b2fb-9ecbb7f3553a", "comment": "Malware payload (AgentTesla)", "value": "d98207a64018e8c8768251dc020aa06972f23564db65b5600d0f73ef8133affb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217166, "uuid": "3c74d27e-1ea0-4e78-940e-1ebfce080983", "comment": "Malware payload (AgentTesla)", "value": "66117a6a30c1951dbbe589501d0b34dbf335134e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217166, "uuid": "c4e672cd-9d24-45f2-922e-1f50868827bb", "comment": "Malware payload (AgentTesla)", "value": "f204f4e0f6eecd3f94470c5b78d8541bae8129c251c26c322edbcafc51f0d0cf92af42c003af07c2ac86a711ec454e7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217166, "uuid": "24022e44-b986-41ca-bd4b-38f05884a336", "value": "31E15B38AE98DDD5CB83D0F59A517C9C48A2B06592C76E46720CF3F807D71AA6336886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217166, "uuid": "bfe87c7d-2c32-4f80-ba28-e0581279da8a", "value": "96:7JcAGWhhZVuGRlipmEKI65yoHqMp/01u3SvXcAV0fMR0JyAZx3dE1EFf1hU8Dq3Y:7JcAG2hfpRkoqMi1uZs0Bl/OAtiqi7m5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217166, "uuid": "ceab8158-5747-4d7d-bd7b-37da62d3a374", "value": 7027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217166, "uuid": "60d75de5-65a1-476f-bc0a-4d8a52ba242a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217166, "uuid": "befe6877-069f-4027-85f4-ce962f7ddd48", "value": "Payment Advice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef8597e-c8fe-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1623228201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623228201, "uuid": "245c59b0-ebac-4b8e-9acb-d9b77c3c820f", "comment": "Malware payload (AsyncRAT)", "value": "fff678d5f6ce73a1b7737d61ecde2c5d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623228201, "uuid": "9795e6b7-09fb-44a0-85a6-ec80f6109ee7", "comment": "Malware payload (AsyncRAT)", "value": "dabd0b5d149d3846e96f880e2433cc8be80218502da80688a111b06ca79910cd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623228201, "uuid": "b2623797-2213-493c-8e82-42b7710932c5", "comment": "Malware payload (AsyncRAT)", "value": "79e68a0832837ee48dad73c3d5ad6ae2fbc42580", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623228201, "uuid": "bdb2957f-40d7-4a3b-962f-2caf4afdf251", "comment": "Malware payload (AsyncRAT)", "value": "dbe3a87c207bf6f9f0b17b8544b06c97032abee7752d9f3db80cd9a6519c181c31d6392b4e1615305cc5ffa06d7f169d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623228201, "uuid": "0e570063-7a70-4b15-9c44-2cb207c22047", "value": "2EE4AD251F449AE4E1BE977980E2400443F7AD0FC722C68DEE95B88D2F323C6DE5B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623228201, "uuid": "c848603c-2e67-44c2-96f7-3a1195e429ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623228201, "uuid": "d067fe52-a219-440a-b9f8-3dab64d7e9db", "value": "12288:SRWQlMV40JRyAITs6efYyWpOWZsa+znYR6bFc+V5h5j4:SRWQU2AYeYyWEW7gbFb5h5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623228201, "uuid": "16cb10e8-816d-4d92-941c-dcde7ef58e79", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623228201, "uuid": "1e9181b2-6edc-4e54-a644-2f504f790e98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623228201, "uuid": "fc192530-5a0f-4a8e-baf7-91d140a4e822", "value": "KEB HANA BANKeStatementswift00018937481967108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65150fbf-c945-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1623258545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623258545, "uuid": "f072c3cc-8261-483f-a07e-5d1af9b39e85", "comment": "Malware payload (TrickBot)", "value": "32b2798ecb2396f1bb2ccc3d5a2a20fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623258545, "uuid": "ee184db7-50e2-4640-bc19-7614601c1ded", "comment": "Malware payload (TrickBot)", "value": "dc084e88f377ddd7ee21424f94f1f94b409b26ebfbfb6b8566654cc9ce71472e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623258545, "uuid": "bf1df24a-6847-4031-8187-7ca1844a760e", "comment": "Malware payload (TrickBot)", "value": "69e34010da3954b55806b8afd622fbe573ad89df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623258545, "uuid": "b9a176af-2015-4713-97b8-dc75ff127f52", "comment": "Malware payload (TrickBot)", "value": "b0e41d6065ac7f8c7991c374d5c2eac41eca3018ae467c2c637d50987a99a67becf06862314ae7773f4189b2cc56bf58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623258545, "uuid": "a188adda-b720-49d5-885b-abbf2712170f", "value": "3C257C1076B0D033F2B12172897AD9F3E575EC628B2573CBE5C2363C2A3C5D35A25AA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623258545, "uuid": "c127d5c7-4647-4ba9-a53c-8ff82b664ff6", "value": "9cff33d60abb2b9ada3b724500411bdc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623258545, "uuid": "9de90bc2-d807-453b-88bb-86bcd2d7985e", "value": "12288:ZMRocJsQWis6bFd10txEYP2WUJJ2XegCnZ1v4414FB4sbqiohY8Hy1n6quWT:mimzrjHy2WUJueLZ1v4414vbqWrbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623258545, "uuid": "46cf6362-3c5e-482f-80da-0dfe2760a628", "value": 1010176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623258545, "uuid": "ca7706d5-58e4-4a8a-954c-8c4ce53560d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623258545, "uuid": "e88ad2f0-c4ee-4e4c-9371-846c5810ae54", "value": "dc084e88f377ddd7ee21424f94f1f94b409b26ebfbfb6b8566654cc9ce71472e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e8c5e9-c8e8-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623218489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218489, "uuid": "5bf09513-2f06-4628-bfb8-92dc326dc615", "comment": "Malware payload (SnakeKeylogger)", "value": "d5c4781f3bb37c1d18d55015e7a228cf", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218489, "uuid": "e823a8ee-a7c7-4c49-9bc8-3d78aca17115", "comment": "Malware payload (SnakeKeylogger)", "value": "de83d058df7c645a5b9429747d781d24c0417caa0c0302f19766a25901101972", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218489, "uuid": "c34ad355-cc7e-42de-ab45-de3ad9a4e61c", "comment": "Malware payload (SnakeKeylogger)", "value": "e8c2edbb90736e2da947f95ce3db6d523df51c56", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218489, "uuid": "5f00b413-b72e-4091-94ae-43591e5def44", "comment": "Malware payload (SnakeKeylogger)", "value": "dbe5b57bdc9c8ceb25fa5b1160bcb74f67fd47ee9a452aba1ad485643b6cab84c0bcef59e6ce5bd5b489411be4022d82", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218489, "uuid": "1b915907-4535-4245-809a-55ca35bcb5ea", "value": "E364233DB5D9807DA19BEEDAE21F2016D62D354F36E35DE72404AE87A4384EC32F6409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218489, "uuid": "c293db71-995c-4e4a-bd01-5b4cc813579b", "value": "6144:EIfi15xKp+xyj/iuqqayMLhCdnoWFyx5XV2V0wfTnHeDADiu0vAn:Egi7W6uqqKLunoWFWyffTnHeEDijvAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218489, "uuid": "48a2b022-bd70-4eaf-858c-1a726bef5760", "value": 330983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218489, "uuid": "80e383e2-3dfd-4284-ae48-92ebe5095dfb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218489, "uuid": "d61295fe-c3fa-4008-9d86-d687b6ac96d4", "value": "DOC09009000.PDF.LZH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870427ac-c8f7-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623225101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225101, "uuid": "3d6f269d-f612-4a62-a1d7-e0574fa817ee", "comment": "Malware payload (SnakeKeylogger)", "value": "80cf134af3b87c670b6aa0f2e905642d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225101, "uuid": "f7c0f461-9e99-471d-afe2-dd9811466297", "comment": "Malware payload (SnakeKeylogger)", "value": "decd78fc105be0f2f8ddf9b74e5676499d1b15cbe4cd26153439948575362db9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225101, "uuid": "4ac7dcc9-3826-4405-985d-3f59c0f71cd5", "comment": "Malware payload (SnakeKeylogger)", "value": "8fbbed4f8380f1dbfc78abf00b7e516d9e376933", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225101, "uuid": "29d08af7-49ac-4cf4-a4c9-d32225e45fcf", "comment": "Malware payload (SnakeKeylogger)", "value": "0362cbc5d09add0479bf40a1d8c0d879f9270d39a50c297a6a78ebfb318a00da8b6a02becc57ed91adc16cffafd52a17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225101, "uuid": "ab0bb4db-3503-414b-a810-5467241726e1", "value": "BEE4D03553488A55E17F8335A0B1120443F0F503D362EE4EFED858EA2EA27C6E76F696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225101, "uuid": "f6250b66-d3e8-4fca-a414-a3eb4932e7ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225101, "uuid": "76809a31-391c-4e94-9316-0f5d68cb2758", "value": "12288:UEyBv15txPvHQcY88p6plMV40J77y6mc+iDqAnXWxVN6qwfxSbO/r:Uziwg6pUlt+jWWrN6qExSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623225101, "uuid": "b59fe1b8-13c5-45a5-81c3-fc4ee95482ec", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623225101, "uuid": "d6648784-45f7-4f22-a9dc-9d1443dbcd49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225101, "uuid": "8173ce79-1b09-43b1-bdeb-a566b14b9615", "value": "Payment Advice MT103.JPG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb8c37d-c8e4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623216980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623216980, "uuid": "eb15b5a2-1201-43e2-aa95-39e902e6f089", "comment": "Malware payload (AgentTesla)", "value": "69ba715038c91aaa69320411cce05b0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623216980, "uuid": "353602e5-af3d-40c1-9a05-523e7b8a9c34", "comment": "Malware payload (AgentTesla)", "value": "e0877fb197acdc9b354fa9c982530f35ceea0c72fb51d37f36dd8caa89448274", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623216980, "uuid": "caf89108-82e7-4f33-affe-308ca7c8725d", "comment": "Malware payload (AgentTesla)", "value": "db32081e67f4f7d25754d5a6c44185175df3d30a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623216980, "uuid": "02f9febb-5354-4f98-9a6d-988c0c0b993d", "comment": "Malware payload (AgentTesla)", "value": "fc3f91ac049b131dd08ff202f71a42f3828517871701e7951ee454045b01ea21c9d3d9774f7f253792ee87111db05f10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623216980, "uuid": "18e6b477-1df8-4fa4-a443-60535c1594f3", "value": "E3E4DF5435F9AFA6D135C7F5051011C19FFAA62ABDEEE2080CD6E0DEA560F029E80F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623216980, "uuid": "85c69b2c-0a0e-47c3-a8a1-56b58e350411", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623216980, "uuid": "3c6a86f3-fa68-4ff3-8571-a26de2c59bff", "value": "12288:9jxpnnE3D642bDAZ/cQ3i2980pCXP7wCqgN1VSet6+:9jLnET642vBr29Z7wt6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623216980, "uuid": "b427629d-6195-443a-ada7-ae3fd6bbfd40", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623216980, "uuid": "b4af4efb-e75b-413a-ad83-ffa368678e0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623216980, "uuid": "ac290ef1-be36-4039-8839-1b7ff510133a", "value": "PURCHASE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe21e92-c8e7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623218029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218029, "uuid": "a038c539-3c72-4490-92f2-489269c3d97a", "comment": "Malware payload (AgentTesla)", "value": "76201b426da6dfd599a0e49c8c6fa35c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218029, "uuid": "db119847-3c99-4842-9ad7-6e773c521e26", "comment": "Malware payload (AgentTesla)", "value": "e19dc64ecde415dcf1b6fc7d7f551a2beeca91270412b6ca6f7605a478e97670", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218029, "uuid": "49c3b150-e472-4b30-a7ab-b7af10583ba8", "comment": "Malware payload (AgentTesla)", "value": "3f1564b3e251123939905d857e018f902018d5df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218029, "uuid": "560563cd-3f9d-49f5-89a7-2f2859542993", "comment": "Malware payload (AgentTesla)", "value": "6eacbfc7d60cf8dae9d03ab3d61e88ea0abd9de6d711e13153b9d77e80877a0547015cb9ee53936e812f32548639d623", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218029, "uuid": "fccc93b5-80c0-4cce-86ed-1aad01215fab", "value": "0F542395E8A08A2C494D11AD4B4AD23E4893CF7D283DD19CEE1DFB5CB68E4D2F483467", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218029, "uuid": "dfd9ae89-63bd-44ad-b287-3ff3b27596a2", "value": "6144:PdAAUtmjMVk72IzsbaMCjlGSyNkZGLOn/gqiSZIfG8RaCOWJp6RkY:PO+E42QMIqgxF5IfZJMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218029, "uuid": "a4002e97-9b65-4dc8-878d-a52b3c718bf6", "value": 286200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218029, "uuid": "44060239-eee8-4ddd-b607-65e9fd036cf2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218029, "uuid": "58ccfd97-7b52-41b6-9d66-64683a8682ac", "value": "Chinese New Custom Rules and Regulations_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd67b7f-c935-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623251744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251744, "uuid": "1a1f324a-d03c-4192-b0d0-0cd992f6eed5", "comment": "Malware payload (Formbook)", "value": "f6dad3a16a8ea72bc59bc24be556a327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251744, "uuid": "d07ba96f-ca85-4246-b4ef-f9c2fb34a44d", "comment": "Malware payload (Formbook)", "value": "e2352bb00592a6c40e649858d568e36b1b4bef1f02f76cf9e4d1b03bb5279744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251744, "uuid": "f1f6812a-5a92-4657-a472-9f167c3af752", "comment": "Malware payload (Formbook)", "value": "22e1051182a21f194e684a0c919b07ed43872575", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251744, "uuid": "9f26da3b-e2eb-493f-9c5f-6f8781e2a511", "comment": "Malware payload (Formbook)", "value": "8cbdfc2ef9358953ff80dec9f664dc87c1f15617ed10c20c3823f586d278240f7b3090cd07c8d2b1031fa36d05659094", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251744, "uuid": "e637a883-4320-4545-82b4-a5c433f7b943", "value": "7E05D0282604AA24F0BE4337C8A54054E3FEFD03D713C5AEADE1798D6EB2BD5D127646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251744, "uuid": "f69ba611-4b44-43b7-8ead-ec260d2aae66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251744, "uuid": "a0bd70c0-3e1e-4df6-b983-046825cef6fc", "value": "12288:j4KFulMV409o98PqnHeNCgmFFVpsHyPjsA9PuK2PlAvmtrg4pD1:jVFuUW9ScXjpsKs4PIlAvmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623251744, "uuid": "33c69908-c208-4480-9cde-2b1936efaaaa", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623251744, "uuid": "d1f65dad-d608-4e19-b4d7-fc02ec21150d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251744, "uuid": "1aaec86e-9390-47a5-a91e-24534679cc40", "value": "f6dad3a16a8ea72bc59bc24be556a327.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b2453f-c8e5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623217317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217317, "uuid": "9ce4b5a7-d929-4019-a372-b4d5bf7fc6c2", "comment": "Malware payload", "value": "0f34f8f2ad40f0b0aea784271cabcbb0", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217317, "uuid": "041634e5-999b-4029-8b53-0272b542b2c1", "comment": "Malware payload", "value": "e30c6a975f21d4c00c52bcf0e794e17222632ae55ea1c0ac9a7986f639638a94", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217317, "uuid": "4ce16362-b5a3-4aa5-a637-a5048caf691a", "comment": "Malware payload", "value": "db7219f27176fc31215e0d56940a34b8c90b6bf0", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217317, "uuid": "291343e1-d9f3-458b-804e-32d9c458b7da", "comment": "Malware payload", "value": "d95deba7425765b0a7dea74ce127a6d54d861d7adfb186268b79031d442ee467c8bc37399aadb3161ab949b5f689dbd9", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217317, "uuid": "0b9f030c-1ab5-40bb-9c03-bcbe0515bf28", "value": "38453328CE9D8347D10B75B0372BE57401FECE152125A49F22E8F72A7A786B757E6700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217317, "uuid": "47bc115d-8fcf-441a-9c1e-61f2271b732a", "value": "24576:LQb82EWkYkK9CzU/d4TAKodznV3rzwFrvjuixSiOFDXmN0yhG:gQNtK9CzUVuGdB3ArLDDOBX6hG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217317, "uuid": "574be3e7-558a-4c85-b0c1-800d9d2b83f9", "value": 1250816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217317, "uuid": "cd0221a9-29b0-4d6e-a6ed-170018061531", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217317, "uuid": "e815d8a4-3072-458a-9b71-04cb80e43885", "value": "Official Request JUN 08 2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556f343f-c91f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623242197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623242197, "uuid": "d6a5c2a5-ca3d-40d7-9ba6-846813ce3d34", "comment": "Malware payload (AgentTesla)", "value": "2e9edc35243e4da130643908491e79f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623242197, "uuid": "56a27048-bdb9-4817-b5ce-e2abb450d713", "comment": "Malware payload (AgentTesla)", "value": "e32303a9e778f52943af40c6aa81f4e7bd6ad9bfe99fbe495a3fc37cff6bcb98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623242197, "uuid": "2be97eb5-feb5-4a32-896b-a899af9826ef", "comment": "Malware payload (AgentTesla)", "value": "9a9751cdc94e89e75f570510a1796b84cb7283e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623242197, "uuid": "10c08709-1202-4fd5-a250-741cea633b3e", "comment": "Malware payload (AgentTesla)", "value": "18ff8b0ff31c26422f45453ceaedb002cbc4fd6e5e6dbcda255692b0cf2a84f5e11238539f35ea6023ab03a74a50d5a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623242197, "uuid": "c38af77b-ce66-47a5-b5d2-dfeffbcd07ac", "value": "322506AC31A075DEC467CE768AA82CA4EA6174775B0BD203901705ED9A1CF97DF206F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623242197, "uuid": "00176c23-8a0c-475f-bb0f-35f988a88b0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623242197, "uuid": "ab6b496c-87de-45e6-82f7-9b841f91b84c", "value": "12288:+E5ZZboD12hxVijrGhdXIaPwUNbnVwZn0r8eToW+Oafm8D7H+Na602eTUth6b19a:F53bY8hW/EnVwZ0Sfu8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623242197, "uuid": "415766c4-4d49-48b6-9a1f-4a1b1b430c22", "value": 998400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623242197, "uuid": "fbce1e15-de4e-410b-bdc9-bd033197b914", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623242197, "uuid": "8f042fbf-30a2-4298-ac0c-adaf0e961001", "value": "RFQ 3546575666_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c92fda9-c92d-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1623248330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248330, "uuid": "5b90d8dc-93f3-4c31-8e08-481dc6bf3a5b", "comment": "Malware payload (AZORult)", "value": "f20710002fbca43ce1062430f1e47f0c", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248330, "uuid": "f620bd66-1881-4f91-b1ae-2dc44d0e0c11", "comment": "Malware payload (AZORult)", "value": "e3d5db0d1a5087cb9f6d26a76bc567f9f337319e7dd0490aa42c938a7532eead", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248330, "uuid": "9ac37303-4f2a-4c3c-86b8-a95f8dd94e27", "comment": "Malware payload (AZORult)", "value": "d259ad19800cd6c89252d0548b21c6c13084b8cd", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623248330, "uuid": "355a00e8-d225-4040-9ec8-ec8caa2d9b1b", "comment": "Malware payload (AZORult)", "value": "0d2aa3c1a5f4a2768b18a5b47844a920f424fdd7717a1fc66b839e141a25f6249da2325a6d104b3fedf97e4274a1914f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248330, "uuid": "38c7c194-bfb7-4cfb-b3ad-bbb398325b79", "value": "2614024BF2E1DCBFFCA752300E766F29EBBAF6E4052206474B146E762C510538B27652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248330, "uuid": "0fdf991c-3b42-4bef-9ceb-7f649d259b83", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248330, "uuid": "5c28cd73-5222-44db-9250-4249748d025f", "value": "3072:JS8BCfoDaXJnM2Pp3qBjk6jDFV+dFjuOPApUXfvfy1iltVvQ4wGkMroLE90Uzm9A:JPB6W3jkiFV+fjDPApefxVbtFMLFUzqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623248330, "uuid": "09ce6d4e-460a-424c-b596-ca5463c004f7", "value": 191394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623248330, "uuid": "90ccc26d-cf4a-4363-b0b8-3256baf7f5eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623248330, "uuid": "dd9a8ed1-13cd-4322-a19a-472f0d0df386", "value": "Telform 208533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4291fcb-c918-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623239377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239377, "uuid": "b874ea06-c9ee-4351-bead-94aa1cea6095", "comment": "Malware payload", "value": "31c636b5155f9c6bf71bd5c279947a88", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239377, "uuid": "711f6d83-3a3d-41fa-9f4f-4c11356efddc", "comment": "Malware payload", "value": "e609ac709a6b80b0ceb58c646735fc597db0483ff637e93acf9be028c07900d7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239377, "uuid": "389071a9-0f29-4cd3-831a-c0ed974b565b", "comment": "Malware payload", "value": "7bf98935db59ffbdedf2fc85a6d04901608c85bc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623239377, "uuid": "eb2a6d58-00ee-4b1e-8b34-504e3ce899e5", "comment": "Malware payload", "value": "8a670266d1d1b67b39d6c2c2cfbc7cd4e3c8898960f14395657f8241d238c313fd96467687aca95d8703093163a12e3a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239377, "uuid": "28301b94-8b0d-4871-85e0-e631e5b7680c", "value": "B4861249F344A62BC8B350324AB2437662575D8A5E82DB536DA4720C1DB3ED09F9EFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239377, "uuid": "678e60d3-6a40-443d-bba0-1f50ebd46050", "value": "98304:FJ+mW7XQru7VQjR7CugPIkyYtpX0gM8y4CcQijOfR5DSKYAMZcvzYpqvHwIepAgM:FJ+Pk637TE4qijsDYRlqvQpAbgPb8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623239377, "uuid": "66da809e-9bab-44b9-996c-3e56318a1a6e", "value": 8183523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623239377, "uuid": "1712045d-cd4e-44e3-be8e-8402955ccaa5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623239377, "uuid": "5fb77477-79cf-4f5d-9684-28669a4dd687", "value": "spo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69aa42a9-c8e6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623217750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217750, "uuid": "b1defc11-a8e5-432f-9abe-6f23c12e95ca", "comment": "Malware payload (AgentTesla)", "value": "1f2a052bb25792bf863da3cbb4455aaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217750, "uuid": "3f6fd43d-eb94-44d4-9174-34b1331bbba5", "comment": "Malware payload (AgentTesla)", "value": "e62db49525a16e66a8b288a6deaac90f164166fba51ff9dd5badbd0c777722c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217750, "uuid": "5658ae64-1bd6-4fdc-ba85-a6826ea1dfb5", "comment": "Malware payload (AgentTesla)", "value": "acce5d7b6cdbc724a33871d1e54c1c6fa7dcaf3d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217750, "uuid": "620ce465-0589-4f5c-9820-4f89c8b80615", "comment": "Malware payload (AgentTesla)", "value": "39337ed81cce4bb7dfcd061987b8a497fc111b3475e4949b2d3cf47b2ba38bee8202f734465728f4eef181421e5d5086", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217750, "uuid": "ef544f1c-c2de-45e1-a305-d0565e62a400", "value": "49A423AC17D8B304A6029952C89270855633FCA32E98D5F5BD23C77B9F8D25BADF064C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217750, "uuid": "fa15ad5e-6e2e-473e-b613-9174799597e5", "value": "12288:woIkTmcw8U0e4yHDaZncQ362D86p4X97wMqgZ3V6ev6+D:gkTRw8U0e4yjVh2DfJcv6+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217750, "uuid": "fe98e08d-ea90-440c-8e44-7c75f0c6e312", "value": 468586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217750, "uuid": "ffa81fa0-a0b2-4041-b675-af0879083935", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217750, "uuid": "b5393fa5-2ae8-42f5-8981-ec53c5ee77be", "value": "Q.201.05.18.xls.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804e5125-c8e7-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1623218218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218218, "uuid": "b8a26f48-9e37-4fd2-88b3-e9954ed65128", "comment": "Malware payload (TeamBot)", "value": "a2b08ea7409069c11ec71e11931d91ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218218, "uuid": "2516d769-875f-45d3-aa5e-65ea1ddfabd8", "comment": "Malware payload (TeamBot)", "value": "e7739e653d983e7f3c74dc9fed972ea5a791e3eb132bdda8f563e03119a6793c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218218, "uuid": "809538e3-ed35-400e-9910-aa18e71f7fc1", "comment": "Malware payload (TeamBot)", "value": "f77993f25571ac0b04a15289f2c104d559d90ab9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218218, "uuid": "322961fd-a9a9-4ea8-aed0-35ee1719d991", "comment": "Malware payload (TeamBot)", "value": "b420ddb9f00f6ee26a68ace227898daa7d6f8149b8bf8f9f6421b51e7bf4df529abd971c5c390ba1e01f3e46517bf8a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218218, "uuid": "0ddb5061-b378-46ab-b524-734baa3e62b0", "value": "FD050200ABE0C035F2B756F51A7692A8A93E7DE17B3485CF12D556EE16386E0EC32317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218218, "uuid": "43f6d189-6bca-4858-8a6b-0018fdc49eac", "value": "c80a947a474c831077263a43b05ed845", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218218, "uuid": "9126dbca-3ece-4de8-8a54-39de8e91230e", "value": "12288:apoVBkuwlte8TQmSyLO4SkJgZWTguk29wXlNnV1eIKtLMkQP4YRw61S54CBpRUIf:IULCrJgEcV3KIgd9Q5CBnUOPJMAF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218218, "uuid": "547fd671-023f-4ca7-95c6-e634b53f80ad", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218218, "uuid": "f0094107-3bde-4ef8-a067-490eb1507ee4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218218, "uuid": "f50c52a1-7d02-40d3-adeb-f71ace4c845c", "value": "a2b08ea7409069c11ec71e11931d91ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819ccdda-c8d8-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623211777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211777, "uuid": "449e2f3b-1b06-4a90-8807-ae1fc2404d09", "comment": "Malware payload (Loki)", "value": "01b5fd2b8e30ec3928028232560dc9c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211777, "uuid": "94789a7c-b52f-4f35-aafe-8a046d4500c6", "comment": "Malware payload (Loki)", "value": "e95fb87b11cbaebc67276b965735988c215faf03371f348c29596fe87efd2880", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211777, "uuid": "a9ccad8f-2303-4978-bf69-0062b840b516", "comment": "Malware payload (Loki)", "value": "e0119baf00471edb6dd67389115a0ca993321d46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623211777, "uuid": "e107d010-c42e-496e-896c-10c8d5f3eaf4", "comment": "Malware payload (Loki)", "value": "1ec4256490888941aeecd003cae58728c4d8bad6368e2b56af63b78e5ada716ca350c9b10ed83db2b92d4c10b4fe7a62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211777, "uuid": "0b2346fc-8219-4ad7-aef2-f75049c33af0", "value": "8735299D365072DFC867DD36CA682C24EBA0747B830BD643A4531AECAA4D59BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211777, "uuid": "802ac445-797e-45c0-a9bc-d90f02503b52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211777, "uuid": "08d15ef6-4f8e-47c6-b354-23004f28fa05", "value": "12288:rsnwTbHcvUcwXlLdOlh9wfnoitRDlMV40Jab3vGjbSgU6Esw9JvTCxq/EYy/2h9r:rYybJcSlZOl8fnBxUGYSp9sw9JbzEur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623211777, "uuid": "e4dabf8c-5360-4686-9847-b02ae5cb9c90", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623211777, "uuid": "293abde5-51a5-4017-abe0-a3d709dde217", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623211777, "uuid": "176df8e2-d0c8-40e6-b4a1-cca1f6639f41", "value": "???(??)10115?????210609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4a2518-c936-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623252061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252061, "uuid": "96e3db15-09c5-4fc8-8c3a-fa04d42b1b20", "comment": "Malware payload (AgentTesla)", "value": "a6bad539741eec594c280249c56ffac3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252061, "uuid": "1c68b24c-c5cb-4d40-a964-07bbce9544c0", "comment": "Malware payload (AgentTesla)", "value": "ec20b0bca82187287a0a5b3ed6ec8f86191a9022ae302749dcad06d8d72f6a7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252061, "uuid": "3ff11402-e2da-437c-9094-065f48955fcc", "comment": "Malware payload (AgentTesla)", "value": "206ffe33ec75feb40eb8a1a5b2da81804b8b7b06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623252061, "uuid": "66d7baf0-6eed-49b8-ae92-cabad9cdeade", "comment": "Malware payload (AgentTesla)", "value": "896b35749ac765f11c597a728fd3a34f403299296f4d8d557e61e2e26fbb6073da41782815ebab1f7c96a1037d811197", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252061, "uuid": "f3782b47-a978-41fb-b83d-f82265474bc3", "value": "AB851A54F9D3622919C4FCADD4C8DF60B93DE85F487A2724A2860C31A52E6DF807E1B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252061, "uuid": "f9baba33-253f-4a1a-9bd9-4dad6cd8406f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252061, "uuid": "8cb09133-0452-46d5-bd48-38d687dcab78", "value": "6144:ltNkJuihtei9CNokbi5L/KXyt8/kCU8FfrEeuW5Y4ZqYQLvb7d:jOthkzCQfrduilZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623252061, "uuid": "c44f2e71-de8a-42cf-bf08-5fcfa3927daa", "value": 1750936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623252061, "uuid": "b2a9f1e2-df14-4e4d-91a2-15d1e8095be4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623252061, "uuid": "7447b907-2605-4cbb-8bbf-80f50fc6be6f", "value": "Packing list Invoice-2020.3. incorrectxl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2635fa-c902-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623229698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623229698, "uuid": "52ccd214-225e-4a38-9eb5-ecc6e438b922", "comment": "Malware payload (NanoCore)", "value": "8e87de15cd3da1245b9c7b0e48c0f126", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623229698, "uuid": "8cf25fdd-d3ca-4fe3-bab5-cea71e836236", "comment": "Malware payload (NanoCore)", "value": "ec850202f17a8e7f5a04603e9c70ab21d7b39fb3142a79098aef1d592974702e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623229698, "uuid": "2e3a75ab-d040-42ec-aa3c-9bcc1c0c0061", "comment": "Malware payload (NanoCore)", "value": "80830909ec859ed61811329ae16888cb87e1ed5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623229698, "uuid": "c0764dad-5d1e-4714-a9c0-ef4588fe216e", "comment": "Malware payload (NanoCore)", "value": "60080255307464f1056accd11f9f2937a3e3d0e8d215f9b9596d9dd539e59dbb87ef84f8fd45f00681c58684201294ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623229698, "uuid": "1f6671c6-0cc3-4f16-bb2b-589a005072ed", "value": "B4E4231672948A12EBDE16F6DC77FF04E2F60926D493828AF4A93F05763F7630501AE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623229698, "uuid": "fb87de3c-6985-4baf-9d6b-2e96f9a8145d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623229698, "uuid": "66bc62b8-395b-4e23-88a5-0f491d2788b9", "value": "12288:ETQ2c25dc9wH6UvJF0nvekN2rDerJDTQsKIU9JDAccU7jYUL1Xk:52oWksqla711Xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623229698, "uuid": "a1e4843f-98e7-49bc-8d91-a05a05d0c0ac", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623229698, "uuid": "8f64ac22-be4b-4bf0-a12d-982d24ea90a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623229698, "uuid": "068848b6-658f-47f6-bebf-8a8dc4da9742", "value": "8e87de15cd3da1245b9c7b0e48c0f126.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172aab4e-c8e9-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623218900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218900, "uuid": "f77cd4ec-b308-432f-8c27-29f1fbf39e61", "comment": "Malware payload (SnakeKeylogger)", "value": "5f5af1b86b694a6cad6620ade5067515", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218900, "uuid": "ba53cbee-511e-40d0-9c5f-08c89406e605", "comment": "Malware payload (SnakeKeylogger)", "value": "ecbef40a383d1a33c18cb58cc6b43b2586391cdc568f8bfb6459fd84dfbfa054", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218900, "uuid": "11bb096b-142e-47e7-a9b9-6b441b80b158", "comment": "Malware payload (SnakeKeylogger)", "value": "8ca0b8118afe373fd51a7f1c07ce0086b3c36305", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218900, "uuid": "3154e76a-a7b2-42cf-91b6-5d4dad81f85f", "comment": "Malware payload (SnakeKeylogger)", "value": "dbd7babdb1bb2978d9cc5559110633d66bd5be1831f07f4c100bfe843696583b97ba1f82a0d5be9c94e6a333d49bc402", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218900, "uuid": "43084b82-c90c-46b2-bac6-221fe1d1e3c8", "value": "8AD42321CDDDA09100F65091CAA9C1FA5EA6E2FD73C971B38DA2F35255D242C321FD27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218900, "uuid": "d08f8f2b-2520-4c22-bd68-cf086e64bc9c", "value": "12288:jdMy6atC0+FhTis9Tc684lDvlcgqToEoemL8mBhMMtEkQX6HY:my6Zzp9c684lDNjq8ze4BhMjku6HY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218900, "uuid": "279978b9-4600-45d3-9ad2-9053facf84bc", "value": 614784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218900, "uuid": "83006c4e-0400-4f0b-a5b2-81b3da1768dc", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218900, "uuid": "6710a0c6-0f7e-41a4-93c7-c613f21ba90f", "value": "Image.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c187f4b-c963-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623271522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623271522, "uuid": "386e9166-beb9-4ad3-b115-0bcd2c93d0f0", "comment": "Malware payload", "value": "c6af11c95909bea0e3ac1124383e8979", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623271522, "uuid": "7f6969d4-0240-4179-b109-899ad4eda54a", "comment": "Malware payload", "value": "ecd9057da96485553a0d378640ab3930e23641e5c34aa82a3dad9898f7be0198", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623271522, "uuid": "cf7c0668-a364-49fa-a70a-466c12e7beb7", "comment": "Malware payload", "value": "d00307046e54d33e9bc6dc5ed0489533506b8967", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623271522, "uuid": "3df2e00f-3e4d-4fd5-b90f-86976851154b", "comment": "Malware payload", "value": "82cf1bc5e5da7cf448a22f325ba0244b3eea05eeeed39879ac48d8e50d98563aff4ad1b4126c8cc17e57051c08494a03", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623271522, "uuid": "673ab20a-1098-468b-a9c6-de74e6a1c8e5", "value": "73433E5A9187D43FD3CC093A6552CAE653292CC7D8461203B09CBA9DEC37B7D8A787E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623271522, "uuid": "47298164-524c-4b3c-bcad-6c608a7a3dc1", "value": "1536:3IdA74U+kIAEi3d5GVaf/7smuyVDOKWVgi:3cJU/ILi3d5GVafTsmXVDOdgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623271522, "uuid": "5437bcd3-5cec-405f-b750-808bbb57b6b6", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623271522, "uuid": "59e01738-ffa9-4856-9220-221e108a0b41", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623271522, "uuid": "7f50645c-3b34-40c5-bb70-197e37b4b079", "value": "SecuriteInfo.com.VB.Heur2.EmoDldr.3.28B52B13.Gen.22068.4901", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c51d5a-c935-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1623251665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251665, "uuid": "47bcce68-de10-402f-996c-8e32aea2026c", "comment": "Malware payload (RaccoonStealer)", "value": "6b7554c5f2b7a246639156524fb86a78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251665, "uuid": "1ee1b0cf-6e9e-472b-9161-fcc7073b3884", "comment": "Malware payload (RaccoonStealer)", "value": "ecf14e5b521fd83697915fe02ab94585de651c21917d9f949d3c13b3beecac20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251665, "uuid": "692cd549-58c6-4508-be3a-c7b03bb1c95a", "comment": "Malware payload (RaccoonStealer)", "value": "bb84af3616bb85e23fef50530ee8aa22a3070ea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623251665, "uuid": "678e2604-b551-4c62-8764-f75d5731f0b4", "comment": "Malware payload (RaccoonStealer)", "value": "95d62b76d3ed80c871db03f58248d40b8d4d75e46bca67edf0b164c967641859157289953911ad6ccface916633001bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251665, "uuid": "3b201697-51af-4784-9d88-eaf1113cfd6f", "value": "BF7554137D4CF711E5E42E3782DF2D2813F259C68633960BBF4ABEA51461642ADB232D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251665, "uuid": "c3bcb442-edf6-476e-a4cc-50bff7ff16f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251665, "uuid": "2b06f5a4-f2f8-4a61-bb85-a4b5c71313e0", "value": "24576:MAWfOZiCn4Y1xYwCJCa1mAJJYZFfjxbz3FojP:MAWfOZnn4Qx2CLgSZFfjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623251665, "uuid": "d6af49ff-d196-4145-a41c-69f82705758b", "value": 1574576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623251665, "uuid": "0e93648f-c10d-4066-80c9-e79ab1a3048e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623251665, "uuid": "aa6a1dea-fa57-471d-8f3d-111619990a5e", "value": "6b7554c5f2b7a246639156524fb86a78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a129291-c939-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623253265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253265, "uuid": "898e021d-f279-4a42-b97b-043ab7e3ff34", "comment": "Malware payload (RedLineStealer)", "value": "c90cfc40ca06bf087ad22d7fb7fab278", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253265, "uuid": "69c585b9-abd6-42e0-8612-bd3eb9667be3", "comment": "Malware payload (RedLineStealer)", "value": "eeafeaa06f77c3fcedafcf46dcb18a8c0b931dcb4696319bb94b191eb0c9417a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253265, "uuid": "a051f1d5-007b-4b98-98cc-040c260bd0b9", "comment": "Malware payload (RedLineStealer)", "value": "a3d7ce8dfd2b9e98ee7150b8a1c819173e0ace33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623253265, "uuid": "d0ef7a9c-6144-4f64-b2b3-a2fd129a9ba5", "comment": "Malware payload (RedLineStealer)", "value": "3ca650ee404bd3171218afccfc862d729ac91321c7801c9457ab9fda4e0147e31fa2d6f2aedd3d3342a21169c3de7127", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253265, "uuid": "c81dd1ea-5a7a-443f-bd8e-552b9715d109", "value": "4D74AE10B7E0C034F6F326F45A7592B9A93E7AB1A73490CF52D126EA5A346E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253265, "uuid": "7eacb4bb-ffd8-4dc3-98d5-6fec320f94f0", "value": "6c073e6a8ba68224cd3b694cbab6f2b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253265, "uuid": "ac696cdf-b58a-412b-a64b-387903fc45e5", "value": "6144:8W94Io+CevVDdunO6IWlTWnFrBRTmJWE/rSJHXanj0cRF9fh7/CJVII:8O41+CYVDEIWlTiFfmsE/rSknjX7/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623253265, "uuid": "63bbbecf-33d4-4b2b-b4dd-46a29d81e2ed", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623253265, "uuid": "ea115385-3ce0-465d-96af-54cf531c562e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623253265, "uuid": "eaf3dca6-0673-463e-aad4-38b452a94671", "value": "c90cfc40ca06bf087ad22d7fb7fab278.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e099fd52-c8e7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623218379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218379, "uuid": "1d6e70c3-ce5d-4165-a844-4b43847b3296", "comment": "Malware payload (Formbook)", "value": "6e86483ecb326f5aa15177415ec3ecac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218379, "uuid": "17ed3ade-e839-4c8d-91cb-270dedb45679", "comment": "Malware payload (Formbook)", "value": "f02de42f922f8de10d150f823d2b90d89052fcbe4e04754d1c07335a5afd47d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218379, "uuid": "f536075d-c953-4f5f-ac26-97c9ac20700b", "comment": "Malware payload (Formbook)", "value": "af3b702aa3c233770ff13cab92796e50860f249c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218379, "uuid": "8b30e889-0608-44d9-9ba9-c6a8ba7c916a", "comment": "Malware payload (Formbook)", "value": "fb4debfa0086e24b045049faa46e3f5e5c4d08367f51c0e597c30d7b2aa3793c8453f192627d6500d01a1801404328d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218379, "uuid": "b20094af-e5be-4d83-af4e-5b4238d3e7ab", "value": "4284BE5231048ABBF2131CBA5C1ED6B214977D20611AA51D76AE331F15F232223EFB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218379, "uuid": "620780d4-4f7f-409e-9c28-7d28bf9fe37f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218379, "uuid": "eefafa66-9c25-434d-b414-63e64fa05dc0", "value": "6144:ghT+y/jnOY8RGJJKuR4aNiQHL5XSpLJoegbeYyhcKqjL8DPPd8:7y/jcRyPuSLtSpLYyG1jL8DPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218379, "uuid": "e60d12ed-bfab-4328-abeb-8cd4ee5053ae", "value": 374272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218379, "uuid": "04af27a0-8c7a-418b-95ec-7568e95d33f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218379, "uuid": "bb2d9bfe-cc5e-4077-b7f7-f76a6293c4a3", "value": "6e86483ecb326f5aa15177415ec3ecac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "666d1dd8-c975-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623279163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623279163, "uuid": "d95244c7-1ba4-4855-889e-769b5be7b92f", "comment": "Malware payload", "value": "7812d5b0a6dd0b1714f6bfbbcb5b2e5f", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623279163, "uuid": "d98cb4d1-9403-4841-b4e2-6407d09ed4b3", "comment": "Malware payload", "value": "f0954937ac5174186e28ec7e46be4e15231af227ac89606b0385d5e439988f01", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623279163, "uuid": "149e77cf-4cc8-4abd-ab84-ab34fd2cf149", "comment": "Malware payload", "value": "5a22de195bb020c92ac39175b6da1df38d6c94c7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623279163, "uuid": "7be201b4-d679-4aa5-8860-5d5a75abcf12", "comment": "Malware payload", "value": "00ef32745289f8b7a395aa69479498ff33039034f3a334b9308df9ec77e981bfa2e67dbeb24b4fcc26e224ffed25969e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623279163, "uuid": "247228fc-2864-485f-b083-3d30eeea4841", "value": "DF542305233DEE8C5F09A73A48E7ADC5E884B950AC76C7CC4534E97AA2560861AF92F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623279163, "uuid": "5b4d185f-bb3a-4283-aa42-031859924623", "value": "6144:n7ftKeMVcBFC0UXIuuzD1j69wQi4O4pLcPVMaX3jS/2AxRYYayHzd:D0efFC0TuUjswB4pLU2xRO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623279163, "uuid": "1d69aedf-7360-4016-aea5-2ddbc729c3eb", "value": 290326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623279163, "uuid": "dff928a2-c9c2-4527-82e7-b10d836784f3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623279163, "uuid": "7b284811-8dbc-4b37-9d48-66492b6969d6", "value": "\u6b27\u6d32\u676f\u5f00\u8d5b\u9a6c\u4e0a\u5f00\u8d5b\uff0c\u4f60\u8fd8\u5728\u4e3a\u6ca1\u6709\u5ba2\u6237\u53d1\u6101\u5417\uff1f.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890e9038-c922-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623243573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243573, "uuid": "195adb77-81f1-4338-ba61-9df0e9e907e0", "comment": "Malware payload (Loki)", "value": "b72c51bdd3489176cc6da5496d2542cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243573, "uuid": "c4b8ba2a-09db-4e80-9e4a-640bdd52a39a", "comment": "Malware payload (Loki)", "value": "f0d0c5a1ea146a3000bab694741468e0dcee8cd9082485e100db75aae03d9e30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243573, "uuid": "a4671ab8-e3a5-47f2-ba98-c5ab1962f694", "comment": "Malware payload (Loki)", "value": "005f018504f9cf2e6f374c24fbc649e58d049d22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623243573, "uuid": "95de46c3-82dd-4760-bfae-7a7b33b49f42", "comment": "Malware payload (Loki)", "value": "37e440bc9a6842e0627de1fd7e2d5b164cde0ff1b303213ea0b42cd71e1de429e9ea7b1088708f5a26b5d6d34b90a22e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243573, "uuid": "80af53ba-a604-4496-ace7-547d4eb852b3", "value": "ACE4D021134C8955E17F5339A0B1510453F1F507D322EB4DFEA8A8DA2EA27C2D3AFA5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243573, "uuid": "2e3f9f01-b91e-4601-9e49-89e99fee3c88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243573, "uuid": "57866e50-4081-43d4-8522-e620ee8d24c5", "value": "12288:zEyBv15txPvHQcIbc/vZlMV40JsYFBK5PbMSLZdyPEbNkWVnIJZyw3Z+fhXAHl5I:zziY/vZUOGQjJTIEbNkWF1c+5wF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623243573, "uuid": "9a806222-bbff-4916-92fc-7cb5aba95959", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623243573, "uuid": "4411ea15-75b0-489c-bdae-0fd8ed61dcd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623243573, "uuid": "64cae0ce-b3fd-4dc7-8c67-70e4333ae2fb", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d1a73a0-c8ee-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623221272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221272, "uuid": "40ed31a3-ecbe-4ec9-b473-c8c74b4b06d2", "comment": "Malware payload (Formbook)", "value": "c6bbfb9c5a655ebe04629c391523b563", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221272, "uuid": "f9e81d1a-bf52-4ebb-859d-21d6af22ce2b", "comment": "Malware payload (Formbook)", "value": "f10508b4bd982e597771e6128fede0b532c42cb799ac495c922940c27a942dbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221272, "uuid": "1b1c137a-e35c-4efe-9d89-9ff9962d0d80", "comment": "Malware payload (Formbook)", "value": "44b6e002fb2d2d95f45a3d3987834ca4f9f86e6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623221272, "uuid": "14f9cd74-5b3f-451e-a728-8a272fdf9417", "comment": "Malware payload (Formbook)", "value": "d96ba38c3801ed338e6546a9819bf8680088f4850587090334aa898c7e30fff3edf1150110b9aac777946877d575305d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221272, "uuid": "0291c552-4254-4d68-ba77-947962b809de", "value": "B5F4E03522488A51E17F937190A1560443F1F907D723EB0DFEA858DA2EA33C6E3AF657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221272, "uuid": "fca4bab7-67b2-4f5f-a974-b7da87ef1863", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221272, "uuid": "ddd9a470-fdfa-4e07-826e-2ef2aac4c1f0", "value": "12288:Mmeew15tQPvHcsDO+DlMV40Jk2m7dOyrgMXaM/GFGV0kgzWSNgyJ3h5B7XhEUF1G:MlMO+DU4r7aM4GV9gBga33B7iw1QdW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623221272, "uuid": "c87e722c-f8a9-4dac-8610-b4cd63d3ff92", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623221272, "uuid": "65e82f17-012d-49f0-a12c-374e8a7003b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623221272, "uuid": "0c97e152-60ed-407c-90b4-2655085c9b5d", "value": "c6bbfb9c5a655ebe04629c391523b563.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb03d64-c8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1623217358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217358, "uuid": "58edb5b7-e60b-475e-94fd-c1e255885a30", "comment": "Malware payload (Formbook)", "value": "f1a78b9dbc881fce9cdc63d149cabd07", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217358, "uuid": "daef695f-f926-44d1-b56b-d5a6f69dd1ec", "comment": "Malware payload (Formbook)", "value": "f250b60c9e677207f5ec26f828ca0b41f514d34513e89e439458e6bec0769b9d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217358, "uuid": "39c40bba-2130-4735-887f-b7af884bfe42", "comment": "Malware payload (Formbook)", "value": "15dbe5566080596181ae4ea65121805c08602b06", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217358, "uuid": "d63b1492-4c62-4656-a12e-b657e43d86bb", "comment": "Malware payload (Formbook)", "value": "180a13a2dbb9ec31e9a5866768e1afcbb0c7562890bd7b3803737d3139fa32f9a6c28360ab7d7e8803cb1e5e9714ed75", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217358, "uuid": "24fe8f0e-6f81-4411-96b4-8d14e9ba1ec1", "value": "02553310FFE091A7C3AF45B4A72458700030BC69B23EACBB69AEBBCC15F1B7455B2655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217358, "uuid": "47379fdd-fdec-4ad0-8719-e64d20435172", "value": "24576:HZAalb1QjNfaxbUTXcalWOrR9QD7DNhjeB3iy4l1y/aPv0zWyNghVxnMHgCLUiHO:H3Kx0bUTXcoRC7JhyJiy46SUyyyhVyHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217358, "uuid": "95a14e29-971f-4cc7-88c0-618239743b9b", "value": 1397248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217358, "uuid": "09fa8172-cf93-4dd8-aed8-6f1e4d416a90", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217358, "uuid": "bb891f23-27b0-42ee-b1be-8de59f60f49c", "value": "spices requirement.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96590b44-c94c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1623261634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623261634, "uuid": "feb0ba0c-150d-43e0-b766-18fb6f97237b", "comment": "Malware payload", "value": "c5d1b1cc6f3f9d751fad8cfe369431f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623261634, "uuid": "7c6166dd-6f53-4ea6-905c-7ce93ef2594b", "comment": "Malware payload", "value": "f3b1d3c57cfff9fbaad9ba8e379cd434c626cbda1755aac246367749b776a7bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623261634, "uuid": "f70769c6-d6aa-4c6d-9d74-d01ab0f46809", "comment": "Malware payload", "value": "13b1e23504b3be882bf3c6b8a99a336fcf748bfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623261634, "uuid": "6afc9187-e98f-4e64-9386-007c30d3dd81", "comment": "Malware payload", "value": "1d8245594c15214953b3bb2d717e4717059211f264ac4a24359f7a85b7ba2348685c72271de8242dd9e35fcedb923be8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623261634, "uuid": "0bbaccaa-600d-4706-b60b-ac3b6ddddd1f", "value": "86C4231021D1DEA7D5D35AF39276AFB2D3B26B01233622571F883E476D26207ED0D4AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623261634, "uuid": "ad715106-7b40-435a-964e-977290ee5753", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623261634, "uuid": "99523ddd-7bcc-470c-a232-ee31f7cd295e", "value": "12288:81hrmyso3EhB4o91eDLoqD2vJGIIR1BYgayrWfAOS7/tNRseQ0e0PB3R:8vrlF3E91zRRGwgD3OUh9TPdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623261634, "uuid": "7cc37298-6875-46e8-a10e-5aded309e1ee", "value": 543439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623261634, "uuid": "6acf0eca-dfc6-48ff-ba0f-9d5ec82f5c7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623261634, "uuid": "152bd39a-d7b8-495c-988c-aa583de0d455", "value": "SecuriteInfo.com.W32.Injector.AIC.genEldorado.29599.23008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2616f0f8-c8e7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623218066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218066, "uuid": "e750ae37-f6c7-4db6-aa9a-e012fcdca798", "comment": "Malware payload (AgentTesla)", "value": "c95d59467566e3a3727d2f1c496118f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218066, "uuid": "232408dd-45f0-4b58-8786-248ff145a7d1", "comment": "Malware payload (AgentTesla)", "value": "f408ea148b23449b7fc7db69c2f6585d441043cd1b4a60957af3bc9b188b8480", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218066, "uuid": "a98d6049-d977-4b6a-90df-ca10c14119b9", "comment": "Malware payload (AgentTesla)", "value": "465dae38ae62404359e0e0dd1533159c6d359e9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623218066, "uuid": "bac13110-5820-4249-bc29-2c9ecf526f69", "comment": "Malware payload (AgentTesla)", "value": "90fbc67569643727637c4985c3956183fbe2ff2af28b108483ce54461431a4dee3ff51daebf6ff8215f6e5503427a395", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218066, "uuid": "f691db36-567a-4838-a84f-a5a301dcb59d", "value": "121546EC95004BBDE0F54F4A7B6970BE7A166209B73150AE3C070DF7E36DA9C6680A5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218066, "uuid": "97c7725e-e226-4c17-b668-f1ae807a233a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218066, "uuid": "593c9dd2-2f20-4e32-8f0f-c6a7f43a5d2b", "value": "6144:evSNQIrlkBJtyXmLIM+k6KRsyLSxt5/aaAXyPJwZD8OLgly+mK9:evy7PAXQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623218066, "uuid": "b79a2221-6e42-4186-9a07-5cb4dd502b55", "value": 938808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623218066, "uuid": "f678137f-ab41-46d4-9e04-a0690a91c05c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623218066, "uuid": "2d30035f-377c-4c99-94ce-b6e909627018", "value": "Chinese New Custom Rules and Regulations.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0d32145-c92b-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1623247585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623247585, "uuid": "c6da438f-2740-494f-aa0c-ad94da1063e9", "comment": "Malware payload (RedLineStealer)", "value": "c478a53c6dc63c73cc1a828619b3f729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623247585, "uuid": "5d1faeec-5dbf-4538-9356-67cd859fe94c", "comment": "Malware payload (RedLineStealer)", "value": "f4a40d6bf3a266e83bbeb76bd3c865b8c3e925a16f890d107356c62563de3f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623247585, "uuid": "6be14f2c-699b-4ad1-ad51-4dbafd5fd122", "comment": "Malware payload (RedLineStealer)", "value": "f4136cb7451f37a2e846fa9c09c402cb7603e25d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623247585, "uuid": "75ffd842-0216-4c7d-9b21-7f4f7aa6a685", "comment": "Malware payload (RedLineStealer)", "value": "8c76fd9153377dcdd16d361b918a2223383633f0004167c9ab6f29f5b10ca2f44ee4c100dc8f422017345effa762bd36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623247585, "uuid": "28f3a3e8-b17f-40df-8d9d-deea395cc52b", "value": "FFA533223B98C5BFDAE319709E8615E544F9AB211315C8C36B917D4B6D213E2E3383DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623247585, "uuid": "1c96a651-aabb-4c3b-b989-796c46fe1a92", "value": "011a034751880c1944da3b5ecc18520d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623247585, "uuid": "ffabae9d-a0b8-4a2e-8b02-a5533ac2ad0e", "value": "49152:4NNdcExBWbr4fNtPbSTJZyPeGTinHmZTYys:4NjVxUbiNYoTinoEys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623247585, "uuid": "62ed96d3-14f0-4328-853e-9e40a1bc959f", "value": 2237271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623247585, "uuid": "c9c73582-5fcb-45f2-8e5e-eea4b85c9057", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623247585, "uuid": "7a7231df-9c4a-4d07-8fec-e065e1a3dd55", "value": "C478A53C6DC63C73CC1A828619B3F729.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341d9161-c932-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623250302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250302, "uuid": "ae911f32-5915-460d-a365-db94fcaceec8", "comment": "Malware payload (AgentTesla)", "value": "f86b14c90a4eabc844a257abebd8a614", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250302, "uuid": "64c38009-0256-4196-bc72-4b67bfa93dde", "comment": "Malware payload (AgentTesla)", "value": "f4b39a7e09bbdd05663f9ff8b125cce58bab4f38ee63c6fbfff5ac0218d6ffe6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250302, "uuid": "74610795-eae7-4256-861e-c0b49e382ba8", "comment": "Malware payload (AgentTesla)", "value": "e9f5eaf9e8e1476eb7e926f3755f6c1205010686", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623250302, "uuid": "3faa3e96-ef60-4116-a706-751ff0db7682", "comment": "Malware payload (AgentTesla)", "value": "dc7a5b15f906a1e4a7275c1206770a0ce470cb50f696d4682441a5eb0054bcbe58f578ee1922d6d76bf29fb68513ba99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250302, "uuid": "853ceba0-94d2-4398-8a09-f8d2507a6459", "value": "8755103F15BE122BCEBCD39547C4550BE4808BBB7411BD29E8DB17994F29A4279C223E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250302, "uuid": "7d461031-54de-4b2f-921c-bba28692764a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250302, "uuid": "dbbfc019-7906-47dd-a045-ac8c60138876", "value": "12288:UgOogQ1W9nn/vHd4KVvd29Y516AKDgeNttGLWwnIKaFqFm2XXN5:LOU16vHSK2Y516AKsYttGLWvFeXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623250302, "uuid": "591e1e68-454c-4e02-b1dc-a40b87e1e935", "value": 1333248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623250302, "uuid": "224f816a-40ae-4858-ada7-e1b91ea08a20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623250302, "uuid": "2ddf0b74-b728-4396-b812-d013177ac6e5", "value": "SecuriteInfo.com.Trojan.PackedNET.831.28325.8984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829beb54-c8f7-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1623225093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225093, "uuid": "aaf1400a-e574-4c06-90fe-5e969936ed24", "comment": "Malware payload (NanoCore)", "value": "b7fece0a9529306a2644ce102fe2d86a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225093, "uuid": "8a4b3ca0-fa94-4e0d-9863-71b0d2a774eb", "comment": "Malware payload (NanoCore)", "value": "f9284667090735eccb6110c4c9e33122890570b6f10798ef57370740c4d9db6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225093, "uuid": "2f25f426-6cbe-40c4-9ef0-db443bb02ba4", "comment": "Malware payload (NanoCore)", "value": "767fcf70a98dd70d9035dfe4fcca04e17cdebfde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623225093, "uuid": "08f9e718-1770-483b-a267-89e2ba0f82a3", "comment": "Malware payload (NanoCore)", "value": "c9110973a3ef5bb3fc5ad4effca590b6f703760d3dc84d1af124288b6ab32aa9b123e15cee3cc8ee98d19ced1cd15a7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225093, "uuid": "a3cbd811-927a-4a3e-acc8-4d178e135b01", "value": "35D4CF917A4442E7FDB889322322F1701E233CBFC7ACA55160D43B1B167568EEA25FE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225093, "uuid": "caadbf8e-a098-4121-9cec-0b699103fba9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225093, "uuid": "9cf6df52-bd65-4852-8e15-72ec195808ba", "value": "12288:v3SBz/P5DgjDjNGPZk3Zg1Ke0lC8+lEvKlJfF05Ibmu9EgeIKxAtWO:v3IzJDgjDjNU2Jg1t0lCb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623225093, "uuid": "37560bb8-7f4c-4790-8c94-288ab8d84464", "value": 607704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623225093, "uuid": "3598765f-2cbf-49a9-a9e6-8a90e37664c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623225093, "uuid": "e83699f0-3096-46a5-baf1-21d1b14fd02a", "value": "DHL#DOCUMENTS001010.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1145dd-c8fe-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1623227899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227899, "uuid": "b076423c-41e7-4f4c-a08e-9d459b77c509", "comment": "Malware payload (Loki)", "value": "da6af6155581c0803b4c5b58e697b9c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227899, "uuid": "23602d16-e882-4fc1-bf27-66072e2dbb0e", "comment": "Malware payload (Loki)", "value": "f9730987faf0f6cc1bd369f26c68bb4ed109eefb032cc6156a5f878cc1b51ac1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227899, "uuid": "47df09ad-ce2f-4f60-a00b-474d8e328b25", "comment": "Malware payload (Loki)", "value": "5aa26abc18f6125d3cdece60335e2a46054a468f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623227899, "uuid": "a5fc092e-8699-4576-82e5-ae18b80c858d", "comment": "Malware payload (Loki)", "value": "f38560bac6bd2849cc53f8f87219301c97003b4cffb668167566854facce5ce7eb285a371afab2cae2b26bbc23be19a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227899, "uuid": "5e9720b4-38bc-4026-a5ed-0d0759d14025", "value": "88E4DF251748AB24E17F87BAC061400447F5F603D723DA8EFED588DD2E223CA976FA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227899, "uuid": "dba0bcfa-19ce-4e16-9df7-cc270116dfff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227899, "uuid": "4bd393c4-3e70-41d7-918a-eb08fa2ed330", "value": "12288:FtqplMV40JI7khw5XxTR/rUwPq5Z/9JIFnV+X7URGla0:FtqpUsNnPqda+YIla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623227899, "uuid": "8e554a09-821e-42bb-a653-5f870064c15b", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623227899, "uuid": "90a6e808-3bcb-465a-8589-3865e4a9d09d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623227899, "uuid": "30a416ae-962f-45d0-9ea0-ef8170fc3383", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9c0bdd6-c8e2-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623216140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623216140, "uuid": "f768d12b-845e-48c7-8e51-b8319f5c90b8", "comment": "Malware payload (SnakeKeylogger)", "value": "bc08e5e6ab5336466498a55637e66eca", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623216140, "uuid": "fc5d498b-e339-4668-8ce5-829eab180ea2", "comment": "Malware payload (SnakeKeylogger)", "value": "fa3452ac545d1ada17f636a91126ec7590b957f48cade82cd7c257a3fdbc3f37", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623216140, "uuid": "e9608d78-a471-4a46-a151-018702463ad3", "comment": "Malware payload (SnakeKeylogger)", "value": "58bb6a1deaa1522453267008ec6f82fcfa666f56", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623216140, "uuid": "5f76ee85-705e-430c-8cdb-ef3ae2149806", "comment": "Malware payload (SnakeKeylogger)", "value": "db737dfe551f289ab79f8e7fbf9e6ec11ef7aa4be1ae1bb871220f66bbbc26eed26bc7c0ef20092cd1321f32a8358a3d", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623216140, "uuid": "b36a2750-0ae9-496f-84f1-442bc35d8ba2", "value": "3BE433E4ED46BF076FBEDCB3227845AE4682C4930ADC5D5CD9A216258F65FC0620F683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623216140, "uuid": "d9a55ddb-155a-4a3b-9b65-4055fb02b7a2", "value": "12288:LrYmSWixe/RsGuRYwyWHykRsxxTkjo5wNmwpCQEVvDpcWXxhBt3Klfn:ITLWRERVy+yk0KjHNZk7HXLb3Cfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623216140, "uuid": "0b903dec-ac0f-4f22-bf55-060c6188e5fb", "value": 706010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623216140, "uuid": "d1ef063b-f6aa-437d-be8c-c75ec1200986", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623216140, "uuid": "6f1a15c8-37fa-4c94-bdea-fbddcb6f8cf0", "value": "Nuevo orden. PO.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e418f9-c8e2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1623215949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623215949, "uuid": "3b224b27-81b6-49e3-a90f-1a17f6faae06", "comment": "Malware payload (AgentTesla)", "value": "7dace3f0331ea493fb87e73b458187d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623215949, "uuid": "e526b23c-1059-4154-9357-297837168f62", "comment": "Malware payload (AgentTesla)", "value": "faca737d4aa23d55f6d5e25ce2b47f8f5060b8b62aa472073de85c50a21347d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623215949, "uuid": "02f0a344-b4f4-42a2-9f60-390e8c54dbc1", "comment": "Malware payload (AgentTesla)", "value": "826c4cc507cb0af478399eae982119a7733df296", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623215949, "uuid": "1d38ca53-9d5f-45c5-84c0-a7900b6df342", "comment": "Malware payload (AgentTesla)", "value": "94f59d054c97fe84ccacd4ff4fef3b66c2c493a56c25be22dcded0398448847aa295b0c6e2e90d1e1f9f46e14196943d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623215949, "uuid": "4c02dbf2-ee65-4781-9cc1-4e015e96f5bd", "value": "BE0501163394E911C3AE1532CDCF406887FADE423673EB657C8932CE5612B92ED16ACD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623215949, "uuid": "10a14fd4-f344-4285-892c-01a8f19a7ace", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623215949, "uuid": "3bea875e-0fbe-4900-bde6-0c6518cd0d78", "value": "24576:mc6TCRMUVYtXiZDnqOSVboYiqmhG3PMQhCPUZRI/F6:B6bUYtXiZxSVXmhGfMWCsZa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623215949, "uuid": "9797f32e-3b65-4636-a0b0-4121749564d6", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623215949, "uuid": "1858e3f4-d44c-4306-a05b-6aa53b603222", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623215949, "uuid": "174aa1ee-45cb-40c9-921f-78b7006b9fc6", "value": "BANK DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee09765-c8e5-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1623217168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217168, "uuid": "bbb5c277-96f9-4f9f-90a3-7becdde6ff9c", "comment": "Malware payload (RemcosRAT)", "value": "99beb2bebc8248572ded390c0aae8f76", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217168, "uuid": "54719612-39da-448c-89b0-04072c885623", "comment": "Malware payload (RemcosRAT)", "value": "fb96ca5c0b97a8832fdcac5ec79c03255b29e602c30575bca2f2a054cb3d4397", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217168, "uuid": "a07718f5-d276-458e-b1b2-4bf0d2bac395", "comment": "Malware payload (RemcosRAT)", "value": "dc5a1426c3c708f83d829136c223d466fd1d5a47", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623217168, "uuid": "1980a2c4-5284-40c0-9aaa-b4222f89bd84", "comment": "Malware payload (RemcosRAT)", "value": "80811e5d1e7e315326aecc777e7c2f317e1277e649d95c3bfb26f483bd790aa5ddf7152a964c376bd4e83f9737cc6196", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217168, "uuid": "988cfd41-fda9-4f21-84e3-e189fc474474", "value": "2F026AF8F9648EC2CF87D091907ABF6A0123786945C754C0BA7CF7240F9635A6A978A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217168, "uuid": "1873b89b-5547-4ee7-9aa8-0210b2c54240", "value": "192:uPByZx/FVI3tbOV7Q0dj2p7NULf1VFxTTVMMrQLgNf20B7k:QO5/EbKfh2pRULN1TTVPQM7B7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623217168, "uuid": "8183c9a8-59c6-4849-bea1-dcc2826b62b4", "value": 8238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623217168, "uuid": "b6581fa4-47d4-438a-a318-59854afcf17a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623217168, "uuid": "775ec8b9-3cf3-4716-8ab1-9e383f77fee5", "value": "Kangean PO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6314613-c8e2-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1623216160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1623216160, "uuid": "f926b793-5290-4cc8-8255-b95812b8ceea", "comment": "Malware payload (SnakeKeylogger)", "value": "a9d1ad5cde7d461e0756e1d70bb91d7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1623216160, "uuid": "0434ab73-f227-44e9-a522-38a7760846da", "comment": "Malware payload (SnakeKeylogger)", "value": "fc4e2ba1dc3c25186846ec42f5ef46d77cb31dcbd8065445ae7a597323a0f0a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1623216160, "uuid": "e985a74f-0501-4e11-a973-c88bbbd913f6", "comment": "Malware payload (SnakeKeylogger)", "value": "6dff669d182d0814f9cd72a49af5cb4252341df8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1623216160, "uuid": "840771da-4e2a-4bfd-bffa-a4c2c0a46633", "comment": "Malware payload (SnakeKeylogger)", "value": "c8ea8f5f9c245a8420c0bf0b697b20d41a0d39af2c65e95ce23bc56ca1c34b13cbd823389a429556089b26ffc8af6313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1623216160, "uuid": "32c0d5a2-2717-4c79-91b4-ed3f79ad4156", "value": "5105F1223650EA51C3AE5036DCDF015883F9EE033673DF6A3D9832CA19527A6EE255CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1623216160, "uuid": "ce8bd866-78ca-4495-a367-daa225562fdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1623216160, "uuid": "789dffaa-bb18-4057-9333-bca64580ae84", "value": "24576:jUU8wGUVYtXiZ0eQcoDBlO3/R3E72ZTx22LBEZRI/Fq:TmUYtXiZOy/R3E72ZTwRZa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1623216160, "uuid": "6e7a2562-eebc-4147-a05a-a54cdaecdc87", "value": 816128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1623216160, "uuid": "e1da23a6-e4c4-4544-868f-0e435fe3cdc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1623216160, "uuid": "6f855cba-198c-411f-a917-4f3e9c709062", "value": "Nuevo orden. PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" } ] } }