{ "Event": { "published": true, "date": "2023-10-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-10-27", "timestamp": 1698451381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "00993a8e-64c7-4036-8238-ef7f955222b3", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf00e36-74b8-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698404782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698404782, "uuid": "85bb27f2-318f-453d-97d6-5947a09fc33c", "comment": "Malware payload (RedLineStealer)", "value": "8198216f5df14120793be36637bbfe7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698404782, "uuid": "00ca9877-94af-4bcb-a8b8-2202b0feb121", "comment": "Malware payload (RedLineStealer)", "value": "02603da7ecc81e650b835d325094d4ff9e75d1640f06eed634c09b77ee207b95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698404782, "uuid": "ca961866-e33b-4a83-a1fc-81aad06373b8", "comment": "Malware payload (RedLineStealer)", "value": "d3c507753f8e284f6c5e6e3e8aa8e75c47f87c8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698404782, "uuid": "38ed7979-e853-4326-a40f-f3ee8e5ad369", "comment": "Malware payload (RedLineStealer)", "value": "50d765ae57483420546a03a3172ecfbb85f7b2a2c4f95ea2d164f7178e4394b653e59f20f1bb30137f328bd57302d1e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698404782, "uuid": "0b9f7076-8e2f-4e9c-a1e4-50637f0e2958", "value": "T11E7523A776D8C492D8BE1B3074F703CB0A177DE46C98C69A2B9694490DB2684F57333B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698404782, "uuid": "38862517-a3ff-4092-b591-bab041cc8014", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698404782, "uuid": "1283c3d7-d1d4-49c2-93ab-8411fce9951f", "value": "24576:Qyf8ANxTpIGZOGnYvyePbe2bDW2I+3M8nPyzTi6sDxVRw3VvDNGmK8Hlg:XUANxTpIGZHnY9Deuzyz+NxTwVD4MH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698404782, "uuid": "88498c90-80da-4c06-93a7-ae0274c741e0", "value": 1633280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698404782, "uuid": "bb21cb4b-e56a-4a47-82f2-40118b5b90b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698404782, "uuid": "962d208b-cac9-4ff7-9612-36294508ac3d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d9d221-7521-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698449537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449537, "uuid": "d86db2cd-6c63-48d6-afa5-991e368abf47", "comment": "Malware payload", "value": "3c064454689f91cceae0e34ccdc7bdd0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449537, "uuid": "79f3c408-a9f0-4f2b-a995-b82779f88a15", "comment": "Malware payload", "value": "029d436739841ff4fecc41808c53e6491d395f93757576a781f1791ab92834c7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449537, "uuid": "d81ac34d-8843-422f-a808-6dc5598648e9", "comment": "Malware payload", "value": "f0fa2102e3485ef1bb5d58a1aea029633a19dc2a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449537, "uuid": "f2c07b36-d870-471c-9841-421e98ca3560", "comment": "Malware payload", "value": "0dbf45331986e7ddbf10852488a1102ff489ba9ae3633ce011de4676deed5c90704e187d90916e69cc83e7c7b2da09e7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449537, "uuid": "012a9683-bdd0-4091-8009-061cc3bcd4c0", "value": "T1E143F855F8818B22C5D4027AF92D118E332367E8E3DFB2139E106F647B8696B0D37E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449537, "uuid": "1eeb9775-d0b3-43b5-8f0b-7395bdc6ed20", "value": "1536:RJng2Ke3tTQZoSgLyUpja5X3ez7IMix3JihBJ:Y1edT+dCWn3JihBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698449537, "uuid": "99405bf3-0d93-4daf-8ff5-8ec40188b72b", "value": 58676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698449537, "uuid": "58c9bc17-4339-479d-be04-12e793415716", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449537, "uuid": "b0b8d1ed-b2e7-4ff2-a7f2-c313fe3cc9b2", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52f25f8-74bd-11ee-8907-42010a9c0042", "comment": "Malware payload (RiseProStealer)", "timestamp": 1698406916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406916, "uuid": "377d9033-509d-4283-80a8-68820436af53", "comment": "Malware payload (RiseProStealer)", "value": "4a162f4587b5bb1161ecdf6f03a332a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406916, "uuid": "5cde4f14-9c1b-409a-95e2-243b09de6661", "comment": "Malware payload (RiseProStealer)", "value": "031ecb389e75acda19da96871994305ef69fa3976ccbd747588b10181abb41c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406916, "uuid": "645a9b1b-ce2f-4f9c-83b8-7a43cf65b0c7", "comment": "Malware payload (RiseProStealer)", "value": "c7b940fd9a4801ef2e80147a10eb88167d703ca6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406916, "uuid": "5ada5ad9-be04-45e3-a657-52c13087f6d4", "comment": "Malware payload (RiseProStealer)", "value": "513b94a670d3842e0219b1a6cc7e7515e422958afe268d81daf6e09ef37bd512076ae50992dbb3ad54986781ed9c5268", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406916, "uuid": "18e73400-b4f4-45ac-aca7-0d012bbaada8", "value": "T1F1558D71B402D037E1A101F5A67E9BA611ADBA3017AB08D7B7C05E7D94F19C36236F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406916, "uuid": "d7219bba-f4ed-4b55-99ae-3bb507ec5f13", "value": "25c8ae30cd1820a1b5b2591280c2ac98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406916, "uuid": "c3cf9187-e8f0-4389-8e27-19938e3d1e07", "value": "24576:MF9uwNfSKYFODIbxDtU9jyuSmsLNvwqsbQJWBMFbSFv/XsTRYc9W54KycnnC3:qgKal12UpkbQJW2FbSFXXsT59W54Kycm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698406916, "uuid": "2fae9c20-836e-45b5-a11e-600cfa71cc56", "value": 1315328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698406916, "uuid": "214d391e-3ce3-42ad-8138-c529470f2775", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406916, "uuid": "5a1f7b1d-6480-4d5b-951e-23b8d13c7d22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "049ce412-74da-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698419022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419022, "uuid": "ad688a54-36c4-47e9-b50e-9b29f97df4e2", "comment": "Malware payload (Formbook)", "value": "9e586f7fd61985554f07f4ba4cedd114", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419022, "uuid": "7d018499-9710-4b9f-b55f-3679533d35f3", "comment": "Malware payload (Formbook)", "value": "031ece46dd781d975d156062c2a83ee5fe08d733c1e2e52f591a34c31f2530db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419022, "uuid": "e8622af3-9678-4fdc-92fb-e900194837fc", "comment": "Malware payload (Formbook)", "value": "c312110c55b51e6e8094be124e548edcdfe9c7b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419022, "uuid": "ffb9c790-224f-46ce-8161-cd04c38344ae", "comment": "Malware payload (Formbook)", "value": "f4e89007705711c8a1858ecd87ee950bb75a531e613fe0a417467b6e7dcc8bb542923e9cb8948d6a31c5f42ee5040793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419022, "uuid": "931ab465-9214-4136-99d7-049a3c77065b", "value": "T1A0947B49F64489A0CE69933499BACC740732EDBBB931D54E20D93BA73F737A3142A057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419022, "uuid": "81f6e34d-5933-4353-b37d-7c2fa2d454b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419022, "uuid": "0239377d-2545-40f9-af9d-dc1863a0f478", "value": "6144:hrqKSzXtAbCc4O8ver9qAaSg4JJKYExzLzpQgzbL:hrqRFWrIQg4JJKYEFL1QgzbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698419022, "uuid": "e0017b22-a335-42d1-9220-9e1fadbea504", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698419022, "uuid": "b440196e-a047-45a7-b48f-80c0a8f4b9a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419022, "uuid": "b8f9643e-4d51-4702-88eb-111e79885d85", "value": "PURCHASE_ORDER-002404_2023.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f77572e-7521-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698449534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449534, "uuid": "b971f9cf-6698-4b66-b657-e5d0786602de", "comment": "Malware payload", "value": "567c62ea8bf5ee1c0817f6071b73212c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449534, "uuid": "1624038a-2a4e-42c3-917c-273a8890bc75", "comment": "Malware payload", "value": "04938a50961654fd02ed72715dfaa577c156c929560138f7d9d47085e8fc04bc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449534, "uuid": "c31af6cc-b915-4415-a895-f723f181a921", "comment": "Malware payload", "value": "f26af1a712ed0b7c7fb8edd1ec282fe241f957e0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449534, "uuid": "25f0a0a1-3df7-4bcf-9b14-6bc334017407", "comment": "Malware payload", "value": "793c54a3a3ba229cbdfc4e6397e7f004971a03b96afdfd75497abe04a68021415628c259a540bde692f4254d3e49f5da", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449534, "uuid": "34c0a519-dc42-433a-8f99-42f8ad62b83e", "value": "T16B231841B8818613C6E4137AB66E46CE3B2563E8E2DFB3179D221F503B9682F0C67F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449534, "uuid": "910660d3-68e2-4ac7-ad2f-7b8ace2b246c", "value": "768:hRT38FvJsOvEZU3JyvqKVtn9K6/8axU/PoV1K3/N+WzHn533LEw:P38Fv+Ovo089wl/V3XBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698449534, "uuid": "4d0ada4e-f496-4262-8880-d13481333b82", "value": 46868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698449534, "uuid": "1ab56972-e2fa-4763-a5ec-e94b2f3ba9f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449534, "uuid": "40d7ff12-f0d2-428f-9329-84382ace4924", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11f94f9-74c8-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698411607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698411607, "uuid": "3c26e67e-35a3-430c-9929-ee238c23772a", "comment": "Malware payload (Mirai)", "value": "2003297914a1d7f7a76acae36c30fab2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698411607, "uuid": "162df491-878e-4d4f-b565-098f967aeb2d", "comment": "Malware payload (Mirai)", "value": "04e133b1a9ef37a9e8c21e150a23b9109c7912622da6efd66f8b2e76dade3af1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698411607, "uuid": "3b72f599-e5ea-4d6b-8bf2-6ebe7e505387", "comment": "Malware payload (Mirai)", "value": "079eebc3e73d006622328f4a1367bb53c8500dcf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698411607, "uuid": "515bb023-f5cc-493a-825f-8398dc8c36b5", "comment": "Malware payload (Mirai)", "value": "d41c114567100497ea212e271dc6e11ac9a1fe402e74b8de4f4b1537e8b203223a69c7ed9974914e80fe44fde65d3072", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698411607, "uuid": "d544138d-6804-4ca3-9026-9ec32cf29bb3", "value": "T1BDD2D17096A91CB6C6500AB2E27866C4BD424F7DF9FF2C801101DBBB7D41D553ADE88B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698411607, "uuid": "6f89f36e-7a91-48d2-9048-c3d5cbdc1896", "value": "384:kot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEwIC2CmdGU5eT6Nuc:k8soTAZ3alkXLvFh8nNEwIi3UQet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698411607, "uuid": "c2f5a1ff-9e3b-43e0-9684-bcd08b45bbd4", "value": 28312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698411607, "uuid": "0f47e9ac-e619-4d4f-978e-c6d507b1c8e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698411607, "uuid": "91e66b61-1946-4be0-9515-ef017ef4fd90", "value": "syms.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c642eca-74b4-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698402741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698402741, "uuid": "cba091ed-f30a-4b09-985d-06109da5f140", "comment": "Malware payload (IRATA)", "value": "88c0b93d48b3af8b5bf08325498d6ee7", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698402741, "uuid": "a249f6c8-30c7-45a7-819f-6f8d87de14ba", "comment": "Malware payload (IRATA)", "value": "052bc74cb215a94af9328f9c2d627790bb24f81d51dcf8c7435aafabbcfce9fc", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698402741, "uuid": "29a3a078-b35a-44a8-ad88-f687b9b1f30e", "comment": "Malware payload (IRATA)", "value": "9fd05f2cd82ed3d5e618a1cdd30d376eda875d16", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698402741, "uuid": "4800dc3b-1bc2-4e1f-adc1-f3937ae0ffb2", "comment": "Malware payload (IRATA)", "value": "d96219a0d0fde37e04883d92afb026c1a8d02f40034612ce9db226c607503765f8aa2b9494a1e8cdd39609afe6a90c0d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698402741, "uuid": "fb18eef6-1d90-46fb-b37c-ad736203161b", "value": "T14DC52353F636A457C8F2C33221F52731267A4D2AD743E64E390973B958B7EE88B811E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698402741, "uuid": "9340ed76-e786-4fb6-874d-9fa3f92f2b81", "value": "49152:2T0qNmhQ+qnzZxwAmCyXFmcUD0eORSz6e0HVSk2UTwpWcsDPBx0JR+rxFoA07Po:yNF+qnrwtX4cURORS+pTwccMg+0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698402741, "uuid": "c89ae53c-dc5c-49b5-94a7-43ad29e41dfc", "value": 2667013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698402741, "uuid": "17de85fc-089f-476b-94dc-d1555b62e17c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698402741, "uuid": "28f95af2-e566-40e8-8459-54ac28c779db", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d7b963-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698422032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422032, "uuid": "3eeb6590-30b2-4719-b16e-f2e7ff6cbc47", "comment": "Malware payload", "value": "2bce80a2e9c37077f8b1aa782abe51e7", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422032, "uuid": "14c861fa-b2a1-4086-83f0-af5321d10597", "comment": "Malware payload", "value": "055f62ca4ccaba711efde83bc7a75ae98d2ef88609f7946bb76ae73bda028f7c", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422032, "uuid": "2dab9ec3-7e7f-4686-b673-50ed595a39ae", "comment": "Malware payload", "value": "52cdfee0584fe4a8834600833c08f53428c47c31", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422032, "uuid": "09ae6eb9-6a9a-4130-989c-39bd5ede96ff", "comment": "Malware payload", "value": "375a4b4ef6134eb1e2416fca26fcf64d57047dd776010c4bc8c7234324bb02f45ebd27a51766c2c05469ad5a04daffc1", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422032, "uuid": "20c5afb7-063d-4503-8f76-75ebb3679be1", "value": "T1EF723A3EBF975B7CC655D17082E38739F6F8F02012614B6D86F4D7365E60B24A32A908", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422032, "uuid": "8756ad85-c56d-4c6c-b858-3974b2a278b0", "value": "8b7d6f218f07082b5df448bc58285040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422032, "uuid": "49436b8c-aa5c-4d7a-8640-0586678db970", "value": "192:w3uNpN9G/Xw+I5lfWqV1vSMteJOvK7JJ+3VZhHPU4Xixgv4e/0HVGw66ho7oYr7l:YWT9yX2lfxV1v10JOw+Z0766huFr7Cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422032, "uuid": "2f472ccd-302d-4fa2-8831-3357d82ca1dc", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422032, "uuid": "49c0c035-9540-45f0-a532-9c8a67017808", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422032, "uuid": "542b87b5-fbcb-427d-a943-e5f9788b906f", "value": "Billing_Statement_NOV-23_O5.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432cdfc6-74b8-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698404524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698404524, "uuid": "4fd2a9e1-3971-40f3-b251-ce94b8238d54", "comment": "Malware payload (IRATA)", "value": "310fd1e457044eb380b3399da7b2c1fb", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698404524, "uuid": "4efd570e-c63b-4597-9dda-ad98bd58cb86", "comment": "Malware payload (IRATA)", "value": "05bc283776987c49bb334f6b651c90f6a8f464c4feae244839255f4d3a6b4a8d", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698404524, "uuid": "27045e19-d6bf-4313-a314-2498904b90ef", "comment": "Malware payload (IRATA)", "value": "3b42f3f57c66a8e495fdea3c8a6615445aed3a95", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698404524, "uuid": "db9a592e-5762-4bfe-ac93-1e1cdab81eaf", "comment": "Malware payload (IRATA)", "value": "99027d6b3fa7a8b4dd5c2c39ae6a085c40afa8255af58d95a55abad6f6a610b510cd092b7cf1e50fa20049c88a4daa8e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698404524, "uuid": "b8fa5560-f1d8-4192-bbc0-3520f9f01c01", "value": "T16A06CF97F399A86BC4F35372817523A542874C228F83EBC76D24767C68BB5C41E49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698404524, "uuid": "0faace32-4964-45eb-8c50-5efad493897a", "value": "98304:RdOkFv5BjsgLCr8DUgprAiaAdlS0zV861Xj8aZ:RddFnjJRpMiFXZzV86zXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698404524, "uuid": "42e3f9e3-c881-471e-8f50-167132b57b91", "value": 3868374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698404524, "uuid": "6d50447b-ab66-4541-9501-22b069088c52", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698404524, "uuid": "119fbcb9-818a-4118-bcca-f69188a2ddbf", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a75600-7461-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698367132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367132, "uuid": "3431b22b-2645-470c-bb9d-475ae23b9a8c", "comment": "Malware payload", "value": "df3ca957369096a3d57bc29f83f2f3bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367132, "uuid": "e8a1a706-e027-4743-bc76-e318507191ef", "comment": "Malware payload", "value": "066b90714357380ce40bd36e7df98c6fa18440d19a82f1c32bb93a3628c2ff68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367132, "uuid": "041cc8c3-e731-4ca5-8342-cda14068cc17", "comment": "Malware payload", "value": "6d1e12e74ae21f0ddaa4efba6ab841a8a53b7916", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367132, "uuid": "ad1fb42f-abf2-4812-b56f-24304255e5e5", "comment": "Malware payload", "value": "39b8db8e45b46a2f708e25b664c767bbdf1d9e50c51e7b940727fc2a8250de4964a80b5e76aa2b5d2b83256525cb918b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367132, "uuid": "97869d2b-ca71-4c0c-bda0-f8b2e04300bf", "value": "T182B4F12267C6CD49E5071834C4A7E1B8CE65BEA1A98483D379C0FF6F34B9D68F818935", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367132, "uuid": "6acfbe6c-ce46-4f8f-92b2-b42e459e8995", "value": "13ee35410613aa3684ce0f3ff96b269a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367132, "uuid": "da8e3685-7d9d-4010-b437-61b38c979785", "value": "12288:qwLejQ0WOaFPPozGMvvLwXke35GwAao3V5ilwvC:fxHwg/3LRo3Vslwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698367132, "uuid": "7f945115-0e34-41b0-88d6-cfc6c221d164", "value": 513536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698367132, "uuid": "a68d14d3-2544-463f-bad1-96930fb4ae5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367132, "uuid": "405b63c7-3fa2-4497-bdd8-3c1d194c2013", "value": "SecuriteInfo.com.BScope.FDOS.Nevroz.95.20754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa97ba2-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421886, "uuid": "82f5041c-26c9-4498-bc48-43b65bce5308", "comment": "Malware payload", "value": "7d889aa5ba006e7b06c1e784b28259bf", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421886, "uuid": "3d95a99b-9e39-47ca-8e81-dc8c639c7576", "comment": "Malware payload", "value": "06e5a2e6a8e8c7dff77e4dbe843e6dd5a5b24da337a5616c1ac2ef6c2b5dbe19", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421886, "uuid": "78428873-676a-48c1-ae5c-0d291d897abd", "comment": "Malware payload", "value": "fce8552f27e5904f991d45f248ba6364ca690fb6", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421886, "uuid": "750940c7-4743-4bc6-8fd6-24f9f89e17a5", "comment": "Malware payload", "value": "817b0e7d9ec16a6827487046cfa5146fc93dee030cd5acc5aba1d4779afb8928d931dd5d9c258d59ef6f24b42f335633", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421886, "uuid": "906ec8db-cbb2-4f5c-877e-3116c2f25357", "value": "T16F72192FFF97677CC855917082E38B39F6BAF01012514B6D86F4D7365E60B24932B948", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421886, "uuid": "7d865a14-16bb-4ada-b084-de2af86f697e", "value": "8b7d6f218f07082b5df448bc58285040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421886, "uuid": "df5fe618-eb13-4b6b-90c4-1e36b7c6f282", "value": "384:QWT9dyoWUlfxV1v10JOc+Z0zzZmhuFr7CN:Q29d6ox/10JAZIOuh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421886, "uuid": "bbd99ff0-3037-4a76-a518-ccd34a64b4ca", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421886, "uuid": "ba5a69d5-ffb2-4622-9350-6754bf3f83a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421886, "uuid": "96e469b7-cdf7-4419-907f-77bb40210457", "value": "Billing_Statement_NOV-23_WI.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3186a196-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698422104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422104, "uuid": "20d8ef53-3e67-4bc4-a781-7f671bcd5029", "comment": "Malware payload (AgentTesla)", "value": "f012e0c7d2d725bd8e33b95581b3cd53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422104, "uuid": "6d5420fd-bbe3-4773-8261-4538f5af18b6", "comment": "Malware payload (AgentTesla)", "value": "078b6de43b63f6b2207aa6a73c783a097dc8beb139224232dd0b7e1169c2a652", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422104, "uuid": "54bc11df-9574-403c-87e0-40ce5a848a11", "comment": "Malware payload (AgentTesla)", "value": "cb2b72995b6f806eb2f3f6bd1d8fe7c5eba01baa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422104, "uuid": "e44d59d7-a6d8-43ac-9c21-1c020a05465c", "comment": "Malware payload (AgentTesla)", "value": "8e5de9669e778e6442310a630f6bb2e02dfcce87e4b45f0d3d9f756a2328984289aae5099d935f6b65bced88efc48a6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422104, "uuid": "9203aafb-6ece-47d9-98cd-6667f5864fd9", "value": "T1DAB311526BEA2108B1B7BB444A7A51744F2BB9DA6D7DD54E01CC5A4C0BF3E80CC60BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422104, "uuid": "6fea6fcc-879f-4b89-87bf-23c1299a94b4", "value": "1536:F+be4Mi3mI2hb7KZ18C2NGkikGkFjGkikGkKEt0eEKU+kCKGWGPrbrbTDDpOAWG/:YeBQZxNj53e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422104, "uuid": "b18946f4-889a-4258-a0a2-2cf3cbb85276", "value": 110072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422104, "uuid": "2d24bfea-c532-447c-8d5b-6e53ec59e59a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422104, "uuid": "4040c764-aa95-4615-84d3-6ad21b6babfb", "value": "RFQ9-09836908879.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb1d1b4-7486-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698383117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698383117, "uuid": "0e8533d1-89a8-40cb-8dfd-724862d80212", "comment": "Malware payload (Loki)", "value": "aa9aeb09e024905ded8d30f9008374e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698383117, "uuid": "8deb69f8-dd42-4e4c-be5c-8e63ecf71b5a", "comment": "Malware payload (Loki)", "value": "07d26bb238634a32871c31fd1d845313fec91dc7495db7dd3714de28b1383d1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698383117, "uuid": "5e85e684-7296-4629-8b98-c00ede886877", "comment": "Malware payload (Loki)", "value": "fb8b692654a0279a4ae557db7e4c18269d2840d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698383117, "uuid": "323a6eb8-91a8-48ba-89d3-cf0b4ef95882", "comment": "Malware payload (Loki)", "value": "84ed7025df6ed522b75e4135fa03792f4cc152c1d3785d12762d1910a5bdb26bd80ac362f516f62d536e6e3c0ce758ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698383117, "uuid": "fbf03e14-9982-43f8-81fa-6c6437e5609d", "value": "T1D5249D2791F4C211C99257391998DECCED322E3A3D959E7BD848F426274F98CCBE09D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698383117, "uuid": "1666a366-c33f-4ba3-a382-76379564a27e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698383117, "uuid": "88b32db8-cccf-4d1d-bf2c-01799b521327", "value": "6144:Fa/b8OFnGwTWSi8L2ADCasPXP5G/Bpm7RowN:48OQwTE8yXiBc7RV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698383117, "uuid": "70f0b6c2-be99-40e0-a40a-3eee54f8b122", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698383117, "uuid": "7897de62-79dd-4db0-b8a0-942b7f67373a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698383117, "uuid": "4671715b-89b7-4990-87cd-6acb79e9c8d5", "value": "SHIPMENT DOCUMENTS ARRIVAL NOTICE FROM MAERSK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403c4d3b-74d2-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698415686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415686, "uuid": "0bd0f9f9-8092-47cf-b92d-003d52e7ec5d", "comment": "Malware payload (AgentTesla)", "value": "69d8f5764a41c25edff6a098ff64ac28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415686, "uuid": "bfaf0198-be8a-4805-90b0-8050018e9635", "comment": "Malware payload (AgentTesla)", "value": "07fb0fe43ef510bc658272b1e1c5e1ea3a449a6f7d00dbe73b35cf252b384cbe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415686, "uuid": "b1d70fdc-306b-4a4c-adfa-d77b44441812", "comment": "Malware payload (AgentTesla)", "value": "ab177d7f0c5b11aa107ed0235270ed13589bc900", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415686, "uuid": "eb677f5f-b004-4987-8ef2-fc513d481d7f", "comment": "Malware payload (AgentTesla)", "value": "b8994e4961dd470847e1d78b7c1283dbbf1c6f3d3c58cc39cd9567ac824144cc75a1033af56dba908c8d5a52fddcdd1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415686, "uuid": "c16aa05d-0658-41e6-8594-4c45bbbe75a8", "value": "T17593C01E3251E84AD1129DBD8DD8C0E752197C719E82EA0F3644BB2F087ADD38B4FA5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415686, "uuid": "3e12941c-44fd-4ab4-8053-57cbb666490f", "value": "1536:OPP5RL619IjvpQDC9uI8QhF6d+JgaDTK/vL4EiRl6N:+TLTm/I8AF6Gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698415686, "uuid": "f41311cf-776d-4af1-9bad-b2b47dad7107", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698415686, "uuid": "75f78bbd-58a8-4442-9dd9-22342e0b5281", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415686, "uuid": "230e1adc-d834-4482-a0b4-9b0ba1cd104b", "value": "especificaciones y cotizacion.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09d0a52-74d9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698418935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418935, "uuid": "45a5bab0-07d4-4b1d-9c52-54a6023ee85b", "comment": "Malware payload", "value": "9ae6e01abee643979fbf5a1ef50244f6", "object_relation": "md5", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418935, "uuid": "69dbcade-fa26-4b08-b1eb-b4043bbcc54b", "comment": "Malware payload", "value": "0a6f078064342c677a5a59c4a038a77b3053d7fa1c52839d3714885c42275a32", "object_relation": "sha256", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418935, "uuid": "1eaf9e30-0f46-4c6a-8547-114141e3d070", "comment": "Malware payload", "value": "07be7f48a5ef020a8677005974ecc3d7a2393246", "object_relation": "sha1", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418935, "uuid": "8edfb5bc-5430-4e72-85f9-bee61450f66e", "comment": "Malware payload", "value": "0e7d31906f62a5c2174d501dc652628943c08e3873e1e772b4a300199791772b0390466c9cf0e49df61c4c92841b17a4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418935, "uuid": "fef33407-ded2-412f-bbb4-4dd13f3df301", "value": "T13745DF07D804CB83D51D83F8BE434DE90F0A6F18E98969DB10577F8F3A31A625E9A51E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418935, "uuid": "2378f563-126c-4de6-8328-40e8af5dffdc", "value": "24576:AxBXZyrw6/X/v86e4Zylw6/iburhGJnUFQsTIZLeIyy0yLzsdT0bN:EF6/Pv86376/TVcnUFDT62VyPcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698418935, "uuid": "4d9a28d8-e317-4aaf-bec6-2a738e38957d", "value": 1186304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698418935, "uuid": "eb53b4e1-6bbe-4a28-bedb-5dc9dffa1ed8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418935, "uuid": "7e906911-f1de-4945-b8d6-43e14ec073b4", "value": "DHL WAYBILL AUTHORIZATION FORM.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac239389-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421880, "uuid": "e4f80837-14ac-4613-9007-a7b0a3bb51ef", "comment": "Malware payload", "value": "b635686f4ce8918f747a880f49978c4b", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421880, "uuid": "d80c45ad-a960-4542-bf6c-4dcc3f003d7f", "comment": "Malware payload", "value": "0ba1f057dd67c53e0829969b5c6ef7a3786bc8a29812b858e3f8fcc18af935ab", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421880, "uuid": "8ea7848a-ce53-4f1c-ab0f-d0ca6b74d92c", "comment": "Malware payload", "value": "a83a3dd978dc4a169db024e67062d6b31aab0972", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421880, "uuid": "926c811b-31a5-43f6-b4db-6600bd4424e2", "comment": "Malware payload", "value": "d1665d5fffbaf7127aa554807d772a268fceafa9a7dc8372d2abe9b2e50196f6ccc4f8344c889e1387553d68841f76e0", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421880, "uuid": "9416b3ed-55a5-46d3-8ccb-d7bee7ba196c", "value": "T194725A2EBF97477CC4A6E174C2F78B35F6B9F02002524B6D86F4D3395E24B24A32A508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421880, "uuid": "14822bdf-5dc8-479f-95ed-92472821a839", "value": "8b7d6f218f07082b5df448bc58285040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421880, "uuid": "840989bc-5eea-450e-ad30-49b9c1b2fe7a", "value": "192:sud692T8ap4PpsG4v2rjVv8oKlJOb67JJ+3VZhHPU4Xixgv4e/0HYZD1ho7oYr7C:/69+7pIsRIj6blJOU+Z06D1huFr7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421880, "uuid": "2e8b6950-526d-48eb-b6bf-2d0066ba6317", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421880, "uuid": "35663e09-4a29-4559-9a26-ca201096e937", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421880, "uuid": "6192b67e-c63d-4eb9-ab46-c46a81453ae6", "value": "Billing_Statement_NOV-23_OH.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414d25ac-74ed-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698427284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698427284, "uuid": "70013376-550c-42c6-b1ca-fb31e97b7d86", "comment": "Malware payload (Amadey)", "value": "2cf7d899e03cd3b6b1090fdd52e8534e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698427284, "uuid": "e6b215d7-3dee-4c15-942a-bbbac8f4769a", "comment": "Malware payload (Amadey)", "value": "0e50f248faca7dcfd1111526b3c587422efe6d62951d67f85bc0369ac0114739", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698427284, "uuid": "41b09da6-b825-402e-8143-33ae21c61a56", "comment": "Malware payload (Amadey)", "value": "62147ca29ad5e5ab55876355c711e1f2cc595f90", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698427284, "uuid": "777786c1-c8cb-428d-abc3-5c74c18c2143", "comment": "Malware payload (Amadey)", "value": "e79baad8f4576e9861ce1feefb9e638a358820cde3e442832d23db182900a414d6fd81115851f8a33493821443cf08d2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698427284, "uuid": "877f05d6-98d3-425f-bf8a-5595f55b9fbb", "value": "T1A22408657912C032D660A1B61AF4BFF6C19DA815ABB149DF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698427284, "uuid": "9a5e87bb-10a8-492b-9fba-404befb2bac0", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698427284, "uuid": "ccee4934-a175-4985-b14c-c4bb36a3099a", "value": "6144:DEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:DE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698427284, "uuid": "4d60cd44-8ca0-408b-90e1-0c298a2a839a", "value": 225576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698427284, "uuid": "c7cfd7f7-005e-4ca2-b3f6-97d4a72b01f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698427284, "uuid": "de381ca6-c6cf-402d-8254-b9aa4f67b602", "value": "5ip6oY3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd06f1d-7524-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698451141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451141, "uuid": "ab99bb8b-20ca-406b-b206-d82f4c29eb89", "comment": "Malware payload (Mirai)", "value": "29dcb687fc8370dabe13f7d42e57c19b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451141, "uuid": "5aeaf605-c0f9-4226-8688-1ced501436e4", "comment": "Malware payload (Mirai)", "value": "0e7a715e8eafd6ce008c56a216c858e5cd3a1e5d2f97f8ef60c6a246bf674a29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451141, "uuid": "163d7060-9038-4323-8d9f-3da30ec8cd7e", "comment": "Malware payload (Mirai)", "value": "488c986b6a1e20b40d30843d8cd9544552c47e6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451141, "uuid": "9322431f-0991-4558-a106-a87c510d80ce", "comment": "Malware payload (Mirai)", "value": "43be174c72742afe042463f4a64e47ef3c4e61480ba838c49d62e6c99410695a025f35a1e03242898912ac18672b48e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698451141, "uuid": "86b901bc-d83e-48af-b05e-ad34814935da", "value": "T151232A25B9761F17C0D1A8B521FB4B68B6F106CE26E8CA4E3DB20E5EFF619405503AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698451141, "uuid": "92cb8734-dcae-47e1-9ede-43866525ecc1", "value": "768:nxoZ6yf3xx1DEmtrBy1ZBJcI7s8+AIQjCO+AW31WwWQ:nxEjf3xPjrBy1/JcIA8tIQjgjBWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698451141, "uuid": "57bcd515-3abc-4d5b-910e-8f6a36c6837f", "value": 48856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698451141, "uuid": "11194140-e9a5-4749-a81a-60ef570bb4bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698451141, "uuid": "a4066dda-a3d8-4af8-83f2-2639ff5f7b91", "value": "29dcb687fc8370dabe13f7d42e57c19b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c4d59b-74da-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698419024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419024, "uuid": "d06b2308-8fe9-4a10-9496-26305071a267", "comment": "Malware payload", "value": "a2e7a8aa46dcd3649535e3abd762185e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419024, "uuid": "3de4a674-a071-4917-b042-10fe32c1bfe4", "comment": "Malware payload", "value": "0f7b65e91d193fdfd3a0fc1b07e875969c2bcbf1ba80bcf7320219ece9df159f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419024, "uuid": "57b0c0d5-0ab0-4036-9b3f-f572f2e0a928", "comment": "Malware payload", "value": "8e970efcdfb7dddb2b39635a3591227af1f74480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419024, "uuid": "b8a09380-9ac3-4de7-90d8-6ac6e77e6dd3", "comment": "Malware payload", "value": "12d70ed011f9c26bec87a24d9dc49d8feb46a0e00f9adde4c1c00cadbbc9da61f014d208f95a2e29ade2298e6abf10d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419024, "uuid": "9e0c68a6-7387-4583-a5d1-dc74eb670a15", "value": "T1E7054A4AF6445991CC3983F42936CD751722AEBF7834C09D18D97AAB3BF67C3202A593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419024, "uuid": "a86a0876-17c3-4949-81e7-85a3fb0ac64a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419024, "uuid": "752e37db-c3a6-406c-8553-4efa5c1b8cb3", "value": "12288:5WoTqWrIQg4JJKY0FL1CgzbL3SPzWbIQg4JJKYkFL1QgzbL:XMQh+FMQ33SP6cQh+FOQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698419024, "uuid": "03bb5aef-c8df-4f64-9eff-e2fdba1a19a3", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698419024, "uuid": "834faaab-ad07-465b-bdb8-a733e5969616", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419024, "uuid": "47b4b22d-c14c-4e57-83aa-916f6a0ff2f4", "value": "a2e7a8aa46dcd3649535e3abd762185e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1f77b8-7501-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698436109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436109, "uuid": "ad8aeafe-207b-4db4-b71e-58321b4ecabc", "comment": "Malware payload (Mirai)", "value": "eea0129a334f06a7e233ccb2ba4bd030", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436109, "uuid": "5e06a233-9146-4c70-948d-3c135b0219ba", "comment": "Malware payload (Mirai)", "value": "0f8c1a0eaec446f17d8ed9c82ce2ac882dca17344c2077eb0077c2868f0a9c5a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436109, "uuid": "694b25e6-194e-4dc1-8a1f-5c18cc6a4a87", "comment": "Malware payload (Mirai)", "value": "d209b600d370b38316a7d576665e2d04b44f2971", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436109, "uuid": "5596ae05-b5f1-4239-905c-441ac29c63e5", "comment": "Malware payload (Mirai)", "value": "5cecd2d0132ac8202f48068f5349fcd6af474c517ad652433ad2306d4b06bba1c0180552c274cb20326e7123951dc753", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436109, "uuid": "616c7b0e-2967-4cb2-b2e4-6039ddc4bdc7", "value": "T160C2F0659228C471B4B05436FEAF01036636CFF8DAEF322622244735A097D26E6B5B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436109, "uuid": "208b6970-c48d-439f-b9df-54316b51f4fa", "value": "384:KBH2HEdV7UQDoYQHXxcjllK5+AWaFmK0MF9lz7X6AGexXVzonBY6plN0AQrhymdU:byNUQUfhQllxlaH0MFjlOnGsCs3Uozt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698436109, "uuid": "bff59682-b3e3-42a3-b3bb-40c9d44ebd16", "value": 27344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698436109, "uuid": "e371ce02-887b-4bbe-85de-aaab5a0f01ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436109, "uuid": "e915ae4b-6f5c-42d1-9761-03b5b22c7182", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519fcabd-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421728, "uuid": "a8f84fbe-dab1-473f-af55-5ba2486ea687", "comment": "Malware payload", "value": "6e854f5a57628d8957fbb55baf12a340", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421728, "uuid": "5a87ed46-d7a9-4ef8-a5c3-99a15af2a05a", "comment": "Malware payload", "value": "1066262567df448ebc9a211ea86bbbf6ad9e4e925af2d20c1d348b3007aa5077", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421728, "uuid": "fbd6648b-7245-4897-80d0-2efc84acb2b9", "comment": "Malware payload", "value": "631db18a2d2f2785bd9dc16f3204f4fcacf98405", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421728, "uuid": "0193c1ab-80d9-4a0f-92a6-4f8d6ad16a93", "comment": "Malware payload", "value": "2625cd084ff7d006c7ae4796caa25ab7488783e045381277faca7362c4762a937731515cf4df52db5efd6f1f16cfc823", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421728, "uuid": "dfbf498c-40a9-4847-802d-d42e681a6bdc", "value": "T1BFE4234C1105139BCBF886B2B849F89FDA47B3A269077DDD766A2F75B4C7AC0031690A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421728, "uuid": "fa3f4858-29b8-40c3-bd22-db98772c65e6", "value": "12288:YuxFj4+fDPV2Z7hkZtvPraX8jAaQ1xU3mqdOiZulv++2PYtwJMqNSWToIG/YgGaI:ICB87hkZtlcP1xwm5iZulvmPYK79ToIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421728, "uuid": "958c12d1-c7e9-4834-a024-b5f70dd0cfe6", "value": 692107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421728, "uuid": "45039c43-1a40-4fb3-853b-10b410fe6ab9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421728, "uuid": "60b96f43-ff5d-4a7c-ad15-cb7121b97ab8", "value": "Documente.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737785de-7491-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698387855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698387855, "uuid": "2c3f3e1f-05bc-4954-bc65-94af55e7acbd", "comment": "Malware payload", "value": "3e2e2663ffd516b3112868ce41619480", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698387855, "uuid": "9349fffe-c5a6-4d48-8a96-22c00b0fd277", "comment": "Malware payload", "value": "1351e32f3e52169c495d65661e9a5bc1f963af568b01010dac7949e5fe883a7e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698387855, "uuid": "ab8a929e-37b6-40a9-97fe-67d5bcb36dc2", "comment": "Malware payload", "value": "27a1edba1d2a293023caa139c2d629bbfd58cd7d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698387855, "uuid": "85bad607-6724-41cc-9c5a-e3a3a693c28c", "comment": "Malware payload", "value": "c7d9673d83514c1fa25d633e965ff42800d1846ab3e255a99a531b5abdc0d47ac981d05cf0256fd396c765c636eed542", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698387855, "uuid": "896a0ae5-5e01-4703-b8a2-e21ed4d34f46", "value": "T1AAE4337FE185E962AC344CB9B3C3529200966E1635A1C86F656B75C4BFF301ACA37AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698387855, "uuid": "e5b23081-3348-4653-966f-d0b2380e80d0", "value": "12288:FiSxbCu6hoGvzMmmxYrtBYMgofKxNtyKDR8Ooe+HN9aL/+qoXQ4VmgUoQ+pErt:eusHvDgYprC3tHEleLLuYgdQ1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698387855, "uuid": "5b47e10f-52cf-4892-b50b-2275a0984ce5", "value": 716695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698387855, "uuid": "72add977-5f45-410f-9472-ad34e1f47459", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698387855, "uuid": "f9b1a6c1-a9e0-4c11-a511-c60521b6eca8", "value": "SOA SEP NEW.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86b6d75-7490-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698387621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698387621, "uuid": "5494af45-3ae3-4398-80c6-0c86f46442e7", "comment": "Malware payload (RedLineStealer)", "value": "1dca0b304ba53a4a788814e90fe23306", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698387621, "uuid": "55f9de01-521c-4505-b882-0cd76a0a86e9", "comment": "Malware payload (RedLineStealer)", "value": "140653704128a6aa88f80e80b387e87892367b26da00e392e9ccf181bb48408b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698387621, "uuid": "30803431-8c42-4506-9720-c0f39130b883", "comment": "Malware payload (RedLineStealer)", "value": "ee16c11d8459d965f7221255c6f1c677f0eb996c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698387621, "uuid": "2007a810-639f-4616-ac52-b69b363aefd8", "comment": "Malware payload (RedLineStealer)", "value": "93cb8dfcc6406ed664a31a2449960a88187845f10a9c42451fd6858630e3fd7f28bbd437a7faf4be4f87ebfa9950a27a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698387621, "uuid": "451881ef-01f9-4d44-b579-025d7d359a5d", "value": "T16DC5D05336D44061FEA5327CA7930AC60DF33E82E6B489F925BBBC066B735917638631", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698387621, "uuid": "1bb33d3f-4a33-4384-9ea5-2f38587012fa", "value": "8aadc1e04127fccdb3e29df493f299ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698387621, "uuid": "4c13efa0-c13f-4b57-b75c-b539cd4a44a6", "value": "49152:k+6SyoUT3GiZ5cl6sJWJTLc4YFkIQSfmlilQEjolBCwJaZ:kTYsGiZ5cl6swcl9QSfWzgKC5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698387621, "uuid": "bdc5faa4-5158-4f27-99be-8ee1c17111d6", "value": 2554096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698387621, "uuid": "e6f72c14-6772-4159-bc72-e2f68c229a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698387621, "uuid": "ed248887-ca36-467f-a2c2-133f60a6219d", "value": "1dca0b304ba53a4a788814e90fe23306.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70ecc5d-7524-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698451158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451158, "uuid": "bbed83a9-7ab3-4364-b300-80a796037f23", "comment": "Malware payload (Mirai)", "value": "0b461952c9ee17d6cc362785b2f96fa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451158, "uuid": "73afcec6-a905-44b7-9445-3d202577ca43", "comment": "Malware payload (Mirai)", "value": "15c52fe3a4a084bcbdabbd6bba4304df5edc9867b37c91dfec24e95c11741341", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451158, "uuid": "2267b5f2-3cea-4536-83d6-34ae9ce79dce", "comment": "Malware payload (Mirai)", "value": "79179900b8580575f2b5435bfffef8d5eb8ae5dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451158, "uuid": "22af159c-a03d-4935-829b-c90f4d4e4333", "comment": "Malware payload (Mirai)", "value": "a743361afbd9b44ab2eedd2c1ddf188d007e82a50b304fab46e3d0ce61c75ab42c41b65380856a912ba0381a51ba3270", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698451158, "uuid": "1573bf5d-b035-40dc-a80e-dc1059c9032b", "value": "T1A4137D7BE4AE5E54D0460230B4689E341F13F6C493536EF71EAA82A15487AECF905FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698451158, "uuid": "08d96add-ef05-4929-90b9-5fd565abfb24", "value": "768:WaRH4ge4hYyFDinQT3yMILrzCideITC3o9C7N8C/ww:WaRYghh/FmnQyMiqid9Tf9e8C/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698451158, "uuid": "03e5d730-0e66-4766-800d-020dbdd308f6", "value": 41980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698451158, "uuid": "c19cf53e-5621-40cb-a762-52aa61be8efb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698451158, "uuid": "c37a3ae1-eff8-42f9-8496-52b0c071e512", "value": "0b461952c9ee17d6cc362785b2f96fa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6dde70d-74c2-11ee-8907-42010a9c0042", "comment": "Malware payload (CobaltStrike)", "timestamp": 1698409067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409067, "uuid": "c25135e4-ab24-41ff-8ba4-9eede4f5d921", "comment": "Malware payload (CobaltStrike)", "value": "e30c4998cedc278c8ffd80d74eeb32be", "object_relation": "md5", "Tag": [ { "name": "AceLdr", "colour": "#6DD168", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409067, "uuid": "bf2b72e3-51dc-45e0-8d1f-1e59656c6720", "comment": "Malware payload (CobaltStrike)", "value": "1650cd26f9b746ec0efa8d30896eec4c556f54357ddf56479dbd7ddd42bac209", "object_relation": "sha256", "Tag": [ { "name": "AceLdr", "colour": "#6DD168", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409067, "uuid": "1cc6afeb-1efb-491e-a3ee-e1d3eccd84b8", "comment": "Malware payload (CobaltStrike)", "value": "0a8d3a24caaa99d9afd922aafdac33657735b431", "object_relation": "sha1", "Tag": [ { "name": "AceLdr", "colour": "#6DD168", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409067, "uuid": "5a850493-1ac9-42e5-8f2b-b191f6cc6f8a", "comment": "Malware payload (CobaltStrike)", "value": "427254f69c064b1c71162fc586d8c6d7dabab88518c3ab236ffa307be94ffd056940e1987bb58e6e45204525c819bacc", "object_relation": "sha3-384", "Tag": [ { "name": "AceLdr", "colour": "#6DD168", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409067, "uuid": "9216cae5-4098-4f03-a73a-a86ec1ec7391", "value": "T131A48D32A6B3FE60CFB1413CA591F6730EA13D5DAC163027BE5468F91F2468A4DE6127", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409067, "uuid": "ca0e322f-7801-4471-b90d-27d4d3d90dad", "value": "9b5eece0ad2e82292019bc415b7a8302", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409067, "uuid": "36fc698b-f748-4eca-9641-3922ca2ceddb", "value": "6144:UnRgYN2vzrESnu4n6w+S/7uZqRUC+t02yxUIbq5GV0WJhPl1FZlz7Pfv76djG4HD:BVrJ58tkV0WJLof9f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698409067, "uuid": "efb9056b-059b-4532-b186-a4875ce68c9a", "value": 486912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698409067, "uuid": "0764b23b-6402-4e24-b294-158d9acc12f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409067, "uuid": "89d426fe-bf12-4893-bb63-13b221d7710f", "value": "http_x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa374f4c-7467-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698370042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698370042, "uuid": "ea5238ed-c551-4299-b59f-8fa6d1fa93e9", "comment": "Malware payload (RedLineStealer)", "value": "2269b6f241d0ee44ec50040ca1e8b88f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698370042, "uuid": "92ee0337-4d0b-4fe8-ab37-bc28cf68999c", "comment": "Malware payload (RedLineStealer)", "value": "16c4f6a6e4e30678ddabdaef1aa41bd268867cefabaf6ced9d97ec1a5faee2e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698370042, "uuid": "1824149c-dc96-4880-8875-241c74df595f", "comment": "Malware payload (RedLineStealer)", "value": "e99e6ba3fe80d6c33ce6da3b2aed917449870b0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698370042, "uuid": "72e0147c-6298-4f56-b044-2c3cd29128e3", "comment": "Malware payload (RedLineStealer)", "value": "09153366abbc40fa0454d6fa7f94d92699d95d9378f19b6aa1b9c4f4614f5ea7c72f032b5152c1be44d89f35d9e353bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698370042, "uuid": "f1af0ee9-b504-45dd-8abb-314c62780782", "value": "T1A675238293E88967EDE4137158F6565B07727C705DA8966F33C8A8DE09E36CCB83035D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698370042, "uuid": "16ce7655-8e0a-4b0a-8da6-53c009a1a71f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698370042, "uuid": "8ea33c82-25a2-43fa-8c39-816777298e54", "value": "24576:Qyd0jP0lWqNNMXBMljwJxHRR8MZHHCGHkSz/CEPOU0uZD5/OJA8KlgUGEWpJ2VMd:XdeIAMiXl4IzDjWUTZJE9UGIAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698370042, "uuid": "ea48f162-2c1f-476a-8a90-0f5f09fa613a", "value": 1632768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698370042, "uuid": "292876f9-9aa7-4b14-8103-f77455710931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698370042, "uuid": "ce817777-6b1e-48f4-9f5c-fc4cd2a32b14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4ef531-74b6-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698403680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403680, "uuid": "4d13997e-9113-4a5f-801f-20c478b940fb", "comment": "Malware payload (IRATA)", "value": "de469a91b390d035e0c22fa8a764337e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403680, "uuid": "11f9d4ef-262a-4c21-9872-bce1ca7be333", "comment": "Malware payload (IRATA)", "value": "1764782ffe133257fe29454ed570cad1dea14b42b49ab37fd8af4444107d83ca", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403680, "uuid": "5d4a7a40-37cb-4a48-8a5e-08654d4f6e9c", "comment": "Malware payload (IRATA)", "value": "6230285bac1510bfcf3a10d0a97d639b357c55ee", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403680, "uuid": "6f41148a-484f-49b7-b548-4960ac38a087", "comment": "Malware payload (IRATA)", "value": "3f9da2429b5e76f35d63dcb333cce5c59d7d738038a31bd98378e442a9f66b9d81b7dd52a27a10dd164ba530b88c6473", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403680, "uuid": "db6c9d26-435e-479c-85d4-29e3d7171ffc", "value": "T1E5951243F262A95BC9F2D33751B5223241374D18CB47BB8A2E1973BE68B7DE84B506C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403680, "uuid": "629ffb38-724c-40b1-82c3-68f80c463362", "value": "49152:7/xMSL4XV+poeN/tmWqVhr7KlWqfay7SzTvVDqUoG:jxlUXV58/cWqjKll4zD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698403680, "uuid": "c5b4fd20-50d7-42dc-8e25-fffcfdb0f242", "value": 1987310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698403680, "uuid": "18493bfd-9371-4106-a533-fa4e65e080b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403680, "uuid": "0f20d8aa-a961-4a67-b222-6e57751634c1", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e58c6e8-74d0-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698414904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698414904, "uuid": "ebace813-9fd6-433f-8425-92b3fda49bd7", "comment": "Malware payload (RedLineStealer)", "value": "4b51ce5bb8dd03f4b08ad855a5303a1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698414904, "uuid": "4bd8f6ef-2701-47a6-9eec-f54e50e1df59", "comment": "Malware payload (RedLineStealer)", "value": "17afaf678587947287978f67fdf63017345c64b8a0c3e61f054cbeaa2c5b8c70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698414904, "uuid": "a2df714c-1a0e-4871-bd46-563c60f5f505", "comment": "Malware payload (RedLineStealer)", "value": "f52ab7e4bc8198a037d08dafca87b98e5a2a604d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698414904, "uuid": "7532854c-9a9f-4825-9754-eca84d71937a", "comment": "Malware payload (RedLineStealer)", "value": "f9c81a3ae3cd59fbcdfcdcd3d9387a3f74f73e66f4148e472701b238c741c7cca48aa0f1246dbc934712c031a98f3455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698414904, "uuid": "fad9c240-0009-4b8f-80ef-5d97569b0391", "value": "T1B9A56D0176F95749FBF31BB86ABA6611483AFC7A8F15C2DF1650908E0871BD09970B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698414904, "uuid": "8d024e0c-0968-47da-b49d-1fe885751660", "value": "037522269f8348aa17add864631a3f22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698414904, "uuid": "d0531dca-2f7c-4666-93f7-e487dcef8309", "value": "24576:prKAfSKqe7E9rOdClN26a9DhvhLyD2SS3HiFJCDcdrqI:plqe7E9fl06a3v42SS3iFJCQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698414904, "uuid": "58d254d1-0f5f-424f-af5f-e922d1d14efc", "value": 2107392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698414904, "uuid": "8a123699-458a-4d73-b51c-d6174fd6b3aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698414904, "uuid": "d6609e67-9081-4bff-af0e-bdb61e89b8f3", "value": "4B51CE5BB8DD03F4B08AD855A5303A1F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487609ff-74ec-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698426867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426867, "uuid": "fc33d14b-32ff-4fa7-9772-732806aa21f6", "comment": "Malware payload (RedLineStealer)", "value": "b4f0529e86b038321a9a4bc262963556", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426867, "uuid": "a2b8a61b-b767-4ea8-944d-1267466ecb53", "comment": "Malware payload (RedLineStealer)", "value": "18bed914f599c314991632f92e2f6f553231961047fd418d42b9158af090ede1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426867, "uuid": "0708a174-4878-4ebe-99e2-053a6f31661f", "comment": "Malware payload (RedLineStealer)", "value": "0b483ecd98091c6b60d9ba9f9ae3084730555194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426867, "uuid": "58b10166-ec2f-41d6-8e32-80e03cfe6331", "comment": "Malware payload (RedLineStealer)", "value": "19ee51dbfc6442bae1af15361bced056c4f2f1e73272c08446adb5811c6dc272bd3191b38a1bc0a29245b2312bbc3387", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426867, "uuid": "69acbba2-2e4c-44f3-8dcf-a7f2a2174b01", "value": "T11B459E5138828177EEB210B607ADF626C66D90B41F1AA1FB358507DFC3646F07E327A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426867, "uuid": "03ddc087-7874-47cb-a022-a1d86af9b070", "value": "d880d0ae07cf434dea838358ed4c863f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426867, "uuid": "8a2ecdf7-c633-408c-aa10-1a8b736c0eda", "value": "24576:eC5s6HWdgAw/26p6Xy6GbSROMh4IQ32+xk/BYIpXP4j:eUGw/26p6CARJT+xB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698426867, "uuid": "45e239c5-b24b-42d7-9737-901ff6a4ac4d", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698426867, "uuid": "2f68188f-d0d6-4289-ba64-2fae6da58cf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426867, "uuid": "e8128511-5c38-49e8-b9d6-96e966a0c928", "value": "4AW375Pq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b392d9-74d2-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698415615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415615, "uuid": "e8147aed-4b91-4ff5-a4c1-8249b2a5e0ba", "comment": "Malware payload (AgentTesla)", "value": "f71ec82b93ee1bfc2db0b939a243bb3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415615, "uuid": "fe6da10c-eca6-4d99-965c-029fca6790f0", "comment": "Malware payload (AgentTesla)", "value": "190326e6eb8883cd6ac28e1a2d351c5af7d6833b85fcfc90244c2e3004f890b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415615, "uuid": "f4800135-b889-433f-ae2e-024417ff02a6", "comment": "Malware payload (AgentTesla)", "value": "c875ac91c1e30691628fffb54914f32331f84f48", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415615, "uuid": "adbda03e-c8bd-45d8-9238-ab7c1b8e796e", "comment": "Malware payload (AgentTesla)", "value": "d20603631795dafe10807b28af8687546ed03057a0bc9fa8ba29acf6564d742c1cee702038d4b1f9d1c92842d82abb55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415615, "uuid": "3f44e7e4-50c1-48a0-bce4-d9c29e848888", "value": "T161E41244E1F2530AE4E19BF99D2133E4A37224173663E755CDD0E98AB89D7C786C0EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415615, "uuid": "a28d075f-8d28-40a5-821b-4e72407c6623", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415615, "uuid": "d82009c4-6e2c-45f0-95f8-9724bbd49e7c", "value": "12288:rzzlO0azQCm7PHmnRZquA7oHrRnun315A4utvSGYu78yzE9r+8Q1:PzliNg/mnvHXtnerANJY1y6HE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698415615, "uuid": "c94728ed-4337-4846-9f2e-f7820700bfdd", "value": 662416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698415615, "uuid": "199ec2df-2a6e-4985-8478-b07987420c5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415615, "uuid": "1f7b93a7-0fd2-46e2-b5be-6ab0e646d81e", "value": "rORDENDECOMPRA088562.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345a81a6-7461-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698367133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367133, "uuid": "75c2b4f1-8e7d-4c5b-a798-15ed91c24a60", "comment": "Malware payload", "value": "085dad19a1926b048c8ee5d4b2c812ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367133, "uuid": "8a8c29c0-02f7-42ee-9064-5917ac1b5aad", "comment": "Malware payload", "value": "1938eb1aeccf3576f5a2701b3659e8b1bea51f85b99779f3f773beb548bcaef4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367133, "uuid": "54c43c09-b421-4b63-b268-b2dd6856f958", "comment": "Malware payload", "value": "8040578ee0377bf2fe1615cea24ddb4e90f57c9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367133, "uuid": "2f05f697-5d90-4a43-a165-f1f521d08ddb", "comment": "Malware payload", "value": "784d358eff3bd6f5319240be727f1e129a8ad1be9a8f4833c6abc47a9025ecd4ae073533a2cea32c6cfeaf46770fdcbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367133, "uuid": "73567a11-7b61-412a-98e3-5e6acefbf874", "value": "T1FA659E12B1578872E56627708C6613BEA931BE0B5E708D57A354FF3D6E73A40EA3E10C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367133, "uuid": "1c8e9427-214c-475e-8ba3-a015dbee52b7", "value": "12288:HFx/+O3uIkNG9SJ/viCJMLYBm5J8U5mo/FLKtzhrN9Q1ujR4FDyCV:HFx/+Ci2SJ/KCeLYBjULLkhzqJDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698367133, "uuid": "0ea34ac5-6eea-43e7-a82f-444b7b217350", "value": 1430528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698367133, "uuid": "3c358a23-120f-49a3-8b30-3707f66133fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367133, "uuid": "1bb4ddb2-8943-4017-8e90-851b6177eb72", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.24654.28299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95dccc4-74df-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698421446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421446, "uuid": "f2f02e65-9198-4683-b2fa-b29218f0357e", "comment": "Malware payload (SnakeKeylogger)", "value": "c6831026773fa273685bd3b584d18e6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421446, "uuid": "a4c1a40c-811c-48c3-8f32-829732eb13b7", "comment": "Malware payload (SnakeKeylogger)", "value": "1cdba11094ae2b0b93b98bff9c6714293a14cb61bbe21a5a851a08d6e89507ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421446, "uuid": "751fdada-42f9-4696-b263-a19655f9432f", "comment": "Malware payload (SnakeKeylogger)", "value": "5e10090f47262a60fe3c0d2da9cf45d63bf2bf29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421446, "uuid": "ed065a91-24cb-45fe-9449-dd6ff6656bb2", "comment": "Malware payload (SnakeKeylogger)", "value": "ee4066113638dddd271a808ba2c5cc1b144f76996abf5865d83eee4750e9f51d0b2762ae19bf4a29585adf0e93e8b640", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421446, "uuid": "44d26ec4-7d4c-44cf-8ca4-ddd7ad96ae64", "value": "T1ADE48CAC725075DFC95BC872CAA82C64EA6074BB531BD203A01716EDDA0DA9BDF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421446, "uuid": "aa94b52b-19f2-46e0-a94b-9c6e94a4677f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421446, "uuid": "54ac6ffb-ab72-46ed-ac22-416168f1bdcb", "value": "12288:HPkiCBMR3tzaiJmgMK8nINpJ1voXE58rWc44wkOnnehXixdn2OJLR2W9XjE1rH1Y:8irtzazvGfvoXEoWMGnezOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421446, "uuid": "b7b4c4e1-fe0f-4544-9c15-217a2ee5f598", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421446, "uuid": "3b23fee0-c6a3-42a7-9242-dff5e4693799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421446, "uuid": "4c93b935-3710-4ea6-a4d4-a3d583426572", "value": "Ziraat Bankas\u0131 Swift Mesaj\u0131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0584cd1-74b4-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698403016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403016, "uuid": "cb25070c-6739-4604-830e-bf279dc36783", "comment": "Malware payload (IRATA)", "value": "98f2f5b7e24a047314daecd9582841ea", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403016, "uuid": "15c299a6-cfc9-4dbc-b916-8b51ad0e9ec8", "comment": "Malware payload (IRATA)", "value": "1cf8b23c1d3b4a86601b218cfd088caedba73d9c80d51dbca564fc7989276acc", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403016, "uuid": "e5a9be42-04e2-49fd-83e5-b2327b0e8dee", "comment": "Malware payload (IRATA)", "value": "36acdc874a74ba44c04234aa6b1d9b454b6223ec", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403016, "uuid": "6cc33da6-c258-44d2-9fef-e5f708ec7c80", "comment": "Malware payload (IRATA)", "value": "50c43c38cf42c17801dcc3f407c11c10a89cce24acbb9d969aa61f7d526dc782ad3e2377ff9351e1a2897efba0bdf4b9", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403016, "uuid": "f05e3326-58ed-4a47-bdc5-e03cf9a4fe9a", "value": "T105E52353F27BA957CCF6D33221A92A3514360E298B03BB5A251C77FA69B7DE847C11C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403016, "uuid": "6109f64a-9001-4c1c-9bfd-f6d3c7db686d", "value": "49152:w/e1PAID4YhmflZzMTDDzCmlBmWnakpkOo+sN+7E0j0cEdzDCPA:ee1PlD4bZzonumlZa6o7injHmzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698403016, "uuid": "e2a57c05-ead4-42b8-a881-09311052036a", "value": 3211512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698403016, "uuid": "a903c501-8a55-445b-ad36-be5e14247474", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403016, "uuid": "a84bfa03-746b-48d2-8144-91414da1978c", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fc8df7-7461-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698367127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367127, "uuid": "b3ac0eb0-0242-4958-b67d-1541fc7c1eca", "comment": "Malware payload", "value": "42e1c69f630c8f718ff0417602c409b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367127, "uuid": "36d91d53-5fa2-41d3-a186-b4f421b3466b", "comment": "Malware payload", "value": "1d57b5247c3df074d866fb036f64f5630ee8ca5814077803e3a1ad9504732c1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367127, "uuid": "1e695e59-85ff-43d1-88dd-8814aef6ee76", "comment": "Malware payload", "value": "661bc31f6f89fdd9511574f8e1ecd843ed80a739", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367127, "uuid": "45857b08-98c7-4fbd-bb04-397c9ae8f3c9", "comment": "Malware payload", "value": "8d646476b5f6e469187468ce24ec19f2d6f355f60a1df3197ea5ba972804eca30f9bccd4b8d5ffc1d60baef63bf928cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367127, "uuid": "4f66cc02-0661-4057-9f21-a216e249588c", "value": "T13D9633B3E56479E2E8B47B71DE0192A11333ACD21DF9FD7B30982A4A5CF8F191601E91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367127, "uuid": "3049082a-7988-43fd-b540-c79b5864d090", "value": "aa770df5b9e208c1ca436e9267f0d390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367127, "uuid": "46f90312-a270-4b5b-a492-1f0315b245e5", "value": "196608:bvk0GxaKmky/6deniZxGrujp0/5tbI4eJ3DNjRUio:bvkrxaKmky/6kiXGruI5dIDtRUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698367127, "uuid": "4416d14e-f185-48a8-9c28-154dbd04cc3a", "value": 9247486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698367127, "uuid": "bb8c9fbe-91df-40a2-af93-a95a3bb47be1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367127, "uuid": "fbd1656a-621d-427b-a958-1778537707e0", "value": "SecuriteInfo.com.decompression.bomb.7964.8235", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6bb869b-74b6-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698403966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403966, "uuid": "a1d8e6c6-3781-46df-a924-9aae40ce2729", "comment": "Malware payload", "value": "103e0f63fdf2bfeeef00d5a3de5c1c08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403966, "uuid": "16a2293e-64f9-402b-b602-1b6041d98719", "comment": "Malware payload", "value": "1ec988853602184ff683af474cc32d3ef9179abcf2b19224a02b062f9b806d16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403966, "uuid": "0f640845-7fb2-4b47-8751-c0f6e0b057c2", "comment": "Malware payload", "value": "cb258e1f95cfcac7d5ddeb113d1b90f198a5b1f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403966, "uuid": "a8d224c9-6399-4ea3-ba4c-53f1229148d3", "comment": "Malware payload", "value": "b7e5a61f9076e92357609c47e7030c88c9483d14cf090913b5fd04958ed551f671d5ba4e30a101f62586c5daac720c08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403966, "uuid": "ea4d88d6-ec39-419e-a170-f95b90a0901f", "value": "T1B7D73344EA805CF8E112D37979C2CC0C9CB8FC4E4618D6076A147D781E9B7EE8EBEA55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403966, "uuid": "c4bb9a3b-4635-4b4c-9799-7c0f597d0c57", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403966, "uuid": "9f3287e3-0d43-41a7-b1f5-c6222bef979a", "value": "1572864:JyNQMkRCtQkTMT2Zr9yre77nD0ClE71QOIU9:UvkkQkTyCAS/DuIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698403966, "uuid": "6a819727-c719-4155-b4c7-b4c86b0688c0", "value": 61584609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698403966, "uuid": "60bbea33-f679-4d6a-9026-6d33761803cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403966, "uuid": "9e1e9a2e-a151-4f5e-81af-0d264f7799ab", "value": "O My Bag - Social Media Agency 2023.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3330e33-74aa-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698398753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398753, "uuid": "4b9c4e64-2590-4bee-9ce5-566899f0af6b", "comment": "Malware payload (Formbook)", "value": "316061b743edde955e67ab2c614bfbb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398753, "uuid": "fe69eeb3-9c31-459c-9bd8-1e72b0e9640d", "comment": "Malware payload (Formbook)", "value": "213a50190a51c9434516fb65934c27959a32fef938d482c3a399779deb0e40e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398753, "uuid": "f4403534-2bf8-4069-90f7-eb0184fc282c", "comment": "Malware payload (Formbook)", "value": "97d147505553e94c4f1f5401c9eadc8621480936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398753, "uuid": "2c2e26d8-314b-461d-aa11-5f0b8ce71a68", "comment": "Malware payload (Formbook)", "value": "4e2fb5141b680478aa62f5785229ca60256694915b9cc3f0d43e655ba0afc20d4d308c8303e45bc51e7e8296ab6042da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398753, "uuid": "6675a670-716c-4a15-ad77-78dee2359529", "value": "T1B9A4012049F61781D1B5CABB8E59131123F16E2AB632D34DEDE5F093305AFCA92E4D63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398753, "uuid": "3115899b-05d5-4b41-a91c-2035b415a90d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398753, "uuid": "38cf1cd5-8eda-4c45-a300-057cad3618a7", "value": "12288:jm7PHCbXoOLO9PMCD7hUS+rfH5wpJinIU9bukS7a:jg/YYOLSEe7tgaCnIYS7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698398753, "uuid": "d3c2e028-ac93-4d42-abec-5eef9919303d", "value": 459672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698398753, "uuid": "ddbb3a20-dd5b-4f9d-93ab-abf2b59c641e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398753, "uuid": "1691cb9b-0458-493e-aeb9-2b2c708b65d6", "value": "RFQ20102024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd50814c-7498-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698391012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391012, "uuid": "899f08d7-2063-4a8d-a76d-ae925ed04ee7", "comment": "Malware payload (Mirai)", "value": "e8a3f704271733d1dc10ac9285c44fef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391012, "uuid": "34a9aaea-75ee-444e-b8b9-27319eba4471", "comment": "Malware payload (Mirai)", "value": "21fa70bffb9ed633a8a00f5c8d17a35fb399956af2bff3372ec75c2e5045b595", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391012, "uuid": "27d80f9a-9852-4d9a-b908-7abe731fb811", "comment": "Malware payload (Mirai)", "value": "500337b957e0717bc747d4c8e378d986f000f3e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391012, "uuid": "86335d5f-a424-4100-a99f-60f3c87f283d", "comment": "Malware payload (Mirai)", "value": "17cc039194e090d2db2a1e2122762f6d774184bd46ec1a3f24d734f878316cb3da1d9b67df56383aea8bbe463b94eed9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391012, "uuid": "5838ee27-c42d-466b-924e-c5880dae5a24", "value": "T19603E184A114D4F0C3D83DB7A06E4A9A2A43CBB4A9E7783777E8064CBB454B35AC4767", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391012, "uuid": "0345224f-a6d6-4c2d-82b2-49243a182330", "value": "768:57ISHV9tXPwHaOQNmKHtvZCvI+7gA9Rh6lAUrYna1gg+rybyQUZjt3Uh:57IS1H4HaHNmKNUw+t930Wa1g5yye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698391012, "uuid": "bdf85573-2b57-43f0-95c4-bf9358a11d80", "value": 37900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698391012, "uuid": "7fcaa883-aa9e-4ec9-b30a-8222023d7f04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391012, "uuid": "f3288a5c-0a93-4f6d-8660-e51314db85b5", "value": "e8a3f704271733d1dc10ac9285c44fef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3ff4e6-7524-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698451136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451136, "uuid": "34b30104-e511-4ce6-aa42-6a42b1514d83", "comment": "Malware payload", "value": "f35e950d754f460670404a7f7ac3dbf9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451136, "uuid": "55cfd5e6-2793-4555-86a1-7e8824660901", "comment": "Malware payload", "value": "22ae47dc8f4e26884601a599c2d99f4000830190312c237a68f0ce5536df62e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451136, "uuid": "8ed27159-54dd-42f0-81d1-8e2ab851fa8b", "comment": "Malware payload", "value": "5fbb9250b7c1c094a6f4ec0ce6ce4d902afab0b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451136, "uuid": "92a4dcb4-3b6e-4b99-bc4b-d0f31b72068a", "comment": "Malware payload", "value": "6dd150212d650983b97de24e9c5d8282cb497d42063d4016bd35bc994a62c31c5aacd236ea945dd231b9688c1cb0414f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698451136, "uuid": "b3501f84-a481-476b-8ca6-d31102495f48", "value": "T1552328AAF8028D7DF84BE77E54164E09B93163C152831B2A13B7FEA3BC731592D12E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698451136, "uuid": "5e3c1210-5c5d-4de2-9f4c-babb58cfe3c1", "value": "768:CK0eoVJdxD8xY2xXkCltdSxumlDx3MMYiP4Eq8DHwOG0J:b0BD8xLVdSgm/3MMFP4X8DQ0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698451136, "uuid": "d196ae96-065c-4cd8-ae39-a66c0d293d29", "value": 46676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698451136, "uuid": "f18c12ff-6800-4ce8-bc4a-ad61937bcc0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698451136, "uuid": "2c7f1d4a-ce57-4829-aad0-6eb0dadd83a5", "value": "f35e950d754f460670404a7f7ac3dbf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cbb3003-74f6-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698431196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698431196, "uuid": "dfbd5ed0-f142-47b5-9ed5-1a628045e0a8", "comment": "Malware payload (IRATA)", "value": "79fbdfde4c6a62dd95a12c5f371a1737", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698431196, "uuid": "7e3ce437-4aae-4f48-8c66-822707630274", "comment": "Malware payload (IRATA)", "value": "237102a3a7e0ddf0eb4b9f06838d232c6b353e44ccee7f388e10debf4cfc463f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698431196, "uuid": "b1566fdc-916e-4114-af7d-400ee4c48583", "comment": "Malware payload (IRATA)", "value": "90dc131a6224bed185c55b98604a29f018a2a135", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698431196, "uuid": "e4402b8e-dc7f-4739-a3bd-0e8dcd2cee86", "comment": "Malware payload (IRATA)", "value": "79020bf9d0d5350af07cbbb25b2b1dde1f03d3049b6ff722306160794156b4f42c8bc0cc705a25b6b114444d3e624a09", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698431196, "uuid": "4fea0eb3-a546-4d17-83f5-a8c1d34d4f82", "value": "T104A533D37774A017CEBBEE3051874669A9BE1EB04C82E809B45B7B8D2377BDD9741280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698431196, "uuid": "0823e8a0-4d42-4597-95b5-5ed5fa2342bc", "value": "49152:ZEGnJawJVzyVkhsCdg204EFB7GGeW79qDAzEt/Pqjvb0AK3tHpB17m3Us8rd:ZrJawJVzvhsag2fEWahadt/S7wAAwR8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698431196, "uuid": "0905a03e-7219-4d7e-85ce-f4a72587b716", "value": 2206939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698431196, "uuid": "6e0d79a3-a845-4114-8a4a-5e2ef6b8adcf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698431196, "uuid": "f7743281-caef-4f2b-a998-789ca465e5de", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d90417-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698421732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421732, "uuid": "2a411c91-d5c4-4155-b839-2b8a19332c4c", "comment": "Malware payload (AgentTesla)", "value": "d2a696fc241428602c9159414ae69a90", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421732, "uuid": "0dd04ce9-c6d0-423b-a78f-63948444c9e3", "comment": "Malware payload (AgentTesla)", "value": "23eac68c66a99ac96da08bcff8efd0a8d051f9cac076f3fde6ed6b44cba4d9c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421732, "uuid": "bfa35377-c263-4c01-b95f-bb4498d7cce6", "comment": "Malware payload (AgentTesla)", "value": "ce4c3215aef797d6696d2ebf3987c7c98d7c15ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421732, "uuid": "b79532a6-6fd7-4c61-906f-f42ef420c27c", "comment": "Malware payload (AgentTesla)", "value": "2672d803ffde08e22c64d60b44201c0f2f8166244e4435d9fc868b56186c0a82f81245dae01f1f799cbe8ccb5020ea75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421732, "uuid": "00567acb-b434-4192-b0d9-aefb1f594198", "value": "T1D7E4235D954702249BFF013F0DB19C28D8425EA84147926FEBBCA40A13BBE5D5FEF2A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421732, "uuid": "ec6632e8-833b-44c4-9435-612e6c00f649", "value": "12288:HCnWvH88OBbj2Hcifs96FNzpPym88DxWsyBB2QiENvu+EO6wqwCK:iIG28ifMSNzom19WsKB2QrNqVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421732, "uuid": "4d7f99cc-04c9-4567-98fa-58a695e2ccf4", "value": 698245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421732, "uuid": "7e0da1e0-eaa5-45ce-bd8b-5afb74c051b0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421732, "uuid": "8d00ab41-3692-47e4-bab6-5099797dcef2", "value": "Payment swift.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615ac0df-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421754, "uuid": "caa318a2-3241-40e3-9c32-3443fab87b58", "comment": "Malware payload", "value": "37438757eb25c0dfab3b45d354bffa63", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421754, "uuid": "4ad3a28e-36c9-4ae3-a90b-0bc6265bc5f3", "comment": "Malware payload", "value": "243d6878595ddd436e22f219767c4587159f1957876c4ecad342ec173278a7de", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421754, "uuid": "bc300235-71a1-495b-9759-52c1fd882ccc", "comment": "Malware payload", "value": "08d6119984fe5f1ade4bf8a875bb1c825b505afe", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421754, "uuid": "0b44220b-c328-40f4-97ca-19382254fa5a", "comment": "Malware payload", "value": "b9b08821e48117c7389d2b4e02e13de5f83d8d15f132194e2a2c16113d6aec1aa9ccf3ff417e16b3d376b2d71315d7c5", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421754, "uuid": "f809d1ec-90c4-40fc-9467-4de2690b729e", "value": "T15F72382EBFD71B79C456917482E38B39FBF9F02012614B6D86F4D7364E70B24923A908", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421754, "uuid": "2c95fdb1-858a-4f21-8d30-3218279557ec", "value": "8b7d6f218f07082b5df448bc58285040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421754, "uuid": "4d2f3dcb-fd52-455e-b99f-25549265d535", "value": "192:/93uNpN9G11MZ+I5lfWqV1vSMteJOvy7JJ+3VZhHPU4Xixgv4e/0H2Jfwnzho7oF:5WT9Q1MtlfxV1v10JO4+Z0JnzhuFr7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421754, "uuid": "a2bcf584-02ae-4b3d-aa95-7ae8268f8170", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421754, "uuid": "a5245e61-43de-4bea-b7f2-659962d735f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421754, "uuid": "f1cfda65-817c-4ebf-bac9-d365909805c7", "value": "Billing_Statement_NOV-23_SZ.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab5200b-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698422092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422092, "uuid": "5a96141d-11d9-4ab2-8cba-3bcef465da85", "comment": "Malware payload (GuLoader)", "value": "95164078bd0f18f8a243b7ecdbb186b2", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422092, "uuid": "d25e0940-76e5-4bf3-9164-3625967a2f7e", "comment": "Malware payload (GuLoader)", "value": "25f110d33c76da48da6adba413a08ee81b4b309e2f3e5c5199e5b03a44dd5376", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422092, "uuid": "4eace38c-ac67-4420-be7d-9d84b768a8f6", "comment": "Malware payload (GuLoader)", "value": "0baf6817d66a8dc1fa163427e8f69186f7691827", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422092, "uuid": "86879044-61c7-49ac-824b-240d3baca31c", "comment": "Malware payload (GuLoader)", "value": "c16cc77ba83ae1ca25abe013c3ad9f7af3dec02ffee7724122b9d3d3f76e951d96feb54b5f7649e7a82627d79f60d1f1", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422092, "uuid": "af15edd1-c59f-41fb-a3f8-902fd7109040", "value": "T15F736EA2DB54161A0D8B37DADC408851C9FDC12A5927411AFFEE078E620B59CD3FEB1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422092, "uuid": "8d373465-329e-4501-b8ac-ccf043736ca3", "value": "1536:/abOfI9BAvnctCJBrFTpgOCzCUksQPP1c8uDk/hO:ybUcA/ct4Tpg1CUVci8uDk/hO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422092, "uuid": "29f156cc-698a-4f83-a3ec-1ea4dfee0464", "value": 74365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422092, "uuid": "1ef41090-3219-4299-979e-a828fde7a055", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422092, "uuid": "88aded23-d8ec-47a9-945c-ef5dfed13ac9", "value": "Kahilingan para sa Sipi (UPD-2310-27PH)\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b8eeed-74d9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698418883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418883, "uuid": "fe1e35bb-2158-4bd1-a6d8-b69523b5772d", "comment": "Malware payload (AgentTesla)", "value": "26f25d2c145492004ff51235acfae7b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418883, "uuid": "fa705d8b-41b4-45a9-a985-b647f17ab19f", "comment": "Malware payload (AgentTesla)", "value": "25ff805aa8df04ddeb2ed6a8687f17569dda9ccdf4089dc0cd8910987e799ac4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418883, "uuid": "7323e1cf-23ff-40ea-a191-ff7caf173f67", "comment": "Malware payload (AgentTesla)", "value": "81ad675d6b2951c0d83fa917527644cb033d9d39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418883, "uuid": "28e0718f-d95d-4580-bb36-497561a8ad9b", "comment": "Malware payload (AgentTesla)", "value": "c49356ed640280de0f29727ee1bf2e47ea5d6ac0d391bc9bb55fbd755777e567e7507eb2ff58428e73c97acd72ffcf74", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418883, "uuid": "8361b879-9a69-49a7-948c-0fa637effd9f", "value": "T1E134011971A9C842C262C5B94ACCE7F6070EFC94CE12E74F35407B8E16761839B9F769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418883, "uuid": "731f64cd-c8ca-48f6-ba26-1501b7494f27", "value": "3072:sPj9cgBbqiLesTHno5qzcgBbq3MesT3I8LbUNZw1f2VQWsTn/ALqmfv01:sL9cOJ7oozcOU6zNobw1+/2n/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698418883, "uuid": "8431b86c-b587-4698-9a38-1d70f2f4ae9e", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698418883, "uuid": "3616689c-9c51-413a-9790-360ffddbbfe9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418883, "uuid": "d12fa6b9-f2d5-4587-82ad-05facc96e6cd", "value": "revised_purchase_order_catalog_design_no_TZ806_27102023_00000000023.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc8b7c1-74df-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698421505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421505, "uuid": "93427bcb-ffbc-4387-a006-530560faf979", "comment": "Malware payload (AgentTesla)", "value": "c7e036426856fc562cf38f9f52d00464", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421505, "uuid": "4d6e8c49-7425-4a0a-a740-0743e9de3f7e", "comment": "Malware payload (AgentTesla)", "value": "2657b99ff3f06f6f5be3862d879134151bfe87afedfaba13ccb21a3be0516d22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421505, "uuid": "ff5bb665-69f8-467c-b408-b8331b4b45cf", "comment": "Malware payload (AgentTesla)", "value": "b0189121269212155a77e64b84aa8c9d8e5f3750", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421505, "uuid": "d89ff16d-4b66-4b63-bdec-37aac3d11ec9", "comment": "Malware payload (AgentTesla)", "value": "2111902eefef31ee8e11f85a27cd8d9ac929cff6ca480dddae782d13da03f045481dc6830de761c7b75ba6f30eef20ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421505, "uuid": "e7d39f35-6f2c-4427-bdbf-5a27d287bfc0", "value": "T10B759323BE47C9E3C14B5B36C5DB141403A1D6A16333E68B398E23695843FBB9DC6627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421505, "uuid": "49a7770b-2b66-45d5-a4b2-6ad8fa1363e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421505, "uuid": "01a6e1ab-507e-4854-b872-e605afaf3f0c", "value": "24576:UCuVAyUYhzCfVjvJrdgVQ/HBaqM0FcwM9sj:GVAyj8f5JxHFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421505, "uuid": "003fe009-12bf-494b-98b6-5fd1169ee55f", "value": 1659904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421505, "uuid": "cb01d099-53eb-477c-86b6-07a06e665331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421505, "uuid": "f585a638-4f65-44f5-9eb7-b267d1617157", "value": "DHL Shipment Deliveery Notification 27th October 2023 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa44f3a-74eb-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698426745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426745, "uuid": "1118e97a-0da6-44bf-9ffd-068abbb49a53", "comment": "Malware payload (Smoke Loader)", "value": "19c1c518b880c85d3534ae9a83504e16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426745, "uuid": "f619f41b-41a3-4d8e-b58b-510c22c14f9a", "comment": "Malware payload (Smoke Loader)", "value": "265e44818ee38eb8e9416e4befe68157f0e6e07eb872ccf368a76ac5197d783c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426745, "uuid": "e43857e3-509f-4c55-8021-e3063edd2267", "comment": "Malware payload (Smoke Loader)", "value": "d966816bdab09c76a4355bf205c8e5798b0a3730", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426745, "uuid": "fa7afa89-5983-481b-9a10-14edd20e31db", "comment": "Malware payload (Smoke Loader)", "value": "0ccc688cc4eaa403b60b45765033bd58bcd7dcad00814c96ae5f789545f0eac6ffd7a6c0f7047e31819781b961a8eb9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426745, "uuid": "135b8e25-ac26-49d2-ad7c-fddbf18c83ff", "value": "T13CE2F10E1AA4A0DDE59651B280C39E77EA8433D314A673C8C173AFFDD787F81B591268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426745, "uuid": "72cc8296-609a-4976-96de-704eba074d06", "value": "384:K9VD6tee+qUOTd2opQTLAdz1SvNmhpdvOjT7PbA6HBiTSnjxZMdP05ldpRMaYIBI:k6Qe+qUv8zcqdvOXA6XkPslJvGaVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698426745, "uuid": "46d8ae8a-e510-44a1-9bf1-f4eaa7da3f07", "value": 31322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698426745, "uuid": "aad8ddff-aa27-43c8-8f03-7c6c6542e873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426745, "uuid": "533fddbd-177b-401e-9242-e4ed8d26a0a8", "value": "3fb66uy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0c5b89-7461-11ee-8907-42010a9c0042", "comment": "Malware payload (AZORult)", "timestamp": 1698367121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367121, "uuid": "635e12ed-ad3d-4845-a595-db6c62864d6c", "comment": "Malware payload (AZORult)", "value": "b8a69c367b7a0a2e4d961011043b5618", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367121, "uuid": "16c5bd35-599f-41ea-8bec-01163f2c8d86", "comment": "Malware payload (AZORult)", "value": "2847c1c7de92975ce8fdc09c195c5538a27bd1a094abcc7cecbf05fa28dc05e7", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367121, "uuid": "1a80dfc3-fd14-4acb-bbcc-94e1b31e4a75", "comment": "Malware payload (AZORult)", "value": "ead8a2758614e70b257b41ab97bd7739a6f393f3", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367121, "uuid": "6a7fecd4-40b0-4ee6-8e1b-e1e1af576f05", "comment": "Malware payload (AZORult)", "value": "add003bb64556818aade5f884209cf12c1f6757862382f8a6e6a01fb7b0f70a26cb73020a8a1e9ebd63971d76cb73ffc", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367121, "uuid": "a0a78b59-050a-4a01-96d2-987c08e0aac7", "value": "T1658533549AF8B38CC834DB78DF24C0144AEA8E976714853F1A02BB3E043F2E55E9AD75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367121, "uuid": "7870b4ff-b031-4aab-b0f7-c9b7c82b3be6", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367121, "uuid": "a23d89bc-30a4-4c4d-a9bd-982f048cc5a2", "value": "24576:P2RNazBjOtEId8rs6MvHRuuYukTLm3hW/J2p7yNY/uxGXAijKebG3F72J8yhysUk:P8ozwbeWRYukYhWkP/xjKSGwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698367121, "uuid": "76f16a3d-8333-4638-94ad-819f726e3f26", "value": 1859072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698367121, "uuid": "d5cec19d-40af-493c-b1bc-acf1792a4595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367121, "uuid": "173ec9e2-15d8-443d-b9fe-3b6b3de26e20", "value": "SecuriteInfo.com.TScope.Malware-Cryptor.SB.29685.16525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec0ccca-74ce-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698413992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413992, "uuid": "feadb865-5ad9-461c-8438-0bac70e558db", "comment": "Malware payload (Mirai)", "value": "731015139969836e9d14baae03ddc7a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413992, "uuid": "a3caa02d-e0d9-4c00-a18b-6dfb52c77c1f", "comment": "Malware payload (Mirai)", "value": "291346ae26b819e9f4815d8babe01bae6ca1a2041ffc80f4eb454a552dd8f7f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413992, "uuid": "c9c21ae0-f152-4c6d-b207-1d14daf0d4a4", "comment": "Malware payload (Mirai)", "value": "d0f57088f0f8585f548b21b861bd67543c76df95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413992, "uuid": "efc38ecb-c888-4c96-88ca-9a11262ab0aa", "comment": "Malware payload (Mirai)", "value": "c0a3964b859b47987be45c47f0e6fdff1d887719c2d6a177dff7fe973e442e5fd720d087a5b86e0aff4f6787b1c915a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413992, "uuid": "e98282fd-8399-49fa-9e78-c10e1040fc84", "value": "T19EC2E041E245DD00D9EB39F12E849BE7BBD07F0B65A68E90269063D5AF4C3624306DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413992, "uuid": "40aeb956-3632-4b21-9fc2-4bd8dc4564cb", "value": "768:GVdafO76jpmNJJKehmA7trpfIX9KeA7PXOt4uVcqgw0t10tLyJ:6am+AnKehPRa9a2t4u+qgw0tYuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698413992, "uuid": "97d03f12-73de-4b61-83bc-dab4a52ae358", "value": 27544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698413992, "uuid": "32479070-f7dd-4b1d-9398-8844bfe7cf17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413992, "uuid": "0a1b14c6-dd80-42eb-bf96-ac9e101e30e7", "value": "731015139969836e9d14baae03ddc7a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd952c76-74df-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698421587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421587, "uuid": "6a8da234-f829-4020-9820-e3e6e546abc6", "comment": "Malware payload (AgentTesla)", "value": "55e1b0ee0fcd3aad5007541a1c94e1a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421587, "uuid": "a6e33932-5f73-4061-9cb2-53a60cdc0e92", "comment": "Malware payload (AgentTesla)", "value": "2a08d8e06feb22bc53f8010b928ab9dfc3a02fedca8e1acad55802df3e4bba9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421587, "uuid": "79e27102-804c-4c54-bff3-460b3b31d67d", "comment": "Malware payload (AgentTesla)", "value": "0e21ab310b8afc0f721da6955823e0522bd717a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421587, "uuid": "abed2e0c-f030-4181-a073-f031b8513ac0", "comment": "Malware payload (AgentTesla)", "value": "bbfd1720a9b914dc8440fbb31779cfcca3a143b9f006a5c7671c33f1703497be291ada7bbde31bee410c3f25d8d72391", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421587, "uuid": "d8e9da77-7450-4eeb-bc69-648464197e4a", "value": "T1A7D423143707031BC39B6BF1B622E4648A9F8F59F96A2148F4D4F2CA686B9F3744D815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421587, "uuid": "cb29dc63-814c-4a36-8f0b-13bed5f2a6b7", "value": "12288:9VnWpG+Y/7PFpRiN3XYLFYm8ZLmkWuydGjcPbgBuwEvxYbOxxhIrz:vLLrxiN3XYLFSMkWuydDzpLvaIxy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421587, "uuid": "2516817f-5798-4ba4-986f-8c17204553a7", "value": 625162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421587, "uuid": "6fb38eb2-50c7-41ea-82e1-d17d9bb68e54", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421587, "uuid": "386b61ad-259a-4130-be12-c869d27dd991", "value": "Advance TT Slip.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17de377-7498-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698391046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391046, "uuid": "3be84456-b028-49d2-af9c-29237922fc46", "comment": "Malware payload (Mirai)", "value": "d952d15acb91bc9d1efc3d3f6ee6c18c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391046, "uuid": "0691b077-399f-49d6-9900-94a20b1feb28", "comment": "Malware payload (Mirai)", "value": "2af9ae532c4f1631396e408d9929ed761108d9158c115f240bbe85f0846216f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391046, "uuid": "40745117-497f-45c7-aa29-422076d6a1d5", "comment": "Malware payload (Mirai)", "value": "33db18b2f247680e158ae6ff3b589390da36f990", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391046, "uuid": "71c44410-92b3-4691-93ff-8f6296cb96bd", "comment": "Malware payload (Mirai)", "value": "a656e9379469a7859956942b754c041f71f83e78885d3a7c62f7da70e7e943aa95d755a45e03580dc7a0f3c5b5d0e681", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391046, "uuid": "b066a4e4-94ff-4ef5-9274-d80d79cbfe66", "value": "T1AC03E0D7985D3BC9DBAE9F3C80B54735AD06F0C134198F8CA7509581E56310BBAA14FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391046, "uuid": "3a9819a7-c9ce-4235-ad2c-4d289886bac7", "value": "768:Ih7xsk4LFj64hdlm+pTrGCHZQi0ML76SYAH8x1Ff5ZDgnFEI2TNWM9:IriRj6QmmoML79Y2Kf5ZDgnFErT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698391046, "uuid": "33226143-a6bc-41cd-ab60-aff8560dfb83", "value": 40456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698391046, "uuid": "12415a70-4b16-47df-bb7a-5e94580c8f63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391046, "uuid": "22a8a50d-dec3-4761-8c17-10ed844a4fec", "value": "d952d15acb91bc9d1efc3d3f6ee6c18c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067a37e1-749b-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698391967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391967, "uuid": "2710d3ac-37ee-4d9e-9d7b-b31e02ddb5e7", "comment": "Malware payload (IRATA)", "value": "6bc3818cb0686ba3ea1898d2f362b2b7", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391967, "uuid": "9ab891a1-8c24-4aa4-87ae-34bb9cfbfdf4", "comment": "Malware payload (IRATA)", "value": "2b901f7b02d941f1d43edf4aff9c95ede22b77d9c4803084dd4b1dfae15d46c9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391967, "uuid": "57a67013-5790-4a23-8552-12e1bcd7c7be", "comment": "Malware payload (IRATA)", "value": "7a9763b933641be75b100f1ab47f2d1ef9be19ff", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391967, "uuid": "723b4622-9759-42c8-af05-ae2b186fcf74", "comment": "Malware payload (IRATA)", "value": "c2fc0f7a809e9213c147352302e68a6c85de256523e52e1b2a251642e550314956acbcd74bfce78e7349d7fa8fe6fa62", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391967, "uuid": "67e173fd-1e9e-4504-bba2-eb8c22b75ec5", "value": "T1BBD52383F366B05BCEF6C3B211A41A35107A4D29CB83A7466959B3FE78B7DC847809D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391967, "uuid": "50b45f76-2c37-4503-bea5-ce5df461a5b4", "value": "49152:F/6EtZk7aIXjIwBw5aWYLBWorzKktmX2HsCLe6XLhalP+9yuVyLHhFu4Iu/RwwCs:d6A68w+1YLB3ruX2HPjXLoYyuVyLHzuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698391967, "uuid": "77c44a01-82dc-461b-b027-01b20306b2c2", "value": 2834562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698391967, "uuid": "09834334-5cc1-4fff-8c88-e32f414b18b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391967, "uuid": "43d1055e-2c49-4494-a48f-8a21a46c3925", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66f43c2-7493-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698388799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388799, "uuid": "3eafe932-37a8-4702-bc5c-461316facbd9", "comment": "Malware payload (GuLoader)", "value": "238c9598c4cdd5f957dd95ab7050df72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388799, "uuid": "34e9aa02-ed0d-47ac-9204-4805ee0cc4ab", "comment": "Malware payload (GuLoader)", "value": "2c5a58ed22f62d77d6ac0206b507b206414b42be361e0197d47a85b232d291d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388799, "uuid": "988ac935-8578-4b0c-b3fa-d75a62a25267", "comment": "Malware payload (GuLoader)", "value": "ae77f2e71411165f9b1e06736567d15b8ea805c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388799, "uuid": "4e365ebe-4883-4693-82e7-94cb5d71f18c", "comment": "Malware payload (GuLoader)", "value": "54ce5992a84ccc2c81db9a05563729a36b3ec726ef12ef237001118f2a7cfae3bda021d5a5ee79c5cbbec4cab034cd71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388799, "uuid": "52f1e172-fca1-49b7-aac4-58a441d2dd24", "value": "T1C1F4E0206B69F913E2F113F085A7EFB57B618D150E3BC6738691EE6A78FC3811D19212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388799, "uuid": "978e6ff9-78f0-4649-b461-4c437ee945cb", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388799, "uuid": "33314e0d-8048-4da0-adcf-ce40a0531807", "value": "12288:uJWNBQflWCCKe/4lz0VFMDKefNo2KAjI9XLvlDwLEuSflue6VfFtqdXFg:uWCWCveglQHBSNxjkbvFHfluNtqdXFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698388799, "uuid": "e2349fcd-917f-441a-a2ce-ee546cb058dc", "value": 726499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698388799, "uuid": "b7ec8769-34a4-4571-90e7-8f8c3e25cc50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388799, "uuid": "c9c034dd-e13f-4fdd-a549-0642f5fbf41c", "value": "G-SRL-OFFERTA65756737884495739578582950023Synsmand.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028d60dc-74ad-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698399691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399691, "uuid": "ab965741-7dd0-4ee7-8d9f-c12a74e785c4", "comment": "Malware payload (Mirai)", "value": "adb1688f753f503ea5c3ac04c30d0377", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399691, "uuid": "0824ea67-f39f-479a-a9d0-ed45df33d23d", "comment": "Malware payload (Mirai)", "value": "2c77cd8f834b2f1b956db9f6ff6e4b5086bde187f4d438fa3b179eb86045d682", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399691, "uuid": "8db88c7e-9f34-484a-9a53-e871a5a4b0d7", "comment": "Malware payload (Mirai)", "value": "f44559714b0e12c4fd457fd684346a32ecc05cb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399691, "uuid": "dae3af71-1a65-4883-9ff2-f047b0778840", "comment": "Malware payload (Mirai)", "value": "f8d1d4a103ced2287dc8b00508e0e77a7fb74409c1de5ef557afd0c71050c4dbf5a45afc28169b6a37e4cda9b5687532", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399691, "uuid": "410cbeda-f26e-4337-bc4b-1fb077d962c5", "value": "T124333BD6B902AD7CF98BE6BE80270E0AB53123541053073777EBFC937E321949956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399691, "uuid": "080fc56f-ec01-4612-9ba0-0eb0b46cd684", "value": "768:8CeKEfhe5Xdrben4I1fN5KQnaodgFHx+iPuvWeffpqmUJT6r6Lu380DZ:dsfIBZeXl5nKFx+imvppqmUJQ6Lc8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698399691, "uuid": "b6d8d714-0f34-4381-8407-bc4b0eb7747b", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698399691, "uuid": "6b664074-6d98-4fd8-8337-47da33455eaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399691, "uuid": "e84c5ef0-8fd8-4387-a082-8cd8ad5102be", "value": "adb1688f753f503ea5c3ac04c30d0377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c8c0e20-74b2-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698402043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698402043, "uuid": "889593f8-001c-43ac-9391-5d2031249469", "comment": "Malware payload (IRATA)", "value": "ca8eb6f2b7591ebbdc1118f6ec8e9a9d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698402043, "uuid": "92537a1f-4f1f-41eb-9950-ec70898504b1", "comment": "Malware payload (IRATA)", "value": "2d77ade348d24d4cd92cacd5d4b9265ee05570794c9b745247c39730f85e2bb0", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698402043, "uuid": "906c8bed-bd7f-4566-9c62-a1929da6a5d1", "comment": "Malware payload (IRATA)", "value": "63c0643eec612ac57823672463aee89f193a68ff", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698402043, "uuid": "4ea4fdbf-18d0-408f-bf9c-9384a0cf1784", "comment": "Malware payload (IRATA)", "value": "956d42a164af32821ed8cea51349a8ee13d68f0a4e38b63851a9903a18dd9d5def64d92cb746e7736a58348ada280c9c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698402043, "uuid": "72793f3b-169b-46ef-bb96-4b0cfa9910c1", "value": "T169C52253F66768ABC9BBC37111741635253A0E28C703B78A3598B7BD28BBED84BC11D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698402043, "uuid": "9b8a49a6-28e2-486e-96c4-a226c5a6e844", "value": "49152:Z/YWTHZrOI1Kta7p+Glm6ZtQWdNJ6zWSjY0nKFdCkwzLA/RzzzDA+5u:BRKo7a6TQWdKqI5ncdMzU/Vzwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698402043, "uuid": "0b422213-b8a9-4cbf-9ea3-7359bbaef4d5", "value": 2720261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698402043, "uuid": "bbaa0d4f-e55b-46f5-a05f-49769e9fb031", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698402043, "uuid": "796c524c-18fd-4f0f-acb2-d58ea37de2b3", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c33679-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698421680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421680, "uuid": "787e1549-1d96-4207-a7c4-735d422a5c78", "comment": "Malware payload (AgentTesla)", "value": "1158cd2e9d1c1dd7b0d1e8cd8d8720b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421680, "uuid": "645a7491-3eab-45ae-846b-e7105ed6667e", "comment": "Malware payload (AgentTesla)", "value": "2e9539f4aea8f755534d692c4d5f15cfa262666701af6deb508fc2dd8f1061eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421680, "uuid": "5f786dbd-61a4-4f90-9a64-947dcfe2bc73", "comment": "Malware payload (AgentTesla)", "value": "ff15d9321987cd0b3fdbaa42a67e3f1ec2672def", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421680, "uuid": "528591bd-dfa0-46a3-a231-dacb0e53ec5d", "comment": "Malware payload (AgentTesla)", "value": "e2d670112dbfd17490d6e2251b74069927f091ff07f2d4f37808c074b05771395ff1260f0ee4a5035217e47075bdc8e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421680, "uuid": "344b78ae-754d-43c4-8012-c9b47893e63f", "value": "T127E423076A124C7AE02EA7E2F05F5E58D747988DF432870D03B129DC68DB56DDA239AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421680, "uuid": "5c9ad6c3-ce97-4d24-b657-bfafba068fdb", "value": "12288:n/nW/Jn31f5hdhMflWWSChHfbiPgGqQ+K2RXZF2IJ8XHT+aawX:/631f5hdhMflWW3h/9QfgF2w83T+aa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421680, "uuid": "65b76e29-4ff7-4e4c-a5fe-4ffa8b1590cc", "value": 666305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421680, "uuid": "c8f03e83-8314-4d26-8a45-14713631eee3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421680, "uuid": "7afcbd60-0af6-4b80-987f-c65ae32adbae", "value": "Nel.Eorder2023.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5f0f92-74d2-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698415656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415656, "uuid": "0f5fe014-d37e-4d7a-9f1f-2f71503d9e61", "comment": "Malware payload (RemcosRAT)", "value": "f6cbf303899397b7d28e19930d48627d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415656, "uuid": "1d3bf6a0-b348-46a6-b30d-b129aaa6c76e", "comment": "Malware payload (RemcosRAT)", "value": "2eb8015d95b1f69eca4acc3d64c0ed58125431a19df865a493990025ebe5b40a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415656, "uuid": "5057faff-4c76-4525-a524-398192ac44be", "comment": "Malware payload (RemcosRAT)", "value": "c3b2d0902bc0724228519030d341294db265f379", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415656, "uuid": "bf5e2dd5-f620-4363-ad27-c43374e409b7", "comment": "Malware payload (RemcosRAT)", "value": "84467fe6d8fa202b12fdea397348642780570b4a1017197e6e66c84fc00fe279d85fe55ff96b4714b25de9e32b254544", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415656, "uuid": "e1a15a21-3a28-41c3-b628-0966ab85cbfd", "value": "T15AF4E0216A2AF903E2F203F09567DF756B618D550E7F8A738791EE2B78FC3811D18216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415656, "uuid": "efba8d97-78eb-4f8e-b1c6-a52181ba9b5b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415656, "uuid": "d464bd1a-16fe-4e20-9faf-79a00eec9ab5", "value": "12288:uJWNBQf/tJK1Znk1YAxpqPf+4u+432AAjI9XLvlDwLEuSflue6VfFtqdXFJ:uWg49k1jcdDHjkbvFHfluNtqdXFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698415656, "uuid": "693afa31-b7ac-4963-a829-8df6feabaf57", "value": 740313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698415656, "uuid": "ee6a35c6-303c-4913-adbd-08b3a31f0570", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415656, "uuid": "58d74ca8-cad5-492a-b65d-2e6ab1584377", "value": "DHRI_kurumsal kimlik rehberi-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1579d66-7508-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698439095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439095, "uuid": "1c446c9c-b9aa-49cb-95b7-68ec77a03b94", "comment": "Malware payload", "value": "4e8f9792dd5abeb31acdb7850e1feb31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439095, "uuid": "1db59e56-e1ba-4d06-a88c-e073bb92b3c8", "comment": "Malware payload", "value": "2ed448721f4e92c7970972f029290ee6269689c840a922982ac2f39c9a6a838f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439095, "uuid": "043e0121-ff80-4b7d-a689-462b180a1833", "comment": "Malware payload", "value": "047124d79f0483f62fdb92921af77f800dd269b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439095, "uuid": "bd1a892b-f71b-4a6c-aea3-401eca9d0621", "comment": "Malware payload", "value": "e7e5a66271e4c073213b2b0f0ed565ef791cb5e38aa47b281035c424fb2f5f04d962a81475e286dca4f10e3adfa1ee61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439095, "uuid": "31dc56ad-37ee-43cc-8aa6-dda9c6865608", "value": "T101463907FC9151B9C0AEE2308A669252BB717C982B3023D72B50F7B82F76BD45E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439095, "uuid": "f1414f6a-2c3d-46a4-a83b-dcb931f3e4da", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439095, "uuid": "244b9cdd-34ff-44ed-b6c8-78accecb8f0c", "value": "49152:hATAFHGe+orb/T+vO90d7HjmAFd4A64nsfJSkOqugEkgEW4H5rD1IfW28e3rXQ4E:wY+Dk5u3r3A9fwMa1Q9EFk9EGClYy6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698439095, "uuid": "cef953c6-5dac-4f79-811f-10b658552f5e", "value": 5722112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698439095, "uuid": "e9b1a50c-3947-48dd-a2ee-15f40c7e3698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439095, "uuid": "2b23c8c3-d185-47ec-b2cc-4218c233fb84", "value": "system.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae17b14-7521-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698449554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449554, "uuid": "c5aade4c-bc3d-489c-8b5a-eb2c8277160f", "comment": "Malware payload", "value": "737a6431d4a2746cc49abd0d9b5c3833", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449554, "uuid": "54cc8dd0-2909-4295-8198-7b0f082e8eac", "comment": "Malware payload", "value": "2fcc91960ecddd70e57f392fde3fb4c5d12befa0dc18e68cdf2fb37a06d28464", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449554, "uuid": "c0abfa7d-354b-4db5-9051-a78187d7f483", "comment": "Malware payload", "value": "fe8534e41f2b86c451d934226172f14698cb45c1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449554, "uuid": "bfb99d11-ae1c-47aa-9a8c-00919539445b", "comment": "Malware payload", "value": "853766a2be704a30fc1e20890839faac6df019e4bc2e7cc3f41dd7f5d45af33eeca47bc2e504468efa16b7b9fed419eb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449554, "uuid": "8f38c0ef-95c2-46a3-b286-5da5b964a25a", "value": "T1D653B519BF610FB7EC6BCD3709A81B0538CC644A22A87B367934D468F64B25B59F3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449554, "uuid": "dd90b575-f733-4584-8eaf-e029abb8739b", "value": "768:iAVWeGUx4YGMmnwCw5BheiTebiQ2ZFVyXiSA7mWzkCwE:iAVWds09wxjTIitZFVbmaoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698449554, "uuid": "7c215bbe-043b-46c9-9483-202ac98ca4f1", "value": 61080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698449554, "uuid": "c1d5e76f-d45a-4aa2-aebc-5d0def1a82e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449554, "uuid": "ce248ea8-b535-47d8-9cec-df9c8114c3e8", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8815c76a-74d9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698418813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418813, "uuid": "932b525d-a28d-496e-8d2e-aaf0dbecd63f", "comment": "Malware payload", "value": "f08c3ef13100452df9682a2aedf130c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418813, "uuid": "ec88d222-6e88-48c7-8aa7-43d58ecda450", "comment": "Malware payload", "value": "3041bf845c3d039a2a20d89061045c87f92473f6ef5dd57bb299784fcd0dc150", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418813, "uuid": "00f4fb6b-6618-4ca4-8275-0433a2a2b496", "comment": "Malware payload", "value": "f4aaae14bd01bb9593c34796e237b6662035b5f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418813, "uuid": "ed4e3fab-105c-4447-bb1a-b92e1cf47fa2", "comment": "Malware payload", "value": "a5e4c2cf5a3cd1dd5b9e9f05a1e5b2a34b68c9951fbdfb5f3abf2e3a3460bdc6f7e4a4fa31c5dc7d5a3747ee1be39b45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418813, "uuid": "08d3a5c4-ae1f-4d05-85ed-d82887e8aaad", "value": "T133531B5BE9E9803BD05843740AE306C323B5BEA42B6DA76AE74F6C842C751B47339357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418813, "uuid": "2258a545-5117-42a9-919a-a09c62b550be", "value": "1494de9b53e05fc1f40cb92afbdd6ce4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418813, "uuid": "e8591394-e138-4852-8d88-b1658731ebdf", "value": "1536:ZPdkZdi9rKYzzgbv9VSn8YCN6JyGs5gZY6:bkZdaKmzgbjc8H0Jo5AY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698418813, "uuid": "664de20d-6b39-423a-8e86-93909fd47955", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698418813, "uuid": "b9e34750-e935-45d7-b50e-8c8bad011899", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418813, "uuid": "abb6810f-57b0-408b-837e-a5b18f072507", "value": "f08c3ef13100452df9682a2aedf130c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26da9f56-74ec-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1698426810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426810, "uuid": "1557e31d-bfb7-4405-a307-2fd4ec0edbe3", "comment": "Malware payload (Healer)", "value": "b267f606f2ae5bd7c3968e72868c1c40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426810, "uuid": "cba024f9-2c72-4b98-b16f-ae931d265763", "comment": "Malware payload (Healer)", "value": "30535546ba2636bf9d49bc99b54aee52478125a82e4d526df115eb2fbf827146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426810, "uuid": "79780a78-d54d-4040-b44b-61da18960e62", "comment": "Malware payload (Healer)", "value": "57aa1ad5208f9188d0bfa6c9d54dd5a22de79405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426810, "uuid": "7b84d8a0-fcdf-4670-a1ed-320ded87371e", "comment": "Malware payload (Healer)", "value": "53941ae716e5579d32794e4f435d819f734af60b460b823ec19df30e262401d5798fcdd9efa465a3f96c42e3d9d16a81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426810, "uuid": "adc3176e-722e-4272-820e-6258c03c5b3e", "value": "T157157D2138C09971EEF220B743ECB6A642ADE4B4071516DF06D837EED76C6C17B32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426810, "uuid": "e59b9af2-bec1-4b80-8869-65c87d113cb2", "value": "d880d0ae07cf434dea838358ed4c863f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426810, "uuid": "ca416044-6803-448f-af86-f1d0e8e8c14f", "value": "12288:o6ygLhO67zWdgM8/26p6Lb9f77QBGbyFFUpulVhjIhus897tzyPi:EShOKzWdgM8/26p6fOBGbyGOMqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698426810, "uuid": "f1b713e2-9447-41ad-a5bf-e58d99ec7009", "value": 911872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698426810, "uuid": "c0230b4f-97d6-42ee-ab9d-36431ced6ecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426810, "uuid": "a1ed98aa-eabe-49cd-8d8c-d342729570ab", "value": "1Bb31Xs2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cd2a772-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421747, "uuid": "597235cb-094a-41f3-8054-eae23dde26d0", "comment": "Malware payload", "value": "dacd0e44b1ed3c67c0d80a4ce8d8c09b", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421747, "uuid": "66d7683b-f2a6-4440-a4df-935903375fe4", "comment": "Malware payload", "value": "320d05d9163eac7fb9ef9fc0bbcc95bdec375c14b9cbdbf2dc194fa67c128a42", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421747, "uuid": "f76cef84-ac55-4053-8d8f-5a3e93e0aeaf", "comment": "Malware payload", "value": "b7f3aa74bb3ae22d3a4b51364bae8de80148aef0", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421747, "uuid": "811dde5d-4b9d-4acd-8d46-14a6f254a2d3", "comment": "Malware payload", "value": "bb24ee49ba6b78e5598743ed1f419d986ea38fabb25e087f6cc0885dfaa7337d89b7ef28bf232c4024b47341d8a65deb", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421747, "uuid": "8272dc53-a9ca-40bf-afc0-00ca8c053e50", "value": "T1E072392EFFAB467CC856917482E38B35FAB9F02012514B2EC6F4D7365F64B24D72A508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421747, "uuid": "43e336e4-5137-48e8-acef-010d0b67eb96", "value": "8b7d6f218f07082b5df448bc58285040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421747, "uuid": "c4cdda2e-6f40-4f28-97da-dab34f15720b", "value": "384:4l98Oh1tl1i/D00JOt+Z0D+xnqhuFr7Cj:29dRe/o0JFZyuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421747, "uuid": "2df945cf-efc6-44b0-8bac-840aca7b55c6", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421747, "uuid": "e71cfecf-06a0-47a0-9cb2-702de6e6e6fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421747, "uuid": "d5109dee-aaab-4579-9100-70380476a07f", "value": "Billing_Statement_NOV-23_VZ.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb4c963-749c-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698392652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698392652, "uuid": "f8e1cdf1-f487-43e1-a199-deb920ae5a00", "comment": "Malware payload (IRATA)", "value": "79a0b382065c16d455cfd8b1e945e3ec", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698392652, "uuid": "7758813d-9331-4676-ab22-34f36683caad", "comment": "Malware payload (IRATA)", "value": "32a93cc9ec64a8ad0bc3d9ed66191c9ce965dbe5be7ea82188b55a4ec2ccf6f0", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698392652, "uuid": "33d2d988-1d98-45c0-83b8-d8dcae22159b", "comment": "Malware payload (IRATA)", "value": "b77dc304110c4b78d50ce0b0135370ff07b1b71d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698392652, "uuid": "e5a9785d-58ea-4362-8c5a-b3dffe4628e7", "comment": "Malware payload (IRATA)", "value": "fe6a2309b4d67331f6e1d55f24db769ced7db56b65af9f43fa8b17947d60a49f72d8610ff761fa98c759d2168afde024", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698392652, "uuid": "aec63e2e-1710-4fd7-8815-1f6274e27aed", "value": "T1E2851243F676AC27C832C03320951A38611B5E15C646FB4A79A877BE78FBCEC4B815E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698392652, "uuid": "a9aeb218-2423-4327-bd89-4099bf86b0a2", "value": "24576:LssI8S6pk6EXLfV3vGWX1h54BrqJWd/380SnjbK/+b4jweS9Y/ZJIg:LsFkk6EXLFZqrUWd/pwbgW4jqqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698392652, "uuid": "0f20ff34-8608-4d46-a7b6-466e4ad181f4", "value": 1776632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698392652, "uuid": "c1d09a1a-649e-4b8a-ba00-4e856135eee0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698392652, "uuid": "7a9db0d7-0c72-4e34-8443-d698739ba9ca", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d409550f-74a5-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698396607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396607, "uuid": "c1176b7b-11aa-47ab-a2ae-961d8c42c9c6", "comment": "Malware payload (Mirai)", "value": "ff06c838d6d00d31559f20f50311b992", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396607, "uuid": "5e6a146e-8587-4335-8c48-189582f33056", "comment": "Malware payload (Mirai)", "value": "332ffa10c35ea786c71d4fa326474a7793073f64ece9a72f18207945ecb4cc68", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396607, "uuid": "c643efa5-da42-48b7-9b97-9e0178b13349", "comment": "Malware payload (Mirai)", "value": "eed16d1c3d50da0dedb26d602e9a5cdf47ab12e6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396607, "uuid": "d9d34906-181f-45b5-b803-d7f7c1aa89da", "comment": "Malware payload (Mirai)", "value": "f476ce3bc02e58fffaee0c524a4fa6754fcf0a8228bfb4ae3903d4b7d409aa5ff8006e03fa5b0ea9dcfb4d0154c16f32", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698396607, "uuid": "03fa3c17-9da0-4b49-b9d3-8aa405f922c0", "value": "T106B2D071A015F8B7C7A100779EE9DA83FB801EF8D0F8B3291465099DEAD9942BAF1147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698396607, "uuid": "61b0abe2-5785-44c0-b35a-a415a9d0e890", "value": "384:cZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3p5hymdGUop5hr:5X9nxn8o9wnBoWzEQf2EjKb3p5s3UozR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698396607, "uuid": "dd00ab42-ca88-429c-b912-57407d990aa6", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698396607, "uuid": "0fcd9fc8-7e7a-4bf2-b7f0-b3aeeeb4a122", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698396607, "uuid": "ba609f08-9bf1-45dc-8fc9-402d6d1d1891", "value": "phantom.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05497773-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698422030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422030, "uuid": "1dfc1bb0-35be-4359-a2f1-500a298779dc", "comment": "Malware payload", "value": "e1d24fb776bcfd1877ecfbc50d0bb69a", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422030, "uuid": "6346e52f-c370-4c41-8786-f340180166a3", "comment": "Malware payload", "value": "339c8034365586d01a26d3a2830b8978b00dabf55ab44ff2bb3c410fa77dfb29", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422030, "uuid": "5b44da5e-53d7-4f4a-b515-ce4b5a12e71b", "comment": "Malware payload", "value": "a56aa775f250a0d3921ca5bd395d17229e9908cf", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422030, "uuid": "202f27ef-73ec-428b-a593-48aaa2db173f", "comment": "Malware payload", "value": "23009ef003cdc2a6155d1430d1a0cd7af810e977f5ea6b6f81d337e8ab0449d10e70db2578702d58e7669a3e61caa972", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422030, "uuid": "eb1f07b8-c593-4e55-ab9e-e9da84d1593c", "value": "T1A0722B2EBF97677DC45ED07082E38B39FAF9F01012514BAD86F4D7365E60B24932A908", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422030, "uuid": "ad85aa1c-3fad-442c-8ddd-9533ceef1d71", "value": "8b7d6f218f07082b5df448bc58285040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422030, "uuid": "ca646ce7-34c2-4550-848c-abff5f033bd9", "value": "384:KWT9lyoWUlfxV1v10JOc+Z0iEBhuFr7C:K29l6ox/10JAZ0uh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422030, "uuid": "eaf6fd06-dd20-440c-b983-f86d70a015b0", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422030, "uuid": "1f664456-fa14-4c84-8977-b74bb410e813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422030, "uuid": "41051b97-cfb9-44b4-9e2a-003b447c0c81", "value": "Billing_Statement_NOV-23_0M.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9a09b5-746b-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1698371500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698371500, "uuid": "ae98efb9-c60e-404c-b20d-acdf8578ba68", "comment": "Malware payload (njrat)", "value": "1bc076e59a60a37f69057a7bf7a66aaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698371500, "uuid": "2fc1d9ed-511d-4625-9455-cc3e990410a7", "comment": "Malware payload (njrat)", "value": "33a2a6e04112b2fd3cc2e04d46523d177dd4439542fb6f3677cf7f3b265aeebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698371500, "uuid": "f7928c60-9af2-4db2-935f-61c0d91c1d79", "comment": "Malware payload (njrat)", "value": "7fc6d00005f3b3483b43c7551ff1a5c29eb282c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698371500, "uuid": "204f1a9e-6d55-428e-80a3-35807a5772d0", "comment": "Malware payload (njrat)", "value": "ca80af5fc7fe1e9270edb8f3b839397f405c530c52e7a4f72548cfca780bddcac887548414705bece8756475ac46b922", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698371500, "uuid": "f44ce4b5-ca38-4a75-b9da-aa1db776d913", "value": "T14AB22B4E3FA98856C5BC1B748AA5965003B491470423EE2FCDC554CBAFB3BD91D4CAF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698371500, "uuid": "7f8d0111-065b-4a68-9057-109c39f99200", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698371500, "uuid": "48a98e66-32f9-488c-8daf-99b8aed30c14", "value": "384:v3gexUw/L+JrgUon5b9uSDMwT9Pfg6NgrWoBYi51mRvR6JZlbw8hqIusZzZeVs:vIAKG91DP1hPRpcnuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698371500, "uuid": "1f703cf3-6620-4e6d-8964-a91bf86843e5", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698371500, "uuid": "e14fa20e-75c4-4c89-99cd-1c47234e710f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698371500, "uuid": "3fcbdd88-9939-42e2-a325-1b736908c90d", "value": "wxc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff3982c-7511-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1698442959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698442959, "uuid": "9d4564ae-7678-4c7f-8bdb-49bf0c27cf4e", "comment": "Malware payload (Adware.Neoreklami)", "value": "e2e368bc9b5df048be24badca6081eaa", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698442959, "uuid": "9e99a543-f12c-4d76-b7b4-992c9ac86c48", "comment": "Malware payload (Adware.Neoreklami)", "value": "343d6abe51689e05a9bb3cf35e87062e02e4d2e6dc10b9dd02401afbdbbaf5ec", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698442959, "uuid": "b06cc48e-8b4c-4b3c-a016-0aace3384d01", "comment": "Malware payload (Adware.Neoreklami)", "value": "6e73d1077cfb844cbb03f10a625fae47fd64b979", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698442959, "uuid": "a07c2cf7-0b93-4515-bb4f-4799ead3c310", "comment": "Malware payload (Adware.Neoreklami)", "value": "a81c7ab695d9dcb37daaec74258403b5b41f931d109de7021fe10e80f3d346ce4010b9b01ac0eb88533376ae7f4e8446", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698442959, "uuid": "182e594f-3f99-4dd8-936a-a9272a85d2fb", "value": "T11D76333475D680B3D1925C35DB81BFA7A2BEC59A1D2282372BDF0C2ED67CA09C9B4474", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698442959, "uuid": "e2f6db50-34c8-4c6d-af23-6d8b317e2329", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698442959, "uuid": "250f16a5-b60f-4b78-8151-45d1a1d763b5", "value": "98304:91OgonS/+VGhF3mzYTzAhoy9t+AFI1+WpBcQvQ1r96CkEGAFzFwfChiOW:91OgPWVGjmjh99t+AFIC1x961RADw6YP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698442959, "uuid": "9e398b4b-9874-4e63-89f7-9eaa18363bca", "value": 7496633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698442959, "uuid": "b3567184-e32c-4bac-b204-88d90b7cb351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698442959, "uuid": "1af9c919-debb-44de-a6ea-e6890b6866d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330539e1-7461-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698367131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367131, "uuid": "c31d9735-d2aa-4dab-8b1b-2dbea4d67fb9", "comment": "Malware payload", "value": "70d83d844d5cfbea0b9625bd17fa8c91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367131, "uuid": "e6e25904-d77b-4533-a319-7fccc9ff2b5e", "comment": "Malware payload", "value": "3737a7dcac4efd308909e5410dcf6185698c4c3325794d84757124041de00956", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367131, "uuid": "94e0db6e-ccdf-4b88-88ad-2b65ba17ca4d", "comment": "Malware payload", "value": "597eb91bd234a8fbee6bdd80dea553e88572a75b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367131, "uuid": "42b735d7-59bc-4a57-80e4-3ecb93b1ef1a", "comment": "Malware payload", "value": "38031b729c05459e16b1b393c86c7aedab87526932cbef44251977aa4f5060773278b9a063b24ada04593d76c072e472", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367131, "uuid": "786b1041-270e-4fb2-bb48-a5e4cc10dd66", "value": "T1C19501C2D6481373D2A658F29027528DEA6D0EF21179E47A12F37E8335311B9B2379DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367131, "uuid": "b6a28830-f129-478e-8c08-230998a36de2", "value": "1ab954f0a2bd856e8798f5d833163ccc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367131, "uuid": "4693a943-b7c5-48c8-96fd-b130c6100bda", "value": "49152:viRrDQ7Frv3PK2TvRO1AHyQh/J7aEqNy3Cg5PBR8yAwvY6zQHXt0OePAPa0:vC5ktJ7P+jtU4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698367131, "uuid": "baaad73d-0c5e-468e-8749-7c5da6061d2a", "value": 1888256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698367131, "uuid": "d52f9a2c-5802-4fb8-81f1-15e88a3bd25a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367131, "uuid": "48883ceb-4af5-4c6f-8591-a742688888a7", "value": "SecuriteInfo.com.FileRepMalware.23705.5466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324c5e0b-7461-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698367129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367129, "uuid": "abecbaf5-b3cc-4329-bd4a-f5fbcc5bd139", "comment": "Malware payload", "value": "5027fe5d13f5700bff6f365a6877b6f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367129, "uuid": "c3f376cb-6371-421b-a32f-46a2d0c1add1", "comment": "Malware payload", "value": "37f4d201cb7a76f450577cf122ed19bfd913bc7315db50b73c4b4b3df3ac7a59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367129, "uuid": "04f23704-324a-40b2-bb79-11716c66b817", "comment": "Malware payload", "value": "80d1fe5c98160c7383071c43bab251657e560b0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367129, "uuid": "ee7b59f0-83fc-4c4b-acc9-b4a308ef2994", "comment": "Malware payload", "value": "0ff2959ef551baa0dac130b4979beca9e0505570535a54934a38543f88e1f6050cb85e4a620e66ae5b474569174eeddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367129, "uuid": "3e75238e-f0b4-45e1-b2bd-611f9fc35662", "value": "T115159E95F3E280F3C25A24320B66577A5A76D9474B378BC3A256DF6C49360B0BC3B271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367129, "uuid": "1b6b5e24-fbf1-455b-86d0-b828dd443fd3", "value": "6144:7L7kfOeWN+367ix3NWk0dn2cU86S+4MegmVtewqcgFRC8W1RtmYjvfeIHsg3ie:7Lof2c367ixUkm2cSWgmVtewh9mWvfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698367129, "uuid": "32f595e1-44e2-4cd8-9cac-a6c68ff05de3", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698367129, "uuid": "455c6633-589e-469f-9cc0-b6a78e58b48f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367129, "uuid": "7dbe97c5-2ec8-43cd-8828-14d479e9682d", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.12826.1562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d226422c-74a5-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698396603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396603, "uuid": "54329417-fa50-48c3-8ab1-6bb3e23a59a9", "comment": "Malware payload (Mirai)", "value": "8317b496dfa6c28277201129f60238e4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396603, "uuid": "f02825fa-8805-468c-8911-9356976962c8", "comment": "Malware payload (Mirai)", "value": "3867d9e43ab3e6ad0f4451126ed6f1515a0d02ef98b93e855f6f9906a1dedce7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396603, "uuid": "76aea769-a475-44d5-bd5b-8d85aa136356", "comment": "Malware payload (Mirai)", "value": "f0ee0617f82f60320f12056b770d5a81737e3a2d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396603, "uuid": "767d8acc-09a7-460d-a1fe-3476d8756d33", "comment": "Malware payload (Mirai)", "value": "a8cadb3bba3b38ce837c7f88480470c8e66e39bb0a84fec824e792cb6406e41e45396eea64f51e9a418e1974a7df1d02", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698396603, "uuid": "edcf9b1d-e136-4f39-ac0e-209d20e59985", "value": "T19723021320E7ED03D421947BD8219D687E044AF8B9AD7BB728411694CD60F63BEF1A7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698396603, "uuid": "762cd631-d6d0-4265-83fd-35860f13ffea", "value": "768:SK7y1XGO1LCNgukEkvwtqPnH7u83nc0iF5q9q3UELv1Q06pMBwAA3i5S:M12O1LCNguovDPH7Tcr/LtQ/pSAy5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698396603, "uuid": "98c4eb1f-7418-4b3c-a2f8-8fb3f28e04df", "value": 48716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698396603, "uuid": "8aa7bfcd-900c-4b56-93fe-c5a696e01650", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698396603, "uuid": "d1157233-781d-4a15-87f6-1203048d2d60", "value": "phantom.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1176cf-74df-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698421590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421590, "uuid": "fa7a0f4e-7f5b-4719-b759-29286bd69d25", "comment": "Malware payload (AgentTesla)", "value": "a60ed935cd86a6769804a21d092449b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421590, "uuid": "45aff521-23ce-4894-b291-393a32f2fdf7", "comment": "Malware payload (AgentTesla)", "value": "3876f53e7024266fb115dab7b3b538b145f23104ed93c251a8b3a3ec0b5bd85f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421590, "uuid": "bc10afeb-d0e0-4d3a-a647-557e5937a67c", "comment": "Malware payload (AgentTesla)", "value": "3f996e711f78d8bee887eff1dbe39a94f6a33857", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421590, "uuid": "78eca244-30b0-4e87-a505-e5184870f7b7", "comment": "Malware payload (AgentTesla)", "value": "a7a1dc74dfbaa68241bd28e8574e7f0f2125c5137ed99837300b61a0b3c26126963fcbf254530185b32aed17befd96f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421590, "uuid": "d6b4397a-03c7-4872-95e1-b8244a9c662f", "value": "T132E423DCAD4FE2B68E1CF91733D8389B633F78C18EA452396C3B825214554A0C679D9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421590, "uuid": "e9a683f4-15c4-4d1c-8404-e6a21f6afd15", "value": "12288:9PojapizTcz28XctNr0AeGNHYiGrcco46EpTse3iNluo3CvTKMT9Guf:9PojGzYLHYiUX6QsepofYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421590, "uuid": "0ee9a194-b2b7-4e93-b85a-30c29aef0d41", "value": 685263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421590, "uuid": "a80c7d23-ce81-4275-98b0-7943b5a4dca7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421590, "uuid": "43d74371-cb64-4f4a-a5c2-219b2a19c7cc", "value": "New Order 271023.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665b570a-74df-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698421333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421333, "uuid": "63aabb65-2cab-4747-a436-222a9247ea64", "comment": "Malware payload (RedLineStealer)", "value": "4e6fba034234386b41471451383d8be8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421333, "uuid": "46b8d766-0c4e-4577-a2d9-41a1663cafaf", "comment": "Malware payload (RedLineStealer)", "value": "3932112f1cf166503abed03c187c906c46d61c9d27561519f83ebeb3bb8fa3ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421333, "uuid": "943eb85a-c74f-4377-8c68-7085324d7ca7", "comment": "Malware payload (RedLineStealer)", "value": "1fbde80f42d24155ef1c58bf6eaedd6381a51c30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421333, "uuid": "0968fe4e-9cf2-414b-b79d-2898ab6b7486", "comment": "Malware payload (RedLineStealer)", "value": "dd355f0a91fd502ff2d2035d320d2400292b155e976536b10d901ebc5c5502ac01e289d0979579236a0243e3db90db04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421333, "uuid": "5c486f27-5a68-4504-b4a1-557595446989", "value": "T128752343FBC41533E5B6037424FFA7931E353D929E38869B62946AA70C63365793232B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421333, "uuid": "09c4f819-96a9-40db-936e-356b2c7454f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421333, "uuid": "71048ba0-7cbe-4215-a2a2-46f4a604a0c6", "value": "49152:mjfWvqsUYWDjnH+RtBI182fC8IqamfBVJ:yOuYWDTHItBIfC8ITmpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421333, "uuid": "f64fee75-341a-4f3c-b3c3-808fa5a3c8d4", "value": 1626112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421333, "uuid": "f0b4c1f6-5fe9-43fc-a9d7-d0d3fb2d8120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421333, "uuid": "82035b1a-8b6e-46e5-afeb-9a368e58eed3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7198d0b-746c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698372130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698372130, "uuid": "055cf10c-bfb1-4b6a-a9b9-5290c5b8e4ad", "comment": "Malware payload", "value": "f9a4d1e59de045cf7c3f637f4ac835d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698372130, "uuid": "0fe6d30c-459a-4006-ba35-2df24b4768fa", "comment": "Malware payload", "value": "3970c8a14a7cf30f3a8a8bf09f3a674309279459dfbacaa7aca34b7058a78dff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698372130, "uuid": "5e647725-dbc6-45f8-abc0-9154fe25a19c", "comment": "Malware payload", "value": "2d44fb5a4b24d192d85b5b19b29e34648c37d879", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698372130, "uuid": "5869916d-bfb5-43bd-829f-779fe71561ca", "comment": "Malware payload", "value": "6030581d9661beedfe65b257aed2b707c13f620059a60da7e5adaa7cbae68a69dbcb199a8991d6c9d2312ba7f4887707", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698372130, "uuid": "d6657060-5c24-48d7-a323-9a363464163a", "value": "T1F9C501A37799484FF965E5B61EF0B911EB37EE01E1891CC17788B6ECB011A48A43FD60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698372130, "uuid": "a3bd3817-536c-4868-94d0-25f87aea36e9", "value": "424bf84ef133d7e8e8e3791eeea2950f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698372130, "uuid": "94e7f759-d47e-4e1e-bbe4-c1333e32ece7", "value": "49152:TRsbrrrrrrrsWihVr5+X2c6BMWpAYdXRB8XtcK1rtBlZk70AnDWlELgHN:TRsbrrrrrrrsrh13JyWp9R6X6KvTW7UJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698372130, "uuid": "6e40bcce-ed77-4e9a-8859-20275a071552", "value": 2579456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698372130, "uuid": "139dd8c1-b667-47d8-97f0-777af6b9ffc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698372130, "uuid": "885ec9c3-5352-4890-bac7-85e0cb864adc", "value": "application.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9018e35-74a9-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698398360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398360, "uuid": "ded89762-fe58-4478-a266-5b1eccb35583", "comment": "Malware payload (IRATA)", "value": "c4a8a2a580ffbd20cfc2d382b6000f29", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398360, "uuid": "afac042d-0cd7-4241-a0c3-7e98ef308ed0", "comment": "Malware payload (IRATA)", "value": "39c7ee0fdec5b3c37e5327c58113522b94804a7b7d4fcd63ede41c9d83fb0c77", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398360, "uuid": "cbf3a379-1fa5-4c30-b574-cd10efa8a8ec", "comment": "Malware payload (IRATA)", "value": "386738050a53ca4417cf84aedaf204ba08e989a5", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398360, "uuid": "b94feaf1-26df-4707-93e8-5d7a3d9849e4", "comment": "Malware payload (IRATA)", "value": "3d45afc5a9bd7cd8a8f22e415eb70aa58d473ed63e1aaf18338b644abf81cb7f25fbda4ee9b8346fb4f23075d375c392", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398360, "uuid": "e96fab8f-3f8b-496b-bcb9-2ea1a387143f", "value": "T1DA851253F37AB867C8F1C37211B51A35623A6D25CB43B78A391837B969B7DD80B806D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398360, "uuid": "938459a3-39fc-4471-9377-a03df1ef406f", "value": "49152:BsgkkU0XY00mvJLzxjXOatRPPd/Bk8DZwZdF7Pn/iRpMw73:BkkDXTJL1OanXs8DZwZdR/iRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698398360, "uuid": "8ea23d4a-5e4a-427f-be2c-29d488158f67", "value": 1772504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698398360, "uuid": "1681f90d-bb6a-48d2-a746-b39ae71b7a36", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398360, "uuid": "993dd5db-1f0c-4f63-960d-bf8ca559d509", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "445f61e8-7492-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698388205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388205, "uuid": "56ad9998-2d0f-4bbc-8c73-d2ace1d5f680", "comment": "Malware payload (Amadey)", "value": "c9aa05e75a369370955cf71b12a2121a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388205, "uuid": "0e3365de-4320-48f8-bbb4-7bfbfbfd515c", "comment": "Malware payload (Amadey)", "value": "3a5addf4fef89f397e1abe68c3e4605e13f1aefb20ac7a705e944dde4ccd5b8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388205, "uuid": "2f77a63c-fd7e-48eb-88d4-5e1a70a64935", "comment": "Malware payload (Amadey)", "value": "dd5f45524e0a73c36f7e429943e87864c90914c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388205, "uuid": "99c5c1a3-20bf-47ad-9c20-691e97e12d9c", "comment": "Malware payload (Amadey)", "value": "c4ff3be07c01bf449ee349a5d869b1c2eabfbf47fc265e93b954712df91a1d2571ffc8fa39d3bedfd2fa2949c63d9dc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388205, "uuid": "c8000664-6eca-463e-9ab1-0371614e5834", "value": "T1D675AD499F4ADA13CE100271D197C6F72A49DE8F9707A3335BEDBDB330873885698299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388205, "uuid": "778b3e22-8aaa-4182-b1f8-4cfb791941b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388205, "uuid": "b6e552fa-bc93-4046-9871-44b30bcb2b57", "value": "24576:6dczsM3Cfptr89p7vyCuWk1s0BClDKBcPME5OLi:wWsM3Cfptr8z+CuWk1PBClDKBcBwLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698388205, "uuid": "5f28e91d-8ecc-4e5d-908f-b9148f3ad6d9", "value": 1646592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698388205, "uuid": "01eaa8e2-15d6-4cb0-b19a-b091d05ef9cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388205, "uuid": "faa0f3fd-d888-4ab8-a5d9-385d3679bafb", "value": "c9aa05e75a369370955cf71b12a2121a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7216cb-745e-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698365858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698365858, "uuid": "dcb63dfd-17e7-4af5-90de-e190ae7dbaeb", "comment": "Malware payload (RedLineStealer)", "value": "8b154cff5580530de0333b0f8102fe3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698365858, "uuid": "6b1e5795-3484-47fc-97cd-c21d5c7b1d5e", "comment": "Malware payload (RedLineStealer)", "value": "3c857b118462e3ccbbf499c7066d4a2aa93c5f5a19225807e70568735de2f821", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698365858, "uuid": "b5952384-fbbd-45d0-a10c-85b33e38878a", "comment": "Malware payload (RedLineStealer)", "value": "adb8ec64299a688f9186a988c257a5f4bc01f6ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698365858, "uuid": "f36a4225-035f-4c17-b3b8-1de9b158e5de", "comment": "Malware payload (RedLineStealer)", "value": "7d9912f3d3440af8faf1c31932b3b75ba8ee4359e109886d16569fe1d2a50c86f6c332e00878258dffbc7b6c84b3334a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698365858, "uuid": "f240f48b-64fc-463b-b3a6-342104179562", "value": "T18324E776F304955CE87E533DB01C38B09E707C62E16ED32E45E67AED683BB498A244D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698365858, "uuid": "e2cb88d6-bcf2-408a-8a4a-0b644f821bd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698365858, "uuid": "48ab7fce-2c42-4c3b-9ce9-8f9cea605a96", "value": "6144:EmSQQNgcPf2iHv0+9JR/xadbzBNFygk5:DHQNgcPf1JROBNFygk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698365858, "uuid": "5f8be046-1ba1-4b1b-8f50-5875faa43495", "value": 226994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698365858, "uuid": "b8cc947d-3be2-47ee-825b-4d09a667aa05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698365858, "uuid": "38806815-eba0-43d3-9ef6-79d5a5951bc2", "value": "mobocrat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021dc4b4-74da-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698419018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419018, "uuid": "6a244051-e69f-4173-b264-d2c1c2014f0b", "comment": "Malware payload", "value": "8fcf348a66f4efbddc25d2db5e8fe969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419018, "uuid": "6fff802f-d2ab-4742-be3e-204b518cee16", "comment": "Malware payload", "value": "3cdded700e892c944ea699e3fbdf377dc4bb6ce48dc423c025e348297dd3a9a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419018, "uuid": "cc924245-3e29-4a10-bcc8-987fff0a84fc", "comment": "Malware payload", "value": "64b448c1b441cbbf36d6044bd93afae62dca96b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419018, "uuid": "b3a675d4-1c56-48ef-8e3e-f7c549714c41", "comment": "Malware payload", "value": "02f9e540b0aed5b52fd9343fb0f8c6034eaa8d24a87950b64fae7e6982ca890cc7303da98a3c85a81abdcedc615f5eb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419018, "uuid": "b87648ff-10bd-4b07-b56a-9b2b9a90aa40", "value": "T1E2B46C0EEA8A7990D9B6833D6C76C8644B36BDAEBC35C75D00D039EB2F763851413A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419018, "uuid": "8ccb06c4-ae92-4bdd-b8e6-d04fa4743575", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419018, "uuid": "7d7ac080-bd37-41ae-af47-fe514c28f1d0", "value": "6144:3zsge7LVAZBI/ver9qAaSg4JJKYpxzLzpggzbL:3zsge7L9WrIQg4JJKYpFL1ggzbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698419018, "uuid": "5e4128a5-08e3-446b-b6b1-a34c071a7f8b", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698419018, "uuid": "f865f10f-4182-4dd5-9ba6-5434522dba4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419018, "uuid": "c3744edb-1077-4e07-98f6-694a4f4cf28d", "value": "Purchase Order #002504_2023.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290be57a-74f0-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698428532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698428532, "uuid": "bba622b7-0447-4615-ab2e-adfb852f5eab", "comment": "Malware payload (RedLineStealer)", "value": "e9d03a7a9b0f7e7b11a8b0ef4e50a348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698428532, "uuid": "798b9683-53da-4dcf-9caf-dec915e36e41", "comment": "Malware payload (RedLineStealer)", "value": "3d11fa4f03c6b95f20f4c5b5c185b1d458897679b7087d7ecc2848867843dbab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698428532, "uuid": "06046df2-f33d-40ad-bf6f-44ad7903aea6", "comment": "Malware payload (RedLineStealer)", "value": "0a69d070224187be470374c44b00d9b61d67ca48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698428532, "uuid": "2b4c170c-b94d-42e5-a7bb-11b0d7d68c68", "comment": "Malware payload (RedLineStealer)", "value": "46bd976e90aaa60342e78db175c5e2a952256bc19b1ccbbc6d2b7ac806f2dfc971e39f5905324efe0c0f934179ea55bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698428532, "uuid": "6bc9e879-797c-47bb-a3fc-4048dbec4269", "value": "T105F6336A3AED0EA3C521AF3D553B8D3351DA7553C455C21B8240F2C42E96FEA16C3CBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698428532, "uuid": "74894748-8def-4d0b-90fc-9bfbc87a8baa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698428532, "uuid": "ae0e240c-1695-4146-9fb5-05a4a5657865", "value": "196608:uKay1/3lYLH1y0IV0zeYscPxIeQwwC4kLQmODPz0yrX7FR3XQ6wMZ/ajonEPum2E:uK3/1YJy0IHYFwRYA93Hg67ajoyuzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698428532, "uuid": "ea820c3c-fee3-4fc0-9246-6b3d60940d05", "value": 16388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698428532, "uuid": "26311d64-7215-4e43-bf46-b66f9d0db357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698428532, "uuid": "98b9adf5-d24c-480d-a369-7d1102fae281", "value": "About-reservation.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ce923f-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421876, "uuid": "b2f097be-1475-415f-8d1b-7a63720e7e4c", "comment": "Malware payload", "value": "b8d5a6d725c0257329b0a8555f942c87", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421876, "uuid": "55be74b7-22eb-4596-a0eb-e08897b0f9d3", "comment": "Malware payload", "value": "3de6e0b3b5567ae350cc5f78c17b8b6dca9ce4d90d545be327dfe0be8262c6f2", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421876, "uuid": "f464ee3b-7e36-4a60-8d25-2561a2eb13f7", "comment": "Malware payload", "value": "8d6716a99cef07031d69c2bdafcc2ed567b8b362", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421876, "uuid": "4b0e895f-21b0-4bc4-80e9-2f0ba304d89a", "comment": "Malware payload", "value": "660472af2583eda382d9a6cc7c7683ba9327da0ae5b6579f9d16534909d235b5faed25e01d3b21a604d7ed349ddcfb4a", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421876, "uuid": "58ee820e-fa74-48a2-be22-3689a6db3444", "value": "T11F723A2EBF97177CC856917482F38779F6B8F02012524B6F86F4E33A5E68B54933A508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421876, "uuid": "056c79d9-cabd-4bbd-98ce-476ff938dcc3", "value": "8b7d6f218f07082b5df448bc58285040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421876, "uuid": "8f79a016-1662-4c60-9986-952d41809a4c", "value": "192:93uNpN9GDhbuI5lfWqV1vSMteJOvy7JJ+3VZhHPU4Xixgv4e/0Hj6vzho7oYr7Ah:BWT9whflfxV1v10JO4+Z0uvzhuFr7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421876, "uuid": "8348425c-f7ed-4bec-9cf9-7d477508d4f0", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421876, "uuid": "7f04504e-8435-4794-b260-b5f3c21e8f9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421876, "uuid": "53963063-5bb4-47e5-a488-56f5b15f9b44", "value": "Billing_Statement_NOV-23_WN.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a64a09e-745d-11ee-8907-42010a9c0042", "comment": "Malware payload (Neconyd)", "timestamp": 1698365479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698365479, "uuid": "ddb92036-5f28-4239-a3db-631c819de15b", "comment": "Malware payload (Neconyd)", "value": "564451e54fa0196acd2fd7f771e5ed1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neconyd", "colour": "#FC7553", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698365479, "uuid": "606442c8-acc8-4f0c-9853-0ed578ca46e2", "comment": "Malware payload (Neconyd)", "value": "3e4a9ecdc59ebcf0941aa0c37a6704ddfe15eadcc3f16d1023132445736df30f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neconyd", "colour": "#FC7553", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698365479, "uuid": "eedd347d-0392-45b1-bdf9-831d3392de5a", "comment": "Malware payload (Neconyd)", "value": "fd0a26fea635276bc7b54d572f2dbeb7bfd2e1fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neconyd", "colour": "#FC7553", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698365479, "uuid": "785d430d-8cbb-467e-aac7-f9e43b14554b", "comment": "Malware payload (Neconyd)", "value": "bfd11a60252a266db659f0cf433351f54f532339f48fc763a7bab83eb3e8f8ec469e03fc4034faf630f281c048c572f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neconyd", "colour": "#FC7553", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698365479, "uuid": "2f96d83e-2410-4f81-bb26-5a9794a7e707", "value": "T1B4838D97B7E6C076E2930AB0267D9591DAFEBD7412E1C2CBC7001C477EA4292C635B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698365479, "uuid": "e745a773-7895-4baf-ab66-cd4b035bceaf", "value": "08b67a9663d3a8c9505f3b2561bbdd1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698365479, "uuid": "5a756d2d-d841-40f1-b6c2-b4c2dca6004e", "value": "1536:Kd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:KdseIOMEZEyFjEOFqTiQm5l/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698365479, "uuid": "1c171cd7-4448-44cf-80ba-7841692f595d", "value": 83656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698365479, "uuid": "48a50d12-7cec-4694-975a-a1510c6d5c51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698365479, "uuid": "a6f5d23b-6696-4f69-acbc-bc203e296089", "value": "h.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54bf9bfc-74a7-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698397252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698397252, "uuid": "330da125-8c29-408f-9231-6da5b8a03994", "comment": "Malware payload (IRATA)", "value": "a82b6d8232bf63fd0a4f63aaeb015156", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698397252, "uuid": "6664d1bd-951b-47dc-92d8-e4d9ceeaee19", "comment": "Malware payload (IRATA)", "value": "4038bbaace897645075346175a0541a7707505f8da4beb8adcbbe29018d5d180", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698397252, "uuid": "ba383ad1-c607-468c-8735-0fb8cae7825f", "comment": "Malware payload (IRATA)", "value": "b99fcb1cb06f79fc0e46b94978e82da017be7d42", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698397252, "uuid": "6f5c1b5f-90b9-4cf1-8617-353a19b8bd69", "comment": "Malware payload (IRATA)", "value": "65243eed78031c8abe4feda196860c0e1b5aa6509d51ece1ca9fceb7916db984ed60bd485540507909145d2c3cedcf06", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698397252, "uuid": "a8a3d815-66d2-4698-a59d-1130503b703d", "value": "T103851203F2BAEC57C931C03224551B3665174D28CA43FB463A9437BA64FBDE84BC66E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698397252, "uuid": "e4661b8f-c3a2-402d-8e15-89488b0d4781", "value": "49152:psFkk6EXLTbImyllQXu7r2PCmEjhAibaFrNcUAe/+0tJXfP:AkkBXnE9eeG6m6hVAl+0t5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698397252, "uuid": "4e34c790-d90a-4b7b-aba4-8bac4cb71cce", "value": 1776632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698397252, "uuid": "dda67571-d6c7-4aac-b94c-2254594407d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698397252, "uuid": "2e448525-fd47-4760-8121-ba4ecc40e269", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08789a8e-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698422035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422035, "uuid": "c0f04e9c-944c-4b8e-b90f-f0cad97163bb", "comment": "Malware payload", "value": "2b00496945f31c351de2050169859bca", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422035, "uuid": "745d30d3-e694-430d-8daa-373dd4ed83eb", "comment": "Malware payload", "value": "42f235057d09c54032b617129c24a6aa3f4595e4ccc619028ba3754744e18881", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422035, "uuid": "920cd853-a45a-4063-96bf-3ced85a82e01", "comment": "Malware payload", "value": "d486e9bdb2695544b8606e0982940f7df8629054", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422035, "uuid": "0060003d-02d8-49b9-893c-be1ae90ebbd6", "comment": "Malware payload", "value": "40a9a22b024b64b372f17ebed2686780e49470862e3e92ec1379797162a50c60ba39e00503ff7132ae004b93c7af58b1", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422035, "uuid": "3d8408ed-80f5-4ca1-8de1-5aa25b6e713a", "value": "T1DE724A2EBF9B477CCD55A131C2E78B35F6F9F02022114B6E86F4C3355E66B24A72A508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422035, "uuid": "0e44bb7e-1157-4742-8a9c-cd47917eaa37", "value": "8b7d6f218f07082b5df448bc58285040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422035, "uuid": "ec1cca42-056a-4aa0-bc5e-6ba4d11ef5cf", "value": "192:fX+t/9mrGCsEU2aZc7KYJsY+JOLG7JJ+3VZhHPU4Xixgv4e/0HpCcqWnho7oYr7C:fW/9UGCsE8cGYqpJOw+Z0J8WnhuFr7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422035, "uuid": "ea279d93-f6fc-41b2-9c86-d1c30e08399b", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422035, "uuid": "c31bed8a-af3c-461d-8fcf-ec6d59aa6290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422035, "uuid": "e2363d95-4959-4fb9-aec9-46934aec4c3e", "value": "Billing_Statement_NOV-23_SV.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b042fa26-74d9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698418880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418880, "uuid": "c0ad09b5-b674-4254-b384-04094b6e1186", "comment": "Malware payload (AgentTesla)", "value": "02380ff895162a0165ab65a211b34166", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418880, "uuid": "5a9f8b91-c1b5-47d8-92ff-1190da29ef54", "comment": "Malware payload (AgentTesla)", "value": "438dc185d3a5d4d9a2ae604e2df262a3528a4f79cf1b3c45295b738523313364", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418880, "uuid": "4e98669f-303c-4d75-bfe0-da5b82b58699", "comment": "Malware payload (AgentTesla)", "value": "4718e8c5da434997b99f55f3570bd3d123b91a8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418880, "uuid": "9098d556-3895-4a74-a297-addc0da7deae", "comment": "Malware payload (AgentTesla)", "value": "8c2df3947f627c7dde11df9982ae7a6a12e7ca276808c205a6216753ee0ab0669f8c268e20b7be1089a60a103b70e3e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418880, "uuid": "df1a946a-fd67-43c2-9d87-ffc94c5cd364", "value": "T17845DF03D800DB83D51D83F8BE434DE90F1AAF18E98969DB10577F8F3A31A625D9A51E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418880, "uuid": "6a514797-6c2d-4e0e-b986-9829be3e954b", "value": "24576:XxBXZyww6/ulh4ZyLw6/BUFDNDUqJ33lQUTwBpuIyJ0SL6UdUsDF:de6/vd6/O/4Y33lbTQ+qS27o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698418880, "uuid": "02470a81-8681-4c88-840e-3ff0d75452ff", "value": 1186816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698418880, "uuid": "4dc68407-bb1f-4e94-a7a1-11b7fb474ebc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418880, "uuid": "03325533-59d0-40ca-9796-91f63c427be7", "value": "23101 inquiry.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a472be-74b1-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698401792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698401792, "uuid": "59135b7f-1928-40ef-b9c2-f09779361198", "comment": "Malware payload (IRATA)", "value": "1139cad3df5bc33ebf77fa859da9a10c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698401792, "uuid": "d36eedef-23a3-4a4b-974d-74cbf35c030b", "comment": "Malware payload (IRATA)", "value": "46881156c2ec17a061e1c0b7b006495ab4e32e09d6ad2d107b925104839e4958", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698401792, "uuid": "5cf69165-0ead-4b0e-bb6b-0ceee38782a9", "comment": "Malware payload (IRATA)", "value": "2e606019d77dde46ae5842e29b8d2a87edbfab0c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698401792, "uuid": "fc4d2085-1714-43ef-9fd1-063eda60f7f9", "comment": "Malware payload (IRATA)", "value": "ca11e264c90ef335de8931e87e2946871be3954a1f072df66e5f2fa12df4277a67171b9f04a67cafefa43a7013512687", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698401792, "uuid": "bff2461e-645d-403d-b293-d4f5df150d39", "value": "T18736CFD7F399686BC4F39332817613A5428B4C268F83AF836D14767C28BB5D41E59BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698401792, "uuid": "8deb7b42-318c-4d5d-9d74-a52a199b7f4f", "value": "98304:iPFZd0r+OmNECeuEgLCrgnIa0a4+MNec3QqG:iPrbE83Ia14+Yec3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698401792, "uuid": "369f922c-a48d-43d8-96f2-d1451ece5264", "value": 4918329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698401792, "uuid": "b5b5196b-d0d7-4efa-ae12-181d975118a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698401792, "uuid": "18a3f500-8c57-4352-a9da-6791139826d9", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbccb537-74db-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698419759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419759, "uuid": "88cce883-2a62-4d8a-8b00-5cf492ead665", "comment": "Malware payload (Amadey)", "value": "1c27631e70908879e1a5a8f3686e0d46", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419759, "uuid": "30b45aea-2b35-4cc6-8537-f4cb2793040e", "comment": "Malware payload (Amadey)", "value": "478aa272d465eaa49c2f12fc141af2c0581f569ccf67f628747d90cc03a1e6a9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419759, "uuid": "16a7e204-acf7-4d35-a180-8ecbeb818239", "comment": "Malware payload (Amadey)", "value": "31da82b122b08bb2b1e6d0c904993d6d599dc93a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419759, "uuid": "3c59804e-1da2-4fb0-a7c4-136ec069017d", "comment": "Malware payload (Amadey)", "value": "73510e407d260ec02d1134ca803b74fe6fbdc65f0fe5024adbd737f381affddceac53a5cda788055b953a0acaaea8a28", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419759, "uuid": "ee7d383f-10ad-4b6c-a0e7-5571fa1ca639", "value": "T101457C1BA26501BCD4BBA1789A235A47E775700603309BEB17D05AAA3F53FF16E7E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419759, "uuid": "e64e6a1d-0c01-4e91-8ab2-e3259d0ecc35", "value": "0633f68a2d02b7a4575eabf00b4ef4e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419759, "uuid": "d34d3eb4-e27c-432c-b49a-c08e80e0050b", "value": "24576:OGKcuUK9Jyi+Uj+TGHWTZNyMuB/J/TO/pYmea+Xo45qG:o9Jyi+UjyGGZNyMur/TO/qb4Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698419759, "uuid": "f75d48b8-74fc-470f-b276-8396960473fe", "value": 1186816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698419759, "uuid": "18a0df7c-7ea3-46d7-a895-1b7b2d28c256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419759, "uuid": "abd436e2-8156-42f5-92b8-2ed3a137fc4f", "value": "1c27631e70908879e1a5a8f3686e0d46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a3fd6d-74a6-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698396881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396881, "uuid": "acc7eee5-388c-4c9a-a572-bcd93a1f612f", "comment": "Malware payload (IRATA)", "value": "3f88d0fa3465b7962a5b51798c081ae8", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396881, "uuid": "fa07078c-bdbb-4595-a363-bb63e5acd0d7", "comment": "Malware payload (IRATA)", "value": "4797af075d442ae73d6547056bb35480f177cbd3ba11697ea086d519b008581e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396881, "uuid": "b9bd248e-55d0-476e-b966-38d4e028cea5", "comment": "Malware payload (IRATA)", "value": "de5b58629bf02fa589bcec8eb4400e9477c70e3d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396881, "uuid": "10cb6d27-db97-4a11-8ce9-37202366b697", "comment": "Malware payload (IRATA)", "value": "f99230efdbf8cc8827644dc78726975870cb2026847eaeb7f237cc44e8ac8158b31600a44f2579c743b82d4bd4b9e643", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698396881, "uuid": "dfa33bc8-27c4-4b7d-8c0f-fb8bc16eaa4c", "value": "T1FE06BF97F399A86BC4F35372817623A5424B4C228F839BC76D14767C68BB5C42F49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698396881, "uuid": "ebecd0c2-50ea-433c-a7ba-83a6f281e766", "value": "49152:pdOTvGyBjxnF4VhE2qOgLCr8DqNgagSxBzIh0rTwIpqaDvQBJ3tRkOz:pdOTv5Bjn2gLCr8DSgSxmhcwIAevOyOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698396881, "uuid": "76d119f5-e5eb-4399-949e-fefbeb4a3fe5", "value": 3766308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698396881, "uuid": "cb78827b-cfcd-4be3-8c16-d37fed45895b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698396881, "uuid": "e17fb9dc-8c07-46e5-8cf8-2ff31820c645", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5609d9-7496-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698389960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698389960, "uuid": "215c2e3e-e3e4-42be-8d8a-bb2b95621b8e", "comment": "Malware payload (AgentTesla)", "value": "1bc86053885328398945892d2f27eb51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698389960, "uuid": "c9d5b258-7e95-4a52-b7ce-4f0c6ee5f3ad", "comment": "Malware payload (AgentTesla)", "value": "488472edb9df3704eeff1b01d84825c8ed20d106792794e360d9dc05cce840a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698389960, "uuid": "9473fd52-16c6-43a8-a84e-e22a16bea136", "comment": "Malware payload (AgentTesla)", "value": "5a6b8350cb4b1573e4c4959be0b730b2f4cec661", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698389960, "uuid": "e13cfdf7-8c0d-48cf-b00f-669cbcd971fc", "comment": "Malware payload (AgentTesla)", "value": "f02bb846aa503a83fab283e2dd39ba399ac5d3ee474b78141eaa1865d1f51cab4b55676c7db98bdea29d0052bcfe4a2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698389960, "uuid": "d809f1dc-717d-48f2-b9e5-2058c9126329", "value": "T137855A497E39DA13CD00C23090D2CAF2664BDD5A96D292231AECBDB736723BC574B2D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698389960, "uuid": "d0e28614-4cd2-4d77-b90c-9dfd3cd0854b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698389960, "uuid": "00d39213-815c-4913-b45a-67661534c9ae", "value": "24576:fczhH0U/JcTriMT0rBigkuJA6W0d6FSV:uH0UJcrDT0rBigkgA6W0d6Fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698389960, "uuid": "6f0d613b-7f0e-48ea-bce8-21f3b0e8a80c", "value": 1709056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698389960, "uuid": "e08396ad-e405-4105-ad7f-9b9976aa84bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698389960, "uuid": "4fc0ffe7-5d82-4e13-bac7-da1e58afc071", "value": "QUOTATION_OCTQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdcea12-74f5-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698430872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698430872, "uuid": "9f75329c-8ed8-4cd0-8da5-b3a058afc702", "comment": "Malware payload (IRATA)", "value": "63033e207e707f564ad4946251eec00c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698430872, "uuid": "82c917a1-af80-4998-a2ad-a215947e35f4", "comment": "Malware payload (IRATA)", "value": "4b434e2e9a688ca3ae15445be3f215a37cd42f5019a17a0d366de366dd048d04", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698430872, "uuid": "87841692-07a8-49a6-9c82-850f394a60bc", "comment": "Malware payload (IRATA)", "value": "106daacfcc999cbc3164c5fe92fa0185d2a6cba9", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698430872, "uuid": "bc1bcdb4-254a-49f6-bdf7-37cfa5ea7cb6", "comment": "Malware payload (IRATA)", "value": "f974a033422e46666d40e3001edafd1393f6e81d4cea38ebe5e4ab3a181acd1fd913b72b967aecf7c4c16fa563540ca1", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698430872, "uuid": "c7d3b5ed-77dd-4d7e-b111-2cfdae4eb6c2", "value": "T1AA851247F26AA957C8F1C33224751635213A5E25C787B646390C33FA6BBBDE80BC46E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698430872, "uuid": "fbcdf19f-23a1-4dec-9b26-0a620554aa59", "value": "49152:VsmjkknGX7t+oiCVA9bDosV5UBg5uei4kcCYYgA:PjkkGXx1isA9foO559isC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698430872, "uuid": "8e3d7d09-2055-4586-b0b4-54a40642b982", "value": 1862870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698430872, "uuid": "62aca5e0-81c9-4fce-bf2f-5cb729217921", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698430872, "uuid": "69f3806d-0aeb-4076-b8a8-af2c6c0d40d4", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edb2282-74a1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698394665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698394665, "uuid": "51aa2425-8b80-4f0b-a8e9-1d7122dae3c2", "comment": "Malware payload", "value": "38bda2b9ec5bdcb8a057dfd0a856644a", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698394665, "uuid": "c74aeee0-e6df-403c-97ce-ff560a06e5f2", "comment": "Malware payload", "value": "4bef5bc5f786e0c655379c35ba1143c45e727d20493851abad98b06263f47ff6", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698394665, "uuid": "0f7d047d-7715-46e2-a5e4-d457d64962d9", "comment": "Malware payload", "value": "057686f978bfbe7a7f78c3dadd9c9da11224a094", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698394665, "uuid": "ae61da88-64d2-42bc-8916-edb090fcea13", "comment": "Malware payload", "value": "e308aa96ddc0deba48c40fa349bf84b0d6b466a221220b7cc4eaf7d41d54f3388ca80d180a96f47d8ba925ff1eb6b049", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698394665, "uuid": "b8d471be-0fda-48ff-9411-e25d0274f63d", "value": "T187B49B0C6EF5806E8EF4E658A335D8988035D2E4D784B31FE0276DB191A1BD7BADB4C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698394665, "uuid": "520f06f3-9d6f-46e6-bfc6-0303edb8b88a", "value": "12288:MmPIlXbYrd72REfJtYlX2WmBje8I1oYt8sjvKg:iSrx2RExtYwFBL+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698394665, "uuid": "0311e808-011c-49fc-a02f-21e4084c136f", "value": 510073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698394665, "uuid": "72be3780-84f5-41bb-aa1f-b6b2f23950a7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698394665, "uuid": "c0e92eac-1d3c-4f48-bb79-0e3ff58f5072", "value": "1.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa29bdbd-7498-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698391087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391087, "uuid": "678a44d7-a7fe-4b8c-afb8-b507c9176253", "comment": "Malware payload (IRATA)", "value": "2b3e1cd7f13c5fed57acc2206a708cf7", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391087, "uuid": "141e0776-169e-47cd-9df0-a8cca705437e", "comment": "Malware payload (IRATA)", "value": "4bfd0659768a7ea2d8b3d0647f05475c97b57ef9690f0773b866e2a00e4a52fa", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391087, "uuid": "a3c95bb4-76b0-4d8e-bc1b-199c642f08d4", "comment": "Malware payload (IRATA)", "value": "e5b4e5ece51d00d38e937242ffa6df3ae7837278", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391087, "uuid": "4745c12f-7e92-41ae-9401-5cf611b784d1", "comment": "Malware payload (IRATA)", "value": "891cc882131a77cdc37ecfd68541bcbe86bcc197513ebc0f6a4a435786ed82c9f56091a7c80fbb8c1ff8a67da5acf1f5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391087, "uuid": "dbbf11f9-a89f-427c-9d3f-93ca0fcfb583", "value": "T126D52263F369A857CCB6D37212A8263514774D249B03E689790877FE78BBEE847C42D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391087, "uuid": "f4568b2e-6c8e-47e7-b6e1-96b896b7e1e5", "value": "49152:F/6EtLbSko00h/YOG4WFvHe6D9TA75tPrroT+NJkao0gYq173YVrgRvIT:d66bSkj0hQ74WRZ9TA75prrY+TgYcTY3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698391087, "uuid": "c3d603f8-7558-4109-ac41-f28333fde3a2", "value": 2834562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698391087, "uuid": "67d303c6-43ec-4ab7-95af-0e7e3be86b48", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391087, "uuid": "5d28a3b6-3748-474f-95cb-a43ae349eae5", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139f53f3-7521-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698449541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449541, "uuid": "ba974334-ff35-4477-9075-f6ae8fa358c9", "comment": "Malware payload (Mirai)", "value": "f1ec4033146b446253c1358439d6aca6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449541, "uuid": "6a3ebfa7-a430-43f0-86f4-4a2b940079fb", "comment": "Malware payload (Mirai)", "value": "4c2e47206bd30658da9fbd607ad0d7433732d48193692b8e0ebae54dcdd7ce58", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449541, "uuid": "ff39be51-5345-422a-99b0-265dfa581288", "comment": "Malware payload (Mirai)", "value": "7f86a05a2355e453d127eaa30ea664a0071d324e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449541, "uuid": "fc8e6dab-2d39-4b3d-9822-731b9e3a47bb", "comment": "Malware payload (Mirai)", "value": "ac2620acd8729348b6fabb86eff213227e719bfcf0e38a32ca32c133bdff9d69f87a286899f7dd1529b70905682ac22a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449541, "uuid": "6f83dad5-6d77-470a-8ff7-a8f9eb6a2b73", "value": "T1C6C32B46E6818B13C4D61775B6EF42453323A79593DB73069928AFF43F827AF0E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449541, "uuid": "4c2f39cf-de50-4c3a-a0e9-e7bf618e727d", "value": "3072:5QK3qOAWqKUUoev+YPaOS6c9s+EuNM/9oE:5QK3NjUUoevbCOMe+E4M/9oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698449541, "uuid": "533c9973-29a1-486c-8cbd-e356983f6bc1", "value": 120446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698449541, "uuid": "cfc10d8f-a0b7-4bd4-87f6-91d9f76f8eec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449541, "uuid": "71091c82-7abb-4603-910d-63e2562c6109", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4f2162-7461-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698367118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367118, "uuid": "51de43b6-c6cf-4353-b669-553b36b9e581", "comment": "Malware payload", "value": "5a7e488dc00934ac0826a5f442c07955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367118, "uuid": "c0460c5c-de7e-4580-a22b-cf4a9c35e35a", "comment": "Malware payload", "value": "4c71373aba2ce4be9c8e896b33ccb24cc781ad91f712d097e87267df4ff4145e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367118, "uuid": "87bdfc4a-846a-4670-90c1-c4f95523ea57", "comment": "Malware payload", "value": "b9e35541d53461b2d1337b673f42c1a37183380f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367118, "uuid": "ff85d55a-1a1a-4af1-8c0a-0b86959a48fc", "comment": "Malware payload", "value": "e87d5dac128483849b7a274079fd8278aff0de7e864a2d0c20df9670c4cd368fadcb3e26ad34d21b6735c847b7f5b8da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367118, "uuid": "f5c305d6-fe72-4a54-ae19-b6971cb019f2", "value": "T17FF48E827BC740C6E6A77AF115B7E323E735B57A732E69CBDB902C231660440AD60376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367118, "uuid": "8d297682-576c-4ef3-91a8-eaf1e9fcac74", "value": "6144:Vhu/KkiKMAf17yLj8YK7frpEgrJUN/7CXL0gXh6tBisbwhY1UTwT83MX8OZHm7Pz:fKPMAf17yLjpMoFC/wBlbzSo8k1G7rv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698367118, "uuid": "1b519b2c-fc99-4f80-bb08-6bb775dc20b9", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698367118, "uuid": "4f2dfa96-eac4-4d23-a575-a399dcc4dbae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367118, "uuid": "db97ee4b-7ba5-4a0a-91d7-93fcd4d9b54c", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.22560.1404", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957a40af-7499-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698391348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391348, "uuid": "cb445956-55e2-483b-9213-bfd5d6646add", "comment": "Malware payload (Mirai)", "value": "43fbff42a810f2e219b373bfa5c21386", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391348, "uuid": "cf4744b4-9876-452f-87f4-1b0b6ae4fb45", "comment": "Malware payload (Mirai)", "value": "4c776571e3b5cedc5bba923cfdf0ef084979e2983fd9141512fa8cda06d58061", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391348, "uuid": "fb295e54-a3a9-464d-8d5f-7c8023f00471", "comment": "Malware payload (Mirai)", "value": "f9e083d2ef39ee2c5165f6c400a581c7afaf493f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391348, "uuid": "ba070ef8-e4c4-424c-91f9-ef2dace91681", "comment": "Malware payload (Mirai)", "value": "f94dd8435a9c13dbfa7fe546ce0a91f4231095b77bf400118e170535a4d6f710011a7c3fe71657cb6d1c6d44b83001c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391348, "uuid": "de99a1c1-d546-4a27-bb48-ba8c7acc557e", "value": "T14EA37EE9B8215E7DFD47DAFA81264F08B82162044FA20F27F626FC973D720A5DE06845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391348, "uuid": "8b80837a-c020-441b-8a4c-008763395a2a", "value": "1536:5CC3AKSAqhe9wFrsfn/+SkXPdhzcI0VbkXLUKvrtCsKBfqnTN8E3EuWGln:51qheSrsfn/sf3zsVEUMZqqTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698391348, "uuid": "082c8075-4bb7-4341-a2e2-8191185b10ac", "value": 101828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698391348, "uuid": "71f424b8-db84-4112-abcc-1a11cb3ad030", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391348, "uuid": "ebc411f0-7f52-4264-b0cd-8a44a07e7e70", "value": "43fbff42a810f2e219b373bfa5c21386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22688d21-74df-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1698421219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421219, "uuid": "f316e78e-a11d-4dd6-82f4-6bb4556fb870", "comment": "Malware payload (LummaStealer)", "value": "739e72262827148e11779a1ede4a9a9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421219, "uuid": "8ef97e05-9e60-4395-910f-87928e1405fd", "comment": "Malware payload (LummaStealer)", "value": "4dd930a47a2dfa1a61044726ed8e966fc5483f01c1b389d211b845ff6532d022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421219, "uuid": "28104895-0b0d-4e9b-a5bf-7a8d79797302", "comment": "Malware payload (LummaStealer)", "value": "226503aea36a63a0ff51a3072f0bdb0943487f6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421219, "uuid": "dc82c249-96ac-4725-9b08-db6fe109c25b", "comment": "Malware payload (LummaStealer)", "value": "79f8e7f9b2d51fa5959a2e3e5af0b546c42e602bdeb590fcc47101cf8f428d02a99713650743ac613a3fb02fa8e2d3d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421219, "uuid": "50af5d60-5c83-41f6-9d7a-65b3cddbe98a", "value": "T11236AD16BAA5CD12C01D2A37C5E6101443F7E5C77322F70B7ADA23691D933EE1D8E98A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421219, "uuid": "3042c754-5ae7-4416-85b7-760c623faaec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421219, "uuid": "58f035ec-1d33-4cbc-b0de-79209bb8b9f1", "value": "98304:VfpTG+4seZoxw7SB8DbhYpzapDuoKhixLLrq6A9XC5FgQ:hY+4seZoxw7SyduRoKhixLLrqz9XO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421219, "uuid": "30eee167-63b2-4148-b69c-ba7b1d4c2f13", "value": 5084600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421219, "uuid": "43d163e8-274f-49dd-aa5b-d7bd74588f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421219, "uuid": "92b4a94e-a129-4be3-8ba8-a788a0c07dfd", "value": "739E72262827148E11779A1EDE4A9A9A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fac2fa-74ce-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698413954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413954, "uuid": "31fe1f92-ee88-4c6b-9fca-0a103c475428", "comment": "Malware payload (Mirai)", "value": "f2f1036270a4259029112d03dfe3cf22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413954, "uuid": "2debeb28-8086-44da-83a1-8f36d8cbccb0", "comment": "Malware payload (Mirai)", "value": "4e00101032a554eb2ba40903efca44f4f382239e069e4ade5a710f94676804a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413954, "uuid": "178c56ad-571b-471a-b0d7-6722700c3d42", "comment": "Malware payload (Mirai)", "value": "580b196416091de081efb0a3cfaefd54abf0bd2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413954, "uuid": "ddff1b8d-6842-44d0-b122-e022839f70d6", "comment": "Malware payload (Mirai)", "value": "c44405816a1ddc6593c47b4277052816bddfe106868bb47ff648cab450f3a9c4b8d566b95865b49fd42f95aaffd2048c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413954, "uuid": "dbcebbfc-41b3-423c-8d98-6774409bf535", "value": "T13C539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413954, "uuid": "b27493d8-21f5-4b40-bac4-a00c4489d120", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698413954, "uuid": "98a33df9-450a-4831-89e9-ca114f6ca225", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698413954, "uuid": "4883d3f9-314c-4702-b466-0ead80e2c836", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413954, "uuid": "174f1115-8ff7-4472-9007-cc0668ce618b", "value": "f2f1036270a4259029112d03dfe3cf22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca22a34-74bd-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1698406822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406822, "uuid": "bbe89bce-a9d2-49e2-9c38-779ad3fdf2f2", "comment": "Malware payload (Pikabot)", "value": "42e2a684ec22b1d6d8625a592b6e184f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406822, "uuid": "5579e967-035b-4af1-bc3d-4453c5e64af3", "comment": "Malware payload (Pikabot)", "value": "4f72f711f565eaec5ff4925ccd516bc2439794d7c93701a77413aa10e36de535", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406822, "uuid": "fd5bee47-7472-4774-af3f-5c4e661e2162", "comment": "Malware payload (Pikabot)", "value": "a9544cd4233a7096fe4703eca69f50cde7d8b286", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406822, "uuid": "a7192f52-c3bb-42e4-8011-cc33d848e545", "comment": "Malware payload (Pikabot)", "value": "41e64c39bc13dfcaa3c192f076f805a8fb9f10d59b82e1522284867bbbb4857153a696838c9054613468717bbfa6b123", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406822, "uuid": "c4d10281-f857-4e5d-ad3f-f07a49710334", "value": "T162642B9D7164743805C5506D902F1A0BFE36252E286AC45CB36CE4FF9CBCE8931BABB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406822, "uuid": "0c5583f6-bed6-43e1-bd5d-59837ea3f2e6", "value": "6144:K9nS6CjUdQwFwvP6IoPapJQZSzt/pdwCP:K9nSjjUlAfdwCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698406822, "uuid": "26e44a51-87ac-4198-af15-9288e0fd61ea", "value": 334117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698406822, "uuid": "040b8ed1-4655-41bb-a045-36fea9612d8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406822, "uuid": "c489233a-d274-4b05-bd01-a64a262ee2eb", "value": "Quou.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20b77fe-7524-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698451149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451149, "uuid": "7e3213f8-cb41-4f57-a89c-f7d268a2ebe3", "comment": "Malware payload (Mirai)", "value": "969e43b56f9e8fdbcc3672025e10cb04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451149, "uuid": "e56d37f2-b07b-4b4a-9f19-82c4de7b7477", "comment": "Malware payload (Mirai)", "value": "4ff8446b75d1994398548885175711e1ae0fe3c18e7cc1c43dc0c0aecdb35ae0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451149, "uuid": "50ec8c6a-488f-4a8e-98aa-a3a13b15acee", "comment": "Malware payload (Mirai)", "value": "abad012d95964f38490e2a78dfb1084957f42fcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451149, "uuid": "61732f42-ec27-4743-a097-49c08d4e359a", "comment": "Malware payload (Mirai)", "value": "b5a7201494c1fe7bbcf1a847c013e1c6a95642b200b99b45685f44d1d0f395b2df05238dfd1d4ca4e715cd66792f87ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698451149, "uuid": "eca061a8-e022-42a0-adaf-122af51271a3", "value": "T19E133C42721C0F17C4A35A70253F5BD087BEAAD032E4F285665F9BA68A75E371482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698451149, "uuid": "aeb9eb10-a5d0-4414-af24-672559513827", "value": "768:U40J4bzio9RfQRW0qRGQ8Jt8h/VsBKltn2susfzFuMldW41LFfwL:P0JOC+Qqh/FxjMMlddLGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698451149, "uuid": "7478cfab-4c86-477d-af19-c67ee7c3e363", "value": 43780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698451149, "uuid": "7b72f92b-8e7a-4823-b430-3c93e14fd12d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698451149, "uuid": "525ca6b8-921c-478c-82cd-b5aa0d79eefb", "value": "969e43b56f9e8fdbcc3672025e10cb04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31ae0b2-74a5-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698396605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396605, "uuid": "73cf6ea7-1c40-4455-a012-e776c032d530", "comment": "Malware payload (Mirai)", "value": "e3756be85618fa89ff03e937b2344626", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396605, "uuid": "e4a70364-ce1a-4dd7-9425-ff2f2c2ef96e", "comment": "Malware payload (Mirai)", "value": "524f7105e58c53e09c6ae11244b0346412cd5663f2db20206111d4430294bc6e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396605, "uuid": "316bd920-419d-4874-90c2-3a04ba5cd039", "comment": "Malware payload (Mirai)", "value": "5716ba85a52b172120ba045225556bfd4e5b6401", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396605, "uuid": "4a8d5039-d342-4e32-b247-26b15b532c84", "comment": "Malware payload (Mirai)", "value": "ab492341040d6e1f9590ac52a804cdb9e4e00b1aff327879eef568a8abdde260d311197f1e7c9ea6571c9a6f0166d651", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698396605, "uuid": "9a87f479-b029-4f9d-9e62-ed7fc65f02aa", "value": "T119B2F1D9E6FB27C3C291C336D07C5A4DE5B21AC00347450A1109B68EA29764E8BFB3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698396605, "uuid": "7e87cc3e-b525-4d7a-9569-cdca9eb90a04", "value": "384:MnDKKQOcRpmYLdn6RBOFRFt5rUFW10iSelCo3AnupPFNqnrrd1NEZgO8UXWozPLk:6/QOC0Yhn6ROHWFGrcwNVFCnNBxcZcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698396605, "uuid": "b2d2e422-d0cb-454c-840d-b04f35e7b1fb", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698396605, "uuid": "a8a8db1f-1604-4b5d-8a97-07e1a7a53924", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698396605, "uuid": "6244cf7c-09b6-4f49-b204-d70721d5197b", "value": "phantom.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4038bf6-74c4-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698409867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409867, "uuid": "8c4f8e79-fd79-40d7-a6f2-9645e8c17eca", "comment": "Malware payload (RedLineStealer)", "value": "94537e5e81a825f7cf78016f581e4c77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409867, "uuid": "92a29118-0f1a-467f-98f6-5f57a7457a34", "comment": "Malware payload (RedLineStealer)", "value": "52738b5b4d56612b271443309696f267054db60f974cd42cdf65d2355db20a2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409867, "uuid": "874a3d94-7170-4add-b858-7f6762569d53", "comment": "Malware payload (RedLineStealer)", "value": "8fb6b0ae7952c757497b842a86e8fcffd01e4c8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409867, "uuid": "fd9fb987-d35d-4c08-a9a6-cab444a0c3e5", "comment": "Malware payload (RedLineStealer)", "value": "9024b6a87d503230113be01fbffda31c9a01e8dcd070cc04ffe879451cb68c1d674fd47adf3414ec9c9525c471b7be04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409867, "uuid": "5b7c0da9-804d-4cf2-b8b6-29b7db695385", "value": "T11375239766D98173C9B21BF0A4F206D32E3FBE675C4E425F32806D5E08B21A46A30777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409867, "uuid": "2b468829-9185-4f5c-9de9-41417a532ac5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409867, "uuid": "5365bba2-f247-4a19-aeac-405e10b71f2c", "value": "24576:qyqwcGZbn5EkloGjGRn7sHeYRixpwXs+WxHFkFeSic9ls+Nlfi6Ixd1X3nX:xq45EkGmr+YRmuXsFxacul1Tfipn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698409867, "uuid": "7e71ab27-1da2-494d-a97a-adf115285065", "value": 1628672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698409867, "uuid": "692b9a03-3afc-4687-ba36-e55494f641a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409867, "uuid": "4c6a5992-3068-4678-8149-f28d613eacb6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972482df-74aa-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698398652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398652, "uuid": "7690d5e9-839f-4ee6-9295-d205f9366be5", "comment": "Malware payload (AgentTesla)", "value": "a52e3653b62165931ebcff4dd2ffd1be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398652, "uuid": "1c1735a4-5dbb-434f-8594-72c9985f43cc", "comment": "Malware payload (AgentTesla)", "value": "52a39c1e15de972c6bb0eff1d064f423be4e1144dc11f2d579778499415548dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398652, "uuid": "61a25a71-4453-4aa4-85eb-b04c1563e629", "comment": "Malware payload (AgentTesla)", "value": "b7c404e01d09dbc1f8872c17e4323359012895e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398652, "uuid": "617afe26-1863-4a28-bde6-d38c7659c9fb", "comment": "Malware payload (AgentTesla)", "value": "ce1cc773cb6c3cf554a6ebfabb2558baabbbc1dab8d02795c8ebe77edd0fd93c23a700e45dfb9fdc9463f7641f545f52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398652, "uuid": "ee1a4cf3-a376-43fe-be5e-567b637749a9", "value": "T1A4B2F807B68E0EB1C219877EC9AF81827370E5833757E91E7E8B135A1972F9DC4052CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398652, "uuid": "fb3cd3b6-edc2-490d-89d7-dd1f40ae988f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398652, "uuid": "af9ed31c-7af2-447e-a61d-d11305f32dee", "value": "384:ekgPOS1oIuTucdE21ajhhJW3TycCe06z3i0fhI8+twSZclpnx6B:ek/rIuTucda9zGG/Aydw4clpnW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698398652, "uuid": "949aafd5-91b7-4d9a-bf6a-ede465c949f2", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698398652, "uuid": "81f52811-7291-4f99-a1bd-137aa8ff9d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398652, "uuid": "da97a8bd-4c2f-403a-aafb-67d70b9dec96", "value": "Fiyat teklifi Istegi 23070 PER 1000 Adet \u2026scanneed 00101.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e78ccb-74e5-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698424150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698424150, "uuid": "7a190156-488b-488e-9d3b-060899479781", "comment": "Malware payload (RedLineStealer)", "value": "3bd2cee92fe4248353965b760c97d818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698424150, "uuid": "3c705d69-43b9-49ca-bd68-04dbb785ff7e", "comment": "Malware payload (RedLineStealer)", "value": "52bab54e2768497cb2eaaec017c3d4ac374859a592e66bdb9ff6c5ba6df0bd0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698424150, "uuid": "df2e6a3c-6485-43b6-aa31-f7970d74273c", "comment": "Malware payload (RedLineStealer)", "value": "38c686976e87d32e4e1b9ed4741c310832327738", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698424150, "uuid": "91daa54d-30e2-49b1-a670-616036bcff20", "comment": "Malware payload (RedLineStealer)", "value": "baf8928875a8c0fd9569eb9652977d976a5657b02a794574b469b831f37c36cda8969ce64eeb4a66822581a7dc6aed89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698424150, "uuid": "43f3e194-36dd-4fdf-acbf-198ece8d14b7", "value": "T183D4122076E0C173C8B7413045EA83BADA3670715725A5CBB6CC6BBA5F113E2A3752CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698424150, "uuid": "fb04a9f0-5800-4256-9dd2-96540bf93ce7", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698424150, "uuid": "d5ec6582-6036-4c6f-b579-75b1f7cb4f0d", "value": "12288:6h1Lk70TnvjcHyCxd/YsPcQeg7VnficlLR2xKWN/+enPH4b1GIE3uERfzTn/jZ/A:+k70TrcSEd/YsEUZficxRW//voC+4XZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698424150, "uuid": "0405a373-573c-4759-8a5f-177c3e8a82cc", "value": 618896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698424150, "uuid": "35e56ad5-5bb3-4748-a15d-ae915d98536b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698424150, "uuid": "be0d508a-8fdf-4aa1-ad16-0a447248965f", "value": "Orden de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9850b328-745f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698366442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698366442, "uuid": "8b59ab6e-b543-4142-be85-494054f38c5a", "comment": "Malware payload (RedLineStealer)", "value": "751b48d719e1fca2bda5f16480e8bc85", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698366442, "uuid": "93f30af4-ec63-4818-a175-24bdd4d46278", "comment": "Malware payload (RedLineStealer)", "value": "5304b4f24c9283fab4e768233a26e2cb6a40cedabbcdb711588feee0361692bf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698366442, "uuid": "1810ea05-c59c-4c27-b143-2f8ae19169fb", "comment": "Malware payload (RedLineStealer)", "value": "35fa46a82edba147fdd4a2751f7f1a7ea203a4d9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698366442, "uuid": "fd0ce2a1-3da9-44c8-aaf5-ead3e9653b5f", "comment": "Malware payload (RedLineStealer)", "value": "5b23de0697adf977a1d8acc9634779b9e41d2490110995b7cbd82e25397a21000041a06bab1457554dc28c0d5d7a5df7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698366442, "uuid": "968cff78-1506-4900-8b9d-0127918b5d58", "value": "T19A552311B3DC613BE9F127B084F60A930A3BBCA11C65CB4B1B59D0986C73AD5B532B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698366442, "uuid": "a9a9ee64-0058-4012-bde4-cdcfc01f8253", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698366442, "uuid": "6b799d9d-02fd-4032-8208-e09be9599851", "value": "24576:fyqFuPWBmN2mqv+h3gigW8KT5ISsQV3JRiroQVUOeUSedULa+:qqFwVJ6w3gIT5JPVZ4xebtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698366442, "uuid": "b3dff0bf-df5f-43f8-b569-f6525d76f838", "value": 1390080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698366442, "uuid": "4b08f2d1-1bbc-450a-ad57-817179738869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698366442, "uuid": "43299c7b-78dd-4a59-bb07-141f729d3a3f", "value": "wextract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a723dd-7490-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698387620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698387620, "uuid": "e6125f7f-ceca-46af-86ff-4ef5fc369998", "comment": "Malware payload (Amadey)", "value": "bad1754c94251b2c78c00144697c3518", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698387620, "uuid": "765cd3f4-50a5-45a6-9dc3-69c41e44ef1a", "comment": "Malware payload (Amadey)", "value": "53a1c4eb6bd63f543220e90cb7543a84ad6aadfdf2c5fc4331f726a21518557c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698387620, "uuid": "0bf296f9-9fa3-4ded-84f7-c91989baae67", "comment": "Malware payload (Amadey)", "value": "af84e68f7e4c641d6a3a58befc6ee5a05d47bd70", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698387620, "uuid": "6106d76b-e67a-411c-b084-0e3ed9cab61d", "comment": "Malware payload (Amadey)", "value": "eed137ac673eac72d61cb8d30bac7a5810631177971b39a77588374f3e41b08b382ab9d38a6ab7203d3f3b1eb9939288", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698387620, "uuid": "154c54b0-9612-45a8-b197-2cd357b3c1d7", "value": "T1B5752343EAE8A4B3D6F20F754CF202D3063ABEA9ADB0934F3B9659561871150643237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698387620, "uuid": "5de1ddf1-f978-4351-98e4-c6f9d608a1c7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698387620, "uuid": "2fba5c30-5485-464b-80a9-55c3a597e770", "value": "24576:3yOOZY87XITfPZqHEQ91/eJctmKdV7QzysP2sZZhk5bra:CH7XIbPZtQn/eJctmKbQOsPD/O5br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698387620, "uuid": "796b0058-8bfb-4997-8a7f-00f8db2fb883", "value": 1632768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698387620, "uuid": "87d20213-6586-41c6-9b20-a3c5a396ca7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698387620, "uuid": "35d93498-2d33-49f3-9956-72e0894a99d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e557ceb-7461-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698367123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367123, "uuid": "5cd791c0-1afa-4c73-8d6a-177cf4907cd7", "comment": "Malware payload", "value": "16d4df43b8e437ea44ffe71a301f64c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367123, "uuid": "07e377c5-82ff-4900-b968-e0691c2878e3", "comment": "Malware payload", "value": "5486238ef753d6281077d15143ec3a8f87ed793567cda39f9ddadc66d4736b64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367123, "uuid": "e7d1b767-b47d-4f3f-9d71-3cdec56ce022", "comment": "Malware payload", "value": "f5f313957c56135e0f958d94b6b2c686c7808a51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367123, "uuid": "436ded25-20a4-4ae1-9470-5eed7b90d94d", "comment": "Malware payload", "value": "bad4597b358b3d9a8c270e32e7fbeadff33cf03d40ac9c1cdd2332e56514538d9a74a3dbb8802a1fed7d446cdecaafd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367123, "uuid": "9a4358db-ceb0-420d-a731-cfda45492126", "value": "T175B4AD27F592F191C69301FA469EAF1A3B3AF8385325BBB392D10E592791580473EF43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367123, "uuid": "03046d1a-487c-4f58-ba95-e34e097860c1", "value": "6144:uA7HFek44iAqppMCrhpk9GywUPlfSsfjBQ6m+i4x2qlilY8mFFzzwSEuMuJCNotE:uAt4vppME/UPl3mulBnhcSEPlHbl6lJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698367123, "uuid": "5747dae1-8e5e-4089-8556-fedb9154b789", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698367123, "uuid": "cf6c8ddc-149d-473e-afe0-d2b50e2f5a07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367123, "uuid": "9ec21324-28b2-4f03-86ab-3322929d65dc", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.19296.1358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0aeecc-74c1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698408490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698408490, "uuid": "e52335bd-65ef-4a4d-b4b7-f22d0d5675ea", "comment": "Malware payload", "value": "e169263a022a317ec378a1ec4aef22d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698408490, "uuid": "7a834127-d4dd-41fb-8302-5ff86c7ccd9c", "comment": "Malware payload", "value": "54a46ec0abd3b46b8a2cb35dc24fb344bd2d978f2db34a80359f8d78ba4b6da2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698408490, "uuid": "0a1493e7-2e4b-4555-8360-81caa02164fb", "comment": "Malware payload", "value": "c6e0e40e8789d8b351c3d6744ca85195ec573b3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698408490, "uuid": "e81c06cd-4b2c-4e75-aca9-62f5f16d97fd", "comment": "Malware payload", "value": "010bff58cbdf363353d41fe0e09350be389f5bdba6dc2b4a7ed1b6b4b2e9fb2b8571f59fb704116808dbc57bfc4fafa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698408490, "uuid": "cb3c196c-b514-4c42-b3a9-b4d80246c2ca", "value": "T1C1346D773AE6A056F5F7567189F562B02BABFC90697ADC1F1280031CD931A604B7CF22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698408490, "uuid": "7475568b-f1de-45e0-a6b8-be42d61761fd", "value": "6144:LJuX556mbtorX9yrNPINm/XuTLdLHCCptFK5TqRMM+jatJg:I2mYgNkIXWLMCpjgT2MM+jI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698408490, "uuid": "f98dc243-6051-4b1a-922f-1dd59b79e9a8", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698408490, "uuid": "ac422acc-bb10-4957-b0f3-84923752b7a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698408490, "uuid": "bece1a28-e536-4ed9-9170-55fe3320eb16", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.5926.18257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabd041a-74b5-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698403543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403543, "uuid": "64b82ab7-3a9d-469b-8fc0-2db8cf21e156", "comment": "Malware payload (RedLineStealer)", "value": "429d5e5fae4d539d6c9407a9f9183dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403543, "uuid": "5c26e4b3-8cb8-4980-a7e3-6ce06d2d3550", "comment": "Malware payload (RedLineStealer)", "value": "57635a3e961e37e2193a038c9e90dd73b6841c1b316f8d128137a80fba61495c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403543, "uuid": "01b54667-35da-4e31-a297-48e5f269876f", "comment": "Malware payload (RedLineStealer)", "value": "823e058a5177cac83e588e08a800aac1616da77c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403543, "uuid": "43a027a6-b560-48fe-8785-b2efbe9744d1", "comment": "Malware payload (RedLineStealer)", "value": "6cd2ba2dc6e8af91b179ba1e2d396fa9160b0e6ff0f9dbfc0983850c57977599d2cf11dc06e06ca3078c1c813af3ddc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403543, "uuid": "241534ed-d20d-4e86-a71b-9abc52fd8df2", "value": "T1DB7523C3EAD94073D9F127B118F30103163BFCA18D55CF8E1789DA6A59E2A44B578B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403543, "uuid": "da35ded5-41e3-4203-b573-2b51136d602e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403543, "uuid": "4427a58f-6052-42ee-b32f-349dafb19637", "value": "49152:LX4fPn3XKiA8uYNWHH0mri26YwVbFd1ydo:4nZNWHfG26PVbTQdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698403543, "uuid": "5ecfa7b2-b129-4998-a6a7-51e1762abe1e", "value": 1633792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698403543, "uuid": "72f262fe-3a4c-4a43-b6b4-402cf71c5e89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403543, "uuid": "322c244d-4d03-46fb-82d4-802aebec00bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc163e6-7461-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698367125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367125, "uuid": "38514e45-2300-4121-b46e-8890aff53b9d", "comment": "Malware payload", "value": "380cb8900399ba1cdad36735fb3a2606", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367125, "uuid": "458f9709-f0d3-493c-83c4-02065041f147", "comment": "Malware payload", "value": "581840abc5410c20f31465b266b3c87e9964315d452e3a8626e4edf9e1d17abb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367125, "uuid": "0c897190-8375-45b6-a58a-d38dcfefe268", "comment": "Malware payload", "value": "b382fa8c7f02b4b571ef83e6302a2db87233c214", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367125, "uuid": "e7fd8f68-b9f1-4893-9acb-0eafb25dd77a", "comment": "Malware payload", "value": "7cce2c662f132621511bb38ed92a6d4ff048045f6356bb9ce65154a6edfbcfed1f31dd0c9b0ff52ef2b28ccbd6acb025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367125, "uuid": "c68a7067-ef90-462e-b755-6c65f0148701", "value": "T1C273174332D11C5BD7DB16711F34262A6AEBFC322770D46F85606B8A2C31A44DE29BDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367125, "uuid": "507c037e-0d80-41c7-bcc7-a2f28d1b5bbd", "value": "1536:zVHrXVw12puCIHuFY0xb12R2pfNAzNbwG:pLXuudIOFY4bQ0ENkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698367125, "uuid": "aa3396ba-a9c0-4c69-a0b4-db6f171a5194", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698367125, "uuid": "1d1c78ac-bcbb-4ff4-bdf7-01c5539403c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367125, "uuid": "875e6081-4de3-448a-a572-9b5b411208c6", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.4643.27965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271f8bb1-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698422086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422086, "uuid": "7be31489-426f-4051-9f8f-059648299ed0", "comment": "Malware payload (AgentTesla)", "value": "254ace531f797da77e451ea20e8dbd68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422086, "uuid": "2d73f5fa-c366-4727-ac71-ded62b2c63c8", "comment": "Malware payload (AgentTesla)", "value": "58da840c8d43fab7fb57d81db6e70e43604eeb7b131a17de655e9e0d660b6b2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422086, "uuid": "d48de272-2476-425b-bca1-a0f30f4ac2f5", "comment": "Malware payload (AgentTesla)", "value": "6f74309cb032a35ee8989591e272005efbc0d1b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422086, "uuid": "dbb8f4bf-9a02-42f1-8913-6121be65040a", "comment": "Malware payload (AgentTesla)", "value": "657700da6276ea0e7cc020b8c0f31de97d1e841ddbd9825efa60cf02b967e20c9b60fc48f7ce38d108464af2f9bb9b79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422086, "uuid": "262d5353-a217-4e6f-8da2-d46acbcfd3d0", "value": "T1EE442D6135EF604875777FA31FDC79AA4F6FB7B26A1A906D2040071ACB52E40CDE1A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422086, "uuid": "2a56ea1e-9b6a-4715-8714-7ed717ac973c", "value": "3072:bqRe1Yebqe1Y5ULFe1Yxe1YHa1e1YnwMf6Pfp:1vXZoLCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422086, "uuid": "a221ce61-9584-40ee-b799-99db5f6c6909", "value": 253812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422086, "uuid": "1a5100d0-2954-4ca3-94c9-92299ebbfa88", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422086, "uuid": "7df78b80-ab7c-4407-9011-f805529c2cb2", "value": "PO No. 60834724.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78976318-74aa-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698398601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398601, "uuid": "118fedbc-4935-4778-8347-f6db86c3ae50", "comment": "Malware payload (GuLoader)", "value": "028cb069410fc6834786f27d03eb2484", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398601, "uuid": "15d6585a-ae0f-4530-9304-5b55b0307f3f", "comment": "Malware payload (GuLoader)", "value": "59e829bb0c81e399c27bc6c78c0e880f1e5b22cbb19ea23e1f889d6582d474df", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398601, "uuid": "d0eccbb5-1b65-42c8-ba25-c8554e73adae", "comment": "Malware payload (GuLoader)", "value": "d25cfac0018eccf1c2c92397a2197f70e38e6f45", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398601, "uuid": "97cb18b6-e88b-4190-84a3-523d62579b57", "comment": "Malware payload (GuLoader)", "value": "cf60a75e0bc272727603f047903314c940f0d64327501ec41b20e39ea31ee44b22645003754c16b503cd6d039adc9bfe", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398601, "uuid": "8a631722-8ab1-45dc-ba27-7a5dc56d1a38", "value": "T122336CA3EA54173A4D0B37C9DD518D41C1BC801905365A66FEE903DE920B9ACD3BFB1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398601, "uuid": "6e043a2a-4677-4696-ab27-9109d31f864a", "value": "768:jVdvD+g7iysUD1FCWaA/sltc3ZvU56tR+40MfjQMwUeO3EwTxOS3t6AiFj0:JB0XU3C/2sltc3ZMsqwEMosXTxkFj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698398601, "uuid": "ec05d56a-9fff-4718-b448-c6ec4e7caed7", "value": 53784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698398601, "uuid": "8e9e2d66-81cd-4e1a-bf54-5a4e9ce29edb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398601, "uuid": "6fd40677-c6a5-4216-9254-ce10087f6927", "value": "Angebotsanfrage 20231027.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d9fb1a-74ef-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698428210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698428210, "uuid": "f9d47b4b-8bda-4c80-bac6-e70713e93804", "comment": "Malware payload", "value": "113f790f918ad3cc9355d0cd7eeb87ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698428210, "uuid": "74f4aba0-ebca-458a-9c6c-08a87150bf91", "comment": "Malware payload", "value": "5b047686238347125e0f042d7b07c1999002311ad38ed042548dddff17c3ee0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698428210, "uuid": "019730e6-1041-41ce-aa24-89776e2ba065", "comment": "Malware payload", "value": "c10a7572af5ce5e8f3655b8be0182a98f05ba9b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698428210, "uuid": "79b07c27-a299-4f8b-a304-c25ef10d2d60", "comment": "Malware payload", "value": "3942f4025a786134e4a4f5496b2712374706e0140a0b0a1bf5a25d5679f88f2cf491e6c1d176247945e3b82a6483c6b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698428210, "uuid": "2033e978-ce98-43db-8179-b8e8d9bb0b02", "value": "T1E9753305ABD86473D8B59F3489FF12D30A39BDE38EA9037736044D1918B42E86536B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698428210, "uuid": "1ff80524-11ed-4cb8-a313-aac3166b2c99", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698428210, "uuid": "6b799f42-bb70-45e9-a2db-9a197792d63b", "value": "24576:lynznDqB/dVh0qFiuvOC6lOU2RPwWU/MW2nWfP7HkUu1SMyP16ZpI/6uFBb:ATC/10qFJEOUX/MW2nA7Hk7yPZ/JF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698428210, "uuid": "93e4b77f-76b6-46fd-aa0c-25dda59d4503", "value": 1630208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698428210, "uuid": "83862fe0-61fb-4525-abe6-3d00c8070120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698428210, "uuid": "a84decf6-c81c-40e9-a0b4-f39b64a3acc6", "value": "bus50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2ffd00-7493-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698388862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388862, "uuid": "0b36700d-c9b5-49b9-bdfa-fc4f91655f5b", "comment": "Malware payload (AgentTesla)", "value": "074b5b6db982008b3591d54c9ab166cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388862, "uuid": "b7213349-b96c-4935-a709-507f2050c03c", "comment": "Malware payload (AgentTesla)", "value": "5b67e491f773b5d8f0cb5e8809b23d8a79d7ca17cc8c5341066e109f4c2dce5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388862, "uuid": "bc0f5c89-b8f1-4fff-9e74-799344b757da", "comment": "Malware payload (AgentTesla)", "value": "80ef9e342a311c82e21ae290c8c76de86ec80b78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388862, "uuid": "edf7ead6-c4b6-495c-8004-2e22493c3060", "comment": "Malware payload (AgentTesla)", "value": "bd67fb951cdfece2d6e939c5a47b0055b0e4e5b5cd34fb48599b52c21a06345ea3fdc5457453c97ba294ae0471892252", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388862, "uuid": "b33f2814-e301-456b-b570-dbdc3bbfff84", "value": "T186B42366CE8FBA4D71540BB2501B1209AB5D1EF9ECF0CC3526BBEE696485FB4812C4DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388862, "uuid": "b0fc3209-5b21-41e6-b8c3-85b83a98a743", "value": "12288:Itu1jPOpETkLbliIZM49W5WsawEweDZVez+KOlps:LSETkLbliIW5ryezVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698388862, "uuid": "1a22a58d-cd36-44ba-beea-24b46accc49e", "value": 525928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698388862, "uuid": "376bb91d-c08f-43e0-8bf3-38f9d1843e9d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388862, "uuid": "49b15a4a-1e07-4e9a-a85e-a83bd038e479", "value": "DEBIT NOTE.pdf________________________________________________________________________________________.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a9ebb5-7509-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698439457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439457, "uuid": "811f7120-d172-4fb8-a9e8-2e5160271783", "comment": "Malware payload (Mirai)", "value": "65dcf145c8bcde7dc6341c7ea0b6aee1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439457, "uuid": "723f3c6d-8ed1-4463-b743-6962b82cc730", "comment": "Malware payload (Mirai)", "value": "5de496bcc8d0305c715931252a9f30fe79961ab93b4f6f4fccbe0538c5dde37e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439457, "uuid": "a469eab6-4853-42ff-8b9b-eb20c56e2521", "comment": "Malware payload (Mirai)", "value": "977f0957e3fc36f8a751226e70f42dae1beb8bb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439457, "uuid": "b3743407-32fe-4f12-ab55-334ce8180d71", "comment": "Malware payload (Mirai)", "value": "d61e9b5557f29f6022325c64c83ba624c11cfa55694fdfa913fbaa4c715e4b3de39e3465920ee912b0536e68eeb7c2d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439457, "uuid": "63df0ae7-bc05-48da-ae11-c95362ca9689", "value": "T115732A26B97A1E26C0D4B57E60FB8B11F5E1278E26B4C50A7D720E5EEF147006502EF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439457, "uuid": "509812d3-26f3-4612-9fa1-a099da25cbea", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WL:927jqCt8v3GI/A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698439457, "uuid": "dcf550a6-6936-43e3-9914-d6bdf55674b9", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698439457, "uuid": "ee5e82e0-59be-41b9-a889-86787598cfa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439457, "uuid": "34072569-2c2a-4b0c-8b3c-18ba535d5efc", "value": "65dcf145c8bcde7dc6341c7ea0b6aee1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0389afc-751d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698448167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698448167, "uuid": "ca1d6f94-9b81-4a83-9248-c10007c51c83", "comment": "Malware payload", "value": "9f666b6ad30dfe29da4486a65c138ef6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698448167, "uuid": "10472066-bd18-44ae-bd3f-f5228b28308e", "comment": "Malware payload", "value": "5fa249077f0dfcb2f4c1540e6568887b073557da10c6da0a2c1871e40c914189", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698448167, "uuid": "ee121d3a-89d7-4911-a399-4e66dd99b6dc", "comment": "Malware payload", "value": "ac328614f00cc6b92bc36dc523d5dbe8fa6cb358", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698448167, "uuid": "39bbfe2a-9fb1-4a08-ab2e-83b58dd6527c", "comment": "Malware payload", "value": "f7f12ded9642e2da467b21a78c741f68ceff63f3919350fe8f4dfbd7686e754be56a064fb972d55bb58e2fc146a1130c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698448167, "uuid": "8521a6bb-7ac7-472d-8adc-2f263f2d96be", "value": "T1AE35AF21F8C09175DEE320B742ECB62A426DA5B4C31559DF43D81BEED7246C13F32A9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698448167, "uuid": "f0530114-26cf-490b-96ca-0a2cbeb7d268", "value": "d880d0ae07cf434dea838358ed4c863f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698448167, "uuid": "57f5b382-2d8d-438d-a93f-4caa8ed5d070", "value": "24576:5ShMrHWdgAw/26p6XytGbSaOcKt9XNS5K:5sjw/26p6ira+rNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698448167, "uuid": "e2ab5f54-282b-410f-8dec-ae3a7976b3b2", "value": 1122816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698448167, "uuid": "10f25b43-b942-4edf-92a2-73c0eb6eb833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698448167, "uuid": "3f958bb7-d2d6-4ca9-853e-3a49560efbfc", "value": "9f666b6ad30dfe29da4486a65c138ef6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc02efb-74d1-11ee-8907-42010a9c0042", "comment": "Malware payload (QuasarRAT)", "timestamp": 1698415224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415224, "uuid": "05476bed-4dc8-4483-ace0-608799433f4b", "comment": "Malware payload (QuasarRAT)", "value": "4e7f83301591544a0f82ab3f53b00ea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415224, "uuid": "3a9676cf-49c2-4b56-bb7e-e8d2219c94b0", "comment": "Malware payload (QuasarRAT)", "value": "600fadedee6f9b0149536938fb9ce85b2b57d0fc9126250a68a76dad112108ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415224, "uuid": "b2e58711-97d2-4b22-b57f-4bb1dc9d0594", "comment": "Malware payload (QuasarRAT)", "value": "fffd95083aaebe32272f2cc28eb81ad3bd8ec2d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415224, "uuid": "c51565f7-e6bd-4acf-b6e8-ad0f3bf044c2", "comment": "Malware payload (QuasarRAT)", "value": "1120ccc5abd19fa37fa3f42e52b278266ade94b7bf6fcaae96258ab2f6b9896178e4a83af9ec2137d32af138824c6099", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415224, "uuid": "d68d636a-30f9-459c-b776-40b3955791de", "value": "T160D53369AFC5EC68C46C593FF011922D4267D46791B3F78B8C96D446B88FBBC0805ACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415224, "uuid": "b51d2eb6-2641-4c63-aa48-88da4be63418", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415224, "uuid": "089f7fe2-b970-4fb4-9629-6c7d4e214fca", "value": "49152:BVJWbgRvWgl3jTRWWiu9uADnxJHZHLFuWOSbstBvcTIkJzTYEz:BVkg5WaRRr9uArx9fuWPsnkTIkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698415224, "uuid": "40c37a1e-4451-41c4-94ba-99ff5a4f2fb8", "value": 2749440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698415224, "uuid": "933dbc68-96d3-43a5-a048-a089de804d43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415224, "uuid": "85b9022b-c563-4e94-8a5b-11ab5ea6fb85", "value": "4E7F83301591544A0F82AB3F53B00EA0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea112d2-74e2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698422555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422555, "uuid": "9b1f0765-c417-41ba-afb7-31fec028395d", "comment": "Malware payload", "value": "bbf6104b2b2953e63d98daf9c6fec2b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422555, "uuid": "78dba4d7-7a03-47a9-b123-eb67b90e4974", "comment": "Malware payload", "value": "605dc8045830795f0445770f524e12568592d9004296c17fe792f745dff1fab1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422555, "uuid": "713b380b-4d87-4d2e-91a9-d92467c27063", "comment": "Malware payload", "value": "87c014a12e84df85f4aa017438df1af6f3f56fcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422555, "uuid": "7fd71388-834e-4cef-a5c0-8dcf7a9066c0", "comment": "Malware payload", "value": "da8ee0082db34fcf96d05b1c66ccde068b23cd65c477dcc67af4cf12609594f1273830b959f2c7d676407e952d670364", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422555, "uuid": "2e3d326c-67ad-4f4e-b2d4-7838311acdc4", "value": "T16E05F11A7A86DD41C2685733C4D761185B719A829227DB4F3ACA37950E033FFAC4A78F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422555, "uuid": "13822b73-19dc-4096-bc74-7284c4690ef1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422555, "uuid": "5969b7b1-e503-4a07-bac4-956a9aa0829d", "value": "12288:AlnVST+oe6TNQOKG/FFpvx456OQDOy0X7TGI3cDDNIBgw2rmUSdJrsL1mGMPMYJN:ALefKAFp5A6cSHGrThdJwEGvY13GT8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422555, "uuid": "f1f71e7c-dd27-424e-90c3-c2ff25d88a36", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422555, "uuid": "b682a21f-8f1b-474f-bfc6-1534e93273a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422555, "uuid": "6320ff6f-a64f-488b-a552-2a05cb71dd1f", "value": "bbf6104b2b2953e63d98daf9c6fec2b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31a5165f-7461-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698367128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367128, "uuid": "5d7ec5e5-b763-4263-b1c9-24b9932a0baa", "comment": "Malware payload", "value": "67b964f167a8b76777b6fbdbf705f51e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367128, "uuid": "af01b29b-2c7a-4e0b-bb5d-dcfa598e6fd2", "comment": "Malware payload", "value": "615d9d55692dc222bae5db1508e26dea2fa54c067c3b0311804292972b844297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367128, "uuid": "72341a55-4fa6-4871-b490-2c2b05a9dd20", "comment": "Malware payload", "value": "f7bf9343df965be3965bb4c57da6e8ac44bf4113", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367128, "uuid": "deb27011-432b-4693-b464-ac280fe69971", "comment": "Malware payload", "value": "a8a5d17870636ad61e9c552f376aab1cb23ece91ca029d99cd0fca9b30aa177593af89c3b5addeb2514c340b0f901fc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367128, "uuid": "80f944cb-18ed-45fa-95c4-e926662d246d", "value": "T1CB156B2197E30036D6D306355CBB9598AF1BBE2469D6AC8A1DB8FF0C1F786813C31A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367128, "uuid": "23467354-abc1-445f-a45e-77f2868a4bbd", "value": "12288:Owz4L6KkUzVobR60A7VsNqmbQVUi6pBEggNg3OmfA1888888888888W88888888m:vz4+KkUpobhU63gUOmfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698367128, "uuid": "2cec9cbc-5e5b-4410-97d6-ebb8381bf907", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698367128, "uuid": "b8bd428b-cf05-4aad-b436-75d31a5084fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367128, "uuid": "b5256ec1-b093-4372-9fc1-e29246f983c0", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.25870.5516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec5de53-74ac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698399685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399685, "uuid": "dfd8e584-2b42-4d0b-80ad-7f36047fe9cc", "comment": "Malware payload (Mirai)", "value": "cc6103ca8342578b06bb0f4b878cfb0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399685, "uuid": "acb93610-4397-442d-a348-bf7bb5cd1502", "comment": "Malware payload (Mirai)", "value": "6281cca2f150e1702bb26274b6fab40aad3d3cb18370745c80822966fd813028", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399685, "uuid": "2586e2e1-1102-4122-9a40-1056d41a440d", "comment": "Malware payload (Mirai)", "value": "e339a61d886afbb59d895f1a977178032f402be9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399685, "uuid": "3185293a-512a-40ff-900b-70cf50c797c4", "comment": "Malware payload (Mirai)", "value": "3b8104b236c8e3907264fde96b352b9f8df21f83f36ff9c81b61bb99fe335b976a6ad9362cf2f2aa1f8a2967631c3f3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399685, "uuid": "d0a8b4e6-6e83-4e4d-b872-5992e9d69577", "value": "T128D2E1027641FEE1D5B00236E8678A9B72253D79D1D130FB8B3C0DF8A6E9A1D47F8942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399685, "uuid": "e456af76-f59d-4bc0-af8a-9500a3938511", "value": "768:vusHfRavjynNKnjFcZIhQzhKMXgi9q3UEL7K:HRwynNIOQQ1KMwXLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698399685, "uuid": "d8e9244b-5382-4b84-9b89-245109dddb90", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698399685, "uuid": "77d85ef4-850f-4a09-8ebf-7c37ba395412", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399685, "uuid": "6e7f18a9-6c0d-4435-a12f-da6f44cb0dda", "value": "cc6103ca8342578b06bb0f4b878cfb0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a980af01-7510-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698442491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698442491, "uuid": "f50893c5-9671-46f4-9859-79f0b596ec75", "comment": "Malware payload", "value": "5643274f6df8822f68d61d84d09a314d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698442491, "uuid": "486b06f0-229b-44b8-b65e-52703c9ceca0", "comment": "Malware payload", "value": "62a2b2e5a94b0984d1340508a83997c647cc4d8b371dca5f171bd565d83592ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698442491, "uuid": "26d3f9d1-deb7-42f8-855a-f7c5e4dc3b35", "comment": "Malware payload", "value": "b7638b9ed8a33d62861b12c405a7b83cd4a5b8bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698442491, "uuid": "1b94c3e0-ab75-4ab0-a9fb-216c1890b6b9", "comment": "Malware payload", "value": "e5cb3f088a1ea944b53c7a1c9392e9d87180ea87b0bfe632c8d0ed94b9f0411681b585a8a3635a1c380a0c6061b2ca2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698442491, "uuid": "031cacfd-f6f5-4e1a-ba8d-37383c085e11", "value": "T106C52300B241DC42DDB506F41C6AE2BA50743FBB641EB96337817AFE2AF2E31954F256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698442491, "uuid": "85324ba4-148f-477d-9b8f-4cf7731a98a3", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698442491, "uuid": "eb39ff02-4b90-4591-b115-135a7e9f73e0", "value": "49152:Ck2s5FXQ4EmojLjCRELVf7Avil+dHIsLp1thIikN+6u2hs8:C8zX71oDCRAZUviAHImDqia7hs8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698442491, "uuid": "01d9f7f6-a5b8-4085-bddc-52285e992c05", "value": 2671876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698442491, "uuid": "ca33af2f-6e15-4923-b4a2-c50f99e3ea89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698442491, "uuid": "cb205373-3493-43ed-899b-578c452bcfdb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e12870b-74ae-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1698400220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698400220, "uuid": "ed5f3512-af35-4e6f-98f9-295b5ff59ca9", "comment": "Malware payload (Adware.Neoreklami)", "value": "d5a31564542049be7090377d22005dd9", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698400220, "uuid": "ccc9ded1-ee34-4601-b3c9-e007019a0e4a", "comment": "Malware payload (Adware.Neoreklami)", "value": "62ba4cff84522926e0c6dea44e77ef64614522975f06957387c68fe39b7d1756", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698400220, "uuid": "a5b78d71-eec8-4cd8-a784-81017a4735da", "comment": "Malware payload (Adware.Neoreklami)", "value": "63740a142b40d78c94e65ce5ded128f985da3476", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698400220, "uuid": "0eb733af-8766-4444-ac83-ec3897abcc50", "comment": "Malware payload (Adware.Neoreklami)", "value": "726c0cd06a5655208b4dd8bbaa3ec2102b5fd7a310285dd6a29598a81ba2d5be79b8ed670338f3c851c727af8d3a2309", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698400220, "uuid": "6401f897-7915-412c-a51f-ab3c366d63dc", "value": "T1DF763324BCE996E2F88141724EC43EC8F186E750DB77D9F323540608AD3E4C9A597B8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698400220, "uuid": "a2ab0ec7-5eb2-43c2-90b8-3a7522069f83", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698400220, "uuid": "9a075fdb-5884-4940-bcc5-387cdfcae8ff", "value": "98304:91Ok+7KaKlBQYfKN7bIFLz9vX7/FW51G0VCyVN3g04Xn72gWbn2F4u4NJspmpBNz:91O+aKDLfKNULzN0m1k7/u43wmnT8J+B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698400220, "uuid": "07b24a74-9ad2-4a8c-a6cd-ca4b8a127cf1", "value": 7509852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698400220, "uuid": "08d0d090-9aea-4e8b-bd73-283d52d3b186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698400220, "uuid": "819b1f21-d508-49d3-bd56-1cb7ca43cacc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eef0dd0-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421750, "uuid": "46a41fa8-187b-463b-955e-e1950a6dcd2d", "comment": "Malware payload", "value": "646463c6fecf66e8f461d98c3f2eb6a6", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421750, "uuid": "fd7bab03-c13f-4c35-bf6f-eb89991e2745", "comment": "Malware payload", "value": "62f9181420adc532fe5483cd054d6050bd2f8b35d5b4b02837a2f0f002c50def", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421750, "uuid": "4d8364ae-4da9-4e3c-b901-c196e63e2b64", "comment": "Malware payload", "value": "805fa2b1754ec28011a0e68bb498e65cfcb83c6d", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421750, "uuid": "77b48220-ba61-4fb5-bcfa-b13087cae0f3", "comment": "Malware payload", "value": "8d0c8c93e2d7a37777f293138a11502424d3e9a5afd245179d914d9e50e8c70f68940edad8388ba438386a5fd2a32192", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421750, "uuid": "bde0a08c-79ef-43ba-93a6-4355aff317e0", "value": "T1CD723A2FBF97177DC95A917482E38739FAF8F02012514B6E86F4D7365E60B24A32A508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421750, "uuid": "d8f1ad50-0c2a-4aec-9b02-4956d2535e72", "value": "8b7d6f218f07082b5df448bc58285040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421750, "uuid": "ca64882a-4b3c-43cd-82e0-676692736867", "value": "192:a3uNpN9G/ow+I5lfWqV1vSMteJOv27JJ+3VZhHPU4Xixgv4e/0HQwy6ho7oYr7Ah:GWT9qo2lfxV1v10JO8+Z0Ty6huFr7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421750, "uuid": "a25ed7be-4c68-43bc-8e8e-1ed26bcf36b6", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421750, "uuid": "973355a0-d87a-4901-9ad4-4c3e42d7c7a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421750, "uuid": "506901da-a940-4d2a-ad4c-c1b338af0266", "value": "Billing_Statement_NOV-23_TP.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436a8837-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421704, "uuid": "297b9945-882b-4419-8af2-937fc02722e2", "comment": "Malware payload", "value": "a78a19f461d63409d7148f7ef9f5eb52", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421704, "uuid": "39a77169-dc51-4eb1-af1b-198b8b217ca9", "comment": "Malware payload", "value": "62f98839f6b769dfe8bc18d6b1e7c75f321682787a822d3a7daf0228ab87a948", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421704, "uuid": "bd36bffc-86ce-4302-a652-f3734a809336", "comment": "Malware payload", "value": "56c2f79439a42b5bea33840c6bfc8964a971abf9", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421704, "uuid": "45882416-8c52-4672-903c-1db1c453e6a6", "comment": "Malware payload", "value": "61d2fd5bb7e4ac14692902b0895aafb1d8192448bdb1cb7b952d2b1d00f6c1b25aa9280d8fb1f23ee7a6e48767cc803c", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421704, "uuid": "7e07283d-479a-4fff-8fa3-7d0201b58f22", "value": "T1B6E1181D83F2462CCF0D203FF0622242FEA9B65202AB57177532A55C9DE7EE71B1E624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421704, "uuid": "6c59885a-d4d7-4ad7-abd3-6e0867424f3e", "value": "96:KcMSSPY9LYcTjZMhVVCvkwQEeGIRf3UNape2ZUOqNB69SMotxYuL9lCXWOsg6IC:3MjuLLFOV8vdQjmkEOMOSpYuXCG5gI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421704, "uuid": "0c55ebae-ebb9-4939-8b65-8a8943053246", "value": 7162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421704, "uuid": "e941d2b2-f863-44c3-985d-8356db2d18da", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421704, "uuid": "313d9901-6757-41ad-9fea-f4537518a57f", "value": "Nuevo pedido11142023.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7346fe21-745c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698365091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698365091, "uuid": "3c94fbe9-5330-4643-9718-e0ef4c76efaa", "comment": "Malware payload (RedLineStealer)", "value": "802284404fca67e6af68ebf8fed8849d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698365091, "uuid": "bcfca6ad-4a2c-4804-9dba-b836015bdb30", "comment": "Malware payload (RedLineStealer)", "value": "63b9c85d5ca8b8c285086308c361b6a353758864593e489ae3711721dd5b89c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698365091, "uuid": "21af8b77-103b-4d05-84f3-499cb74c5261", "comment": "Malware payload (RedLineStealer)", "value": "3f905fa736f084e5cae5395c3d39829266d3d147", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698365091, "uuid": "0a1df0db-f194-4a84-baaf-1cfbc8cbc0c1", "comment": "Malware payload (RedLineStealer)", "value": "76705f4e61bfc977d79b4077c3c87ad0ce6f3d8911608d6371d36a61c46f2febdcba65238de75113efeeddbe68c22b4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698365091, "uuid": "8a23cec6-c1e8-4d39-a8c9-3154b2136ced", "value": "T18AC41262E7EC5132E9F557705CFA07C31636BCF29578869B23948D9E1CB2298A43073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698365091, "uuid": "7c077be9-01e8-41d8-9b1f-d1d18f70d714", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698365091, "uuid": "874ba485-8e16-4e68-b043-d1896f81350f", "value": "12288:HMr2y90UyYc8JUofWFhKAPkF5Czv6YuB5FnGuHxlhOSWgI:hynhccUoMhB+MhuPFR71K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698365091, "uuid": "579207f4-e09d-4ced-92b2-1ee9c24ca7d4", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698365091, "uuid": "94b8bec4-6d95-420f-a27e-14b4047ba605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698365091, "uuid": "80dbfe3c-fbf7-4152-a1dd-f56898717907", "value": "WEXTRACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08735bc-7493-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698388870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388870, "uuid": "9ed95048-cff3-47b2-8f93-4f1096a96c7d", "comment": "Malware payload (AgentTesla)", "value": "9087bc9972c4bbc61eef9927652a2f8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388870, "uuid": "42050572-2bff-43c6-b8ef-d08522cb0b33", "comment": "Malware payload (AgentTesla)", "value": "64f84dcf2d8ad3535479de54fd7d15eca200089b01f5d4abe8ae8809e58623c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388870, "uuid": "223a5a9b-e708-403f-abee-b4380d051a7d", "comment": "Malware payload (AgentTesla)", "value": "97273634ceb96c2400640ca2144c59f85df3112a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388870, "uuid": "532dbc28-69ec-4623-a8c4-86167726a298", "comment": "Malware payload (AgentTesla)", "value": "093aec1a4e18d168a88986ab6a22832fe5f8903fa3a049473557d34f95cb6ba6763ff13765513fa9b663fd88fbb530be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388870, "uuid": "7024c933-796c-4d04-8153-260c63dbe186", "value": "T16CC4125473FA5B71E6BE1BF49CF011045BB5B64EA9B0D26C4DEE10EB08A3B448690F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388870, "uuid": "861ae6b9-d150-43ad-9678-97200e05c0fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388870, "uuid": "cb5e8677-502a-4e64-b9ee-59b369665e2e", "value": "12288:9GhL+JzKj5XKDDwwO6thxMP0leJZOVDoY6wPk68meqV+:QhL+JzK5XKvG6thG0lPkYKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698388870, "uuid": "e0a185a0-2bbd-4797-bde9-8d1c8dee492d", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698388870, "uuid": "6d25883e-7bcb-4479-a8ce-f067c55a93cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388870, "uuid": "685c5e64-7f8f-40df-ad41-46c9d3f92633", "value": "DEBIT NOTE.pdf________________________________________________________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff1c98a-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421698, "uuid": "3c77fac5-76a1-4393-ad69-31b31d61c063", "comment": "Malware payload", "value": "6239b800d938770650b19afa6981a8e4", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421698, "uuid": "5c279214-9b50-465f-a4dc-d5c13d6edf2a", "comment": "Malware payload", "value": "650893958c741bb8361da9f1f5cb028aa1c56f8205d056e436f541018f13598e", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421698, "uuid": "f7aa962a-50df-4a4e-b58a-a3287ac9e674", "comment": "Malware payload", "value": "5c94f91981d7f64ade4047305161324a9ac4d1e4", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421698, "uuid": "acbcdcfc-22fc-418b-9d6e-33c6e927e05a", "comment": "Malware payload", "value": "233afac335a6813ba4e9b6bf079bbfa94a2dc238a53921c56aa491f8c2b868a1c64e66a9a77ddc09efe75e6c96bd180c", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421698, "uuid": "278f229c-e4b0-4f3e-a049-bacf8b6beef7", "value": "T1E6F423718CEB922ACDC281E7D3446915F7E8B89C44513B487E65A86E25F40FB920AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421698, "uuid": "53337ec6-b165-4365-a618-fc055970426f", "value": "12288:R8NUGqNSW28J5llsmT+XsxofU7ewhZuSdgj4MDEHnWK8AL:Rin78ln+XsnDn/efAHFrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421698, "uuid": "42c34043-ed3f-49b7-9807-78b0caff28da", "value": 737795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421698, "uuid": "f475d935-4559-4cf6-a6f8-4e6ae93dc21f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421698, "uuid": "2cd07a24-e512-4719-8b34-254347e63352", "value": "Revised enquiry for Urgent buy Denmark.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54be538e-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698422163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422163, "uuid": "be3e88e6-fae0-4a81-a88d-27061b4ae149", "comment": "Malware payload (MarsStealer)", "value": "c8322ab5c49674203c1a64001dfd03ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422163, "uuid": "9fb452c4-664e-4573-856c-6947773790be", "comment": "Malware payload (MarsStealer)", "value": "68d0e11261bd22cf58be2c6e0e8c7966dc4c969b08f522a63a923b8389c7cf75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422163, "uuid": "4bdcdf57-8a10-4547-8f00-0d811e381274", "comment": "Malware payload (MarsStealer)", "value": "37891a088802da8cb13367617ed74f7c2d834f07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422163, "uuid": "79e7947b-a0a6-4a0b-afff-8c2137c3f9d0", "comment": "Malware payload (MarsStealer)", "value": "1003b178c9e8272ed4b1a5e99b2061d1edb93bd8528075d9ce3b9a67c0a67b4a0d0301daf969d79e6e1a7378e1a0ff54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422163, "uuid": "36fa11f0-47ff-43f2-9c9e-6d516b49fe0d", "value": "T1F504D02172D0D072E4B35A3068B5C7B12E7BB83127B590CF27941E7E5E306D0ABB6366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422163, "uuid": "a65709c2-6ea5-417a-990e-02c14ff040f2", "value": "64d367eca3013d5efcb3099af3d7bb6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422163, "uuid": "04a5fb01-6e14-4650-822e-c8e4a9a5d07c", "value": "1536:yJzMBNd8853aVpBWHRCUu8qqOsVRVY5O1Me8XC3iLOcbna7Z2mC1M6L8Uaa8+KhV:K4BNaNsCv8qERqAZ4mIGlq9AEMAmdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422163, "uuid": "9e5d94df-a464-477b-a26c-8262dfdf0ecb", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422163, "uuid": "017c491d-ab57-4da6-bc10-86eca1738d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422163, "uuid": "da7858a9-9c7b-48ed-92d2-4fde3dbe499c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d31cfe-750f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698442165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698442165, "uuid": "b1544800-ecf9-4fa6-988e-973845eef79b", "comment": "Malware payload (RedLineStealer)", "value": "f45d9b844bd38845415b0d4b1e5255b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698442165, "uuid": "b330b0c0-980f-4410-82a9-884b75ff2a7d", "comment": "Malware payload (RedLineStealer)", "value": "69b3cec83a51a5142d2f03856347bfe454e79c785e0b6425c0bcd632edf94a3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698442165, "uuid": "cd602aee-06c5-4d3d-b710-097f990d81dd", "comment": "Malware payload (RedLineStealer)", "value": "67b60a43e6262c1d6547463022b2e90f51d98b2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698442165, "uuid": "6eb34f8f-b646-481b-90a1-6b6f87eaeb2a", "comment": "Malware payload (RedLineStealer)", "value": "59c2907ae84531be8c2aa2a93d031985b885dcab3aeb76710aaff0290f7ee9b79afa73af6f3c9c7b3bf07b0353c07947", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698442165, "uuid": "fc2e896c-daf6-48eb-8354-26c0a83e1a14", "value": "T10FB44A85818790B2CE9C1E7E7D987AE04FA13C346DE13ECB5EC9F94121F7566732092A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698442165, "uuid": "b6ab143a-94fb-4ba6-ab48-4e359d7e03ca", "value": "84e31d32a2cb7830e40cfcbea395c7a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698442165, "uuid": "262fbb52-0bba-4620-a9d9-db6f2a9dd93c", "value": "6144:sSyQdzblQNrVxVA3wWMw+ktVD4TqsDz9GdGGg226lo7fhvIUE:lyQx6NrjVA3BJ+ktV8TqsdaZxvlo7Zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698442165, "uuid": "850b5133-95a5-4c37-9d12-52c5598d7b00", "value": 502272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698442165, "uuid": "51f8e6c5-fef0-4dd3-a50e-dab7daa013f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698442165, "uuid": "9bbf084a-2354-4ae5-b57b-aca273a8e56e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0355e918-74da-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1698419020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419020, "uuid": "6f8afecc-00f3-4d19-ab07-ec591454e292", "comment": "Malware payload (PureCrypter)", "value": "455e6ac25dde30770642f9d4ed03094e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419020, "uuid": "f3dec6bf-aaa0-4f53-bc9b-116e1eb6c69c", "comment": "Malware payload (PureCrypter)", "value": "6ce6bab338050c0b6f181d55657e89e53ac1ca5dfd155e59d8516c441ee3ae5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419020, "uuid": "32b2dc53-6ac6-401e-bb93-c6d1c13cc6b9", "comment": "Malware payload (PureCrypter)", "value": "12888c3881d07df90cdd4db418f056537990cdfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419020, "uuid": "28a3a68c-562b-4cb9-b9ed-248aadc3edaf", "comment": "Malware payload (PureCrypter)", "value": "a74b00d40f670e69f83983b0f914469910c08dd12b81cc81dc2971d1eb6239725cb55a0656776ff38de15aac59ea3e6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419020, "uuid": "fab502a4-6888-4c88-ad62-5f7ae0159754", "value": "T175846C45FA489AA1CE6993341937CC745736BDBEB830854D24E87AA73FB7783102706B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419020, "uuid": "413a935c-9703-4ea9-9001-6e4869085a4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419020, "uuid": "448108eb-4c3a-48b8-b0ff-5126864d4671", "value": "6144:7Az7mZWLqvGS9qAaSg4JJKYnPzLzp3gz/v:wDWuSIQg4JJKYn7L13gz/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698419020, "uuid": "6f07c219-0ddf-4aa2-a0e5-af5c021dafbc", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698419020, "uuid": "754c3c40-68b8-48a5-88c8-f5b7b03355fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419020, "uuid": "ad820477-f8f9-481c-8fe9-16ec553bd390", "value": "Scanner 2023-04-25.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62770b2d-750e-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1698441513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698441513, "uuid": "f6248be6-e431-4499-a4a1-d756b9e422e6", "comment": "Malware payload (MarsStealer)", "value": "87cdc13658fb406b8c4eb2cd3e5520e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698441513, "uuid": "0001c952-35d7-42fa-ae5e-6b450fa8e71f", "comment": "Malware payload (MarsStealer)", "value": "6d788b9cbe3c45094ea5b283af221abe944c7bca570953da930a8649b6b7eeff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698441513, "uuid": "c9c55d81-a857-48a2-99ac-54f9c3e02d80", "comment": "Malware payload (MarsStealer)", "value": "d41108e8d8b14037180e1b39e44807d7137da54c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698441513, "uuid": "3de37a89-ae64-413e-8367-a00fd5102075", "comment": "Malware payload (MarsStealer)", "value": "6acffc5e8f7ac3eba038c87af4c2c3457286b5d2b3466972061f5003e77a03dbd88a4164aa9544bd4963e23a72ee1d63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698441513, "uuid": "78428617-4cc1-4289-bb71-676e4b2d95e0", "value": "T18604CF2176D1D032E0B7123365B5C2B21E3BBB3A2B75449F27841AFD4E706D0EAB5396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698441513, "uuid": "f50cb4ea-549b-4cd5-92f9-465ee5a0d4db", "value": "3cfc2654d985eb5b7fd58484f30ba50c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698441513, "uuid": "bd67c04c-d964-4505-a75c-93efe24c7041", "value": "3072:j4BNkQD5vZDQy9XSy+s2TR0baaUssxx7lddECw0LWgGbPufz:EZNvZDQyBSy+rTg9UxlHw0LWgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698441513, "uuid": "ae85e7b3-35d9-4819-b031-3e56e90cd039", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698441513, "uuid": "5bcbb09e-cf3d-4133-8cb6-02546a5b62dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698441513, "uuid": "66e0bb67-df0a-42dd-af79-a3236470338d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb2e81d-74a4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698395846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698395846, "uuid": "f431f6d7-0872-4589-b8a0-9aed483fc254", "comment": "Malware payload", "value": "fd00ad95e0e69f688e946771e5d229d5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698395846, "uuid": "dfa94669-1802-463e-8056-34a0049628a6", "comment": "Malware payload", "value": "6ede7eff0e9a353d18c4b8a093a1e3382b0c619be41f342fe2bf1a491c20aab2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698395846, "uuid": "9d52b08c-4191-4d3a-9817-896472927294", "comment": "Malware payload", "value": "88b67628bfcce1ba2071a84aaca6f7774f68c2eb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698395846, "uuid": "9f68d60a-b57d-4b35-82a6-271a130a9bd1", "comment": "Malware payload", "value": "5a8dd821ff5529d12c9cc22b6c6c5eaa2a1850198590e02826a1c6f4a2d1832d32b4f81a0c15fb2e22ca4be9f6a8ec27", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698395846, "uuid": "bc4a0d38-96f9-47e5-8d09-d15d05f71537", "value": "T15026CECAFBD89C2FCC7714B5CA5A53B1122A5C068342DF836A14372C69776E84F5ABC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698395846, "uuid": "6263ef0a-c402-4313-8860-fcd1a6986155", "value": "98304:k6FUpHbBQ25ucpdBsRakE1QCbzohDOz0fiBSoTYrZR9GG:dU99fFdgVhDOztBY9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698395846, "uuid": "8eec46b4-aec3-438f-bd5c-c7c38e97d5f2", "value": 4506751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698395846, "uuid": "2998ab57-f265-4d21-b054-5af3f155cc6e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698395846, "uuid": "d3134a96-c986-42bb-b2e0-792b4c06591e", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8811288-74b1-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698401822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698401822, "uuid": "6bfe972b-abb7-48af-9938-5525643a3f40", "comment": "Malware payload (RedLineStealer)", "value": "46fc4e82ba161acd61352b623e5cbee6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698401822, "uuid": "6a5f4ddb-8043-49ce-b8d8-4e5b165fcf1e", "comment": "Malware payload (RedLineStealer)", "value": "6f3aaa08baa55d61dd0e518e6847e47c323f2d3dcbaabe2e3c5299ebb7138b7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698401822, "uuid": "d3297dbc-035e-4355-b815-cdf99704e04c", "comment": "Malware payload (RedLineStealer)", "value": "3abb837b91a8e79cf3f9c8f56ecfe54e29f66fe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698401822, "uuid": "e489500c-b099-4ccd-b110-97115a93ad5e", "comment": "Malware payload (RedLineStealer)", "value": "628a012f7c827beccee8d6d54344e6af8e3840d14dee76013e86b8fd5a0e74bf8d58039b907b408842d7bded97741afa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698401822, "uuid": "43186ebc-eb9b-4dbb-81a8-30c33f0b2d5d", "value": "T13C75231636F990B7D6F243B164F30A431F7A7D115E60D35A23886EA549B3AD0E83272E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698401822, "uuid": "bd820945-062e-4288-b572-104518abea6d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698401822, "uuid": "10c318a1-5d60-463c-9e0b-d93dc2e7c659", "value": "24576:fymfUDPDHnTq0jar9+lqdm0EgprlEKe27OTs3bn594kAx1nFk1pMKrX:qTD7e900nl7M43bndE1i1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698401822, "uuid": "adf3497c-e99c-4cba-a3ac-b8b4193445cc", "value": 1628160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698401822, "uuid": "7cc091a3-bea4-4fc5-9f8a-7ec9410edd0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698401822, "uuid": "5a5b3dc7-410f-4c96-94b6-e459760eae15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77e72e9-74d9-11ee-8907-42010a9c0042", "comment": "Malware payload (Loki)", "timestamp": 1698418893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418893, "uuid": "5507d829-1076-4b32-9e9c-521dc400841a", "comment": "Malware payload (Loki)", "value": "3b7736009133ab2366038e6d9a3e0c2f", "object_relation": "md5", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418893, "uuid": "793a5836-e626-4c9e-ac9b-c571aa9af914", "comment": "Malware payload (Loki)", "value": "6fb30f4760c71e5dd852e73a34222a6fae6f44a0046d0f913e5bcb68ce514590", "object_relation": "sha256", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418893, "uuid": "f1490176-f457-4892-9a53-648c700d8b17", "comment": "Malware payload (Loki)", "value": "ba1ccf6ca0888c15f6475bcac6e285cb479d8939", "object_relation": "sha1", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418893, "uuid": "a39126ad-8fa6-4c5e-9123-1d932de876af", "comment": "Malware payload (Loki)", "value": "6d3417ecdbafb57a2594a70d5ee9be3c59aa4c9c2914f48a2ae375b0496fd545f01f9d2cde404b3605c6edc0361eb1eb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418893, "uuid": "08ec0849-70e6-4b87-af87-43ff3b384559", "value": "T1E745DF03D800DB83D41D87F8BE434DE90F4A6F18E98A69DB10577F8F3A316625E9A51E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418893, "uuid": "ad5e0698-6034-4e0b-8e59-84a94669d376", "value": "24576:wxBXZyrw6/2THaZylw6/90U++g4JRuJngtQETYRMO+4yi0CLnsd7UNl:UF6/ek76/+UBg4TUngtzTUGFCDkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698418893, "uuid": "76ca3cde-a910-4fd0-9e28-1a86c1a30b13", "value": 1186304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698418893, "uuid": "2e67a06a-2e59-40d6-ad02-1744c1b99e12", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418893, "uuid": "fff65db6-a56c-4a37-8981-ccf8d490deaf", "value": "SHIPPING DOCUMENT.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d3ccca-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421713, "uuid": "0f070b27-21e4-46dc-a938-a7f166ccbd5e", "comment": "Malware payload", "value": "140752d674c7090967199bdd7981eb63", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421713, "uuid": "707d6b07-e247-43a6-bf39-d56c651276d6", "comment": "Malware payload", "value": "7079490f8b183a29e4d388a5130baa4745f42850b8895519b4d3ccf2c7086fd4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421713, "uuid": "b9e03708-0196-4b8c-894c-55a641bc3091", "comment": "Malware payload", "value": "9b69ffe12ec0af918270c8bb23f1201342dd37a7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421713, "uuid": "449f961c-1aaa-4acd-8d48-6ae46eed2c67", "comment": "Malware payload", "value": "583a5e6b45b2521e78e56093be06b17b451042437f1f0b02943682e427bf5d7e406207b43b22cfb14ead818776b4228c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421713, "uuid": "ce22e9fe-ab96-47f4-b38f-59776d1ca50e", "value": "T17ED423976B64B2E6CA43484E016023DDF07AB1780BD605BFF0B096E4F690FB5AD943E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421713, "uuid": "1838a4a6-9e91-41af-9add-71ea81489279", "value": "12288:Gnn26bnchchOExGkwUoA+R+Y4w3GyXz+WHjF:02qnKH7l4w3XzDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421713, "uuid": "6d02f523-128c-4832-aaa3-841ffba91874", "value": 637230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421713, "uuid": "89fecda3-a5dd-43e4-88d3-0f42bbdbf55d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421713, "uuid": "2b4060f6-2735-4d3c-a9a1-d289070aaaba", "value": "new rfq 200618 pft0098.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc399a31-74f3-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698430175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698430175, "uuid": "2588dc86-136e-4544-aca6-4e18aa405c4e", "comment": "Malware payload (RedLineStealer)", "value": "8a3d576d8f4d3b4a7ccc08f6c24bbace", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698430175, "uuid": "5054cd06-6139-468a-85dd-b84bf350bba0", "comment": "Malware payload (RedLineStealer)", "value": "7080d5c82a051b8bbf427ae803062b0bef48bdbfb466bc9760aa8c50e7920332", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698430175, "uuid": "19be4ef2-ec8a-4903-8b13-bfa4f030eba7", "comment": "Malware payload (RedLineStealer)", "value": "057478068cb15282fb32d22134ffc7e2b0a6af11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698430175, "uuid": "fa4f8f23-9d00-4e50-8fdb-8ee94c399b93", "comment": "Malware payload (RedLineStealer)", "value": "448bb3f1b384e1d295345ab890a45d6c95c17b853ab24f27dfe5c17be9261e366930288eb680f98deb08a27569db19b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698430175, "uuid": "4692f4f8-ee45-4f13-9cdc-2b23704382e8", "value": "T161F63326BBE67745E1D7C031DA29EDB6703D34132EF647EA58B86B8025F62583F06603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698430175, "uuid": "a4d1b309-b724-46d3-8ea0-6425859cea95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698430175, "uuid": "a3419a86-4458-4585-80ce-ef6a8f1dca13", "value": "393216:j1XgWFAVcPc6tPSfEObGgu0eZJKLFThAK3m9b:j1X0Vmc6YfEuGGe+LF+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698430175, "uuid": "d1fc5f06-7508-4e15-b8a4-f1087f935afb", "value": 16345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698430175, "uuid": "7f951475-20f0-4a9e-825f-bdba48a62b13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698430175, "uuid": "e3253351-8b6a-4640-ad6a-6f94d124a5e9", "value": "inf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c0b274-74b4-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698402867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698402867, "uuid": "e2af67fa-a78d-45df-9be8-061e76e9af44", "comment": "Malware payload (Amadey)", "value": "7f50f2a6c65e05178bcf981652264871", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698402867, "uuid": "85cec169-efa8-4845-9d09-b77b65f8b9b4", "comment": "Malware payload (Amadey)", "value": "71898823e2f461b674aa28804eedc70188b30535a366c7fa60decc23f8c851dc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698402867, "uuid": "56d678b0-7617-4ab9-be33-f5b252bc6790", "comment": "Malware payload (Amadey)", "value": "5122332c41f85b1bc85b8363ca5c5292f8ceb765", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698402867, "uuid": "7770c126-4ba7-4e9a-b3f3-4fa0b7a11f6a", "comment": "Malware payload (Amadey)", "value": "e8ffe9d3fe84002d4248a17d56ccbe50efd95cb07fbe7c01001b64f0672209f32b6cce8cc1b963da4a6ed826f7fa777b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698402867, "uuid": "f79f7c35-5064-48c5-9113-2800cd7dc7c6", "value": "T155752352ABE86563D4F407344EF30B830B217DA49D68936B2793796E0DB3795607233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698402867, "uuid": "2743c8bf-0163-46ab-8e13-ff68d090ae7e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698402867, "uuid": "8b03ccf3-3b19-4cb8-a727-c743f7303871", "value": "49152:/3F71X/EsWO19ml+ivrjTfy17B7zmcsECiH:ff/NHml+YHTs7B7qcsEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698402867, "uuid": "60ce4794-501f-48c7-88e4-8c5425dbbf10", "value": 1601024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698402867, "uuid": "879a58de-8ea2-44c6-9612-c93c3d2f3020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698402867, "uuid": "6ad9ba0e-e83d-411a-9cfc-cdc8a93e3cf3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "076e2384-74c7-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698410866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698410866, "uuid": "5b891ef3-485f-41e2-8f95-c84bb1fa5c1b", "comment": "Malware payload (Stealc)", "value": "22d9780167ced146d99f780a486c8c75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698410866, "uuid": "3ec4c0ff-6313-429b-bde2-91128ea4a847", "comment": "Malware payload (Stealc)", "value": "7202870c0d2dae977e6623e759cecc723a47f3c0de5c5138a0da0fec0a2a7e14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698410866, "uuid": "ab16cf78-f3f8-429b-b8c2-c306f6d07b37", "comment": "Malware payload (Stealc)", "value": "046b318d85c69ed3c5403c627d40d818c41f0ed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698410866, "uuid": "b3cacbf1-a4cc-4570-9ba8-c0fd84d5a902", "comment": "Malware payload (Stealc)", "value": "43be07de62da3b67d0bef94d04e215ad7faf105e99e5707470494bcefb3b23e25299878ca501b6f34430d028084ded5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698410866, "uuid": "c7e5e843-34c6-430c-ac2e-8ce2506e955d", "value": "T1FA04D02176D1D032E0675130A971C2B26E7F78322BBA55CF27981A3E1E707C1BB79366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698410866, "uuid": "8d59298d-8b58-4d36-a81a-85cfa294e1f3", "value": "4409af52e985fd86908702f715cfdf97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698410866, "uuid": "c08f56ba-40a7-47d9-b019-dd713be831f2", "value": "3072:rYBNJ+QCvjR9qvQ/cOoozv/nZE+qPfYeRsp1Nd8/hKpnJT2B2bz:sFCvl9qvQ/cuvxqOp18JKTXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698410866, "uuid": "f0b1df1d-e1d6-4f0c-a071-c0645ccae31c", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698410866, "uuid": "e2960d11-d653-4978-af8f-23a9cf219ee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698410866, "uuid": "7fc7b1a9-0f47-48d6-96bf-05f4005d8075", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2928f9e0-750a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698439699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439699, "uuid": "5839cca8-44c6-49a6-bbde-3e9bb9accfc7", "comment": "Malware payload", "value": "68d8a369cdf2e92c0f7ac2310f633b45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439699, "uuid": "249ef353-7a25-465e-872d-935fc5ac2a6e", "comment": "Malware payload", "value": "73d095abf2f31358c8b1fb0d5a0dc9807e88d44282c896b5033c1b270d44111f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439699, "uuid": "e0a914ca-b42f-4cbd-854f-1522fa524004", "comment": "Malware payload", "value": "5409bd072cd857d94ff24cb8ede0c758689fbbf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439699, "uuid": "c366d66c-d55d-4e73-b2e3-f1057078aadc", "comment": "Malware payload", "value": "8a5b7e846a733f5cbeef8c1d8f3aaae86078cb1c92e5c46ea42c56e6cd6edb9ea5b20943dcd462c1dc10c21b6bdfa037", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439699, "uuid": "fd4df8ed-53af-4b5c-8c21-4fd8c638362d", "value": "T137463907FC9151B9C0AEE2308A669252BB717C982B3023D72B50F7B82F76BD45E79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439699, "uuid": "e3b2cbe5-f2bb-4d32-ac8c-b26034d1429d", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439699, "uuid": "820de270-cef4-4817-b356-368e2566e6ab", "value": "49152:2ATAFHGe+orb/T+vO90d7HjmAFd4A64nsfJSkOqugEkgEW4H5rD1/FagpB3B26kL:5Y+Dk5/3BVCxqiva1QuEZa9UGhlvyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698439699, "uuid": "e0b61b9d-27ce-4c1d-a685-58c31acd0af6", "value": 5722112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698439699, "uuid": "45642d0c-cdaa-465d-aead-c0142c37a77d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439699, "uuid": "4a7184d5-1fc6-4b92-93cf-f06e17a23280", "value": "73d095abf2f31358c8b1fb0d5a0dc9807e88d44282c896b5033c1b270d44111f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3509d91-745f-11ee-8907-42010a9c0042", "comment": "Malware payload (QuasarRAT)", "timestamp": 1698366460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698366460, "uuid": "90787030-9fd1-4306-8167-7dcd306692f5", "comment": "Malware payload (QuasarRAT)", "value": "1dee4122fe6ac3e05874fd3d39375247", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "unibatpacker", "colour": "#D00461", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698366460, "uuid": "1edc74e4-705f-490c-97dc-1a99887cbec7", "comment": "Malware payload (QuasarRAT)", "value": "754343d6d17924930f54a28112b43977a66ebea9bc60cc0e39955cdad37636ed", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "unibatpacker", "colour": "#D00461", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698366460, "uuid": "25f4ebc5-8937-4894-b478-348ddd49e224", "comment": "Malware payload (QuasarRAT)", "value": "bfc0be1492c0700a0904b95768927402f916104f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "unibatpacker", "colour": "#D00461", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698366460, "uuid": "ef694b71-cb9d-446a-a011-fcb036e83e1a", "comment": "Malware payload (QuasarRAT)", "value": "aa35c524ac5cc9f1bb597130ee060b04f5338d90c002772a00deb435b583ffd7986077ae241169b27de776f38bcb8332", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "unibatpacker", "colour": "#D00461", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698366460, "uuid": "1d277e2c-2c09-415c-925a-17b4a41f72fa", "value": "T1B5D6C007E64E4C2589CB9357151EB022E964E0D5A53C187F22DAE5E78283ADF6E33CCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698366460, "uuid": "cfc214e7-316a-4e37-9ec5-946c10a7bfcf", "value": "49152:Q7Xpsdgn6E9y4QgYTaHwf+g7Q83tKPo4chH3f268MWP/FhxWTwdGSvMy89AH+gYP:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698366460, "uuid": "054290d5-8f77-4aa4-8d1d-807fdffac3ad", "value": 13274601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698366460, "uuid": "459294c2-40fb-4a0b-ab1d-8bdb8fa9a0c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698366460, "uuid": "e85f9820-e070-4501-b44a-aa38a8f44a5f", "value": "da49aae4ea90792e9f5497dcd2c4fa8cf7bb98a23b2d846ab985facf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160830d1-74dc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698419910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419910, "uuid": "1be73790-6ddb-4b08-b650-85d0b3b645a7", "comment": "Malware payload", "value": "62a5b4267fde5cc4bd2386b233911930", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419910, "uuid": "22b3db9c-24c4-44d3-9023-de68a3e26be0", "comment": "Malware payload", "value": "76432f361a2513e8371e22a72f374f1243ab47068799fe010e18be5b3cb7561f", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419910, "uuid": "4784acdc-9178-48f2-b9d2-749daf3442a6", "comment": "Malware payload", "value": "ae18d243f55876746b2746c397461a4fc1469a99", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419910, "uuid": "c592fdf3-e845-4ad0-9c3d-9a1029a4903d", "comment": "Malware payload", "value": "d59d294ba871a98a7bdec339cafffba4436a60e813906f33df745de749ead6358813ba31fbfb649ad11e66e6b2f3b678", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419910, "uuid": "c57e5980-5b3f-41e1-8dac-8d4d7d10b9af", "value": "T188645A2363A5247AD9C59270370F6326EB20F548AF60779F7B8853981F90B657F1BB80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419910, "uuid": "c97e75b8-a739-4967-97ec-e88a6c503c61", "value": "3072:VPo4D2TT4fegLJwks8ACRWgXIMu27r2gCNsKF5CQmd5iBDwa0//zduMMsLEwIgjB:VPk4frqks8ACIkrJ5Swa3sLEwcLDdxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698419910, "uuid": "e62a4d54-fd41-4489-8f3e-053ce3bf6613", "value": 308384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698419910, "uuid": "df8b39d1-0fff-46ef-b202-7cb3442e9dc9", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419910, "uuid": "044a10fb-9c4c-4534-80ec-9132fdba78b2", "value": "FixOS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6aa49a-74c8-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698411604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698411604, "uuid": "5311e1b9-caf9-4adb-8800-1bb6a160e7a4", "comment": "Malware payload (Mirai)", "value": "5bf540aa4400fc8472edeac878306419", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698411604, "uuid": "ffc1196d-10a5-4079-aa13-92b85df9e98f", "comment": "Malware payload (Mirai)", "value": "77f0aa61a6c730fe062678e9e988f4d295b163c8d4f0863cecf0b0a9095d1b26", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698411604, "uuid": "57ae730c-7a79-4bc8-aefb-78f33c761941", "comment": "Malware payload (Mirai)", "value": "b4b6fadf713faada8432df2a883596e29b00cbcd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698411604, "uuid": "ad485374-f580-421d-b6a9-90075a2bb59f", "comment": "Malware payload (Mirai)", "value": "3f6fb14f4b8efa626cf4013b0f1371957c02bf8a6c7726cabf8d54e8b9628d4ff5239a24fcd8396d43cf666eed52ab53", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698411604, "uuid": "2bfc69f4-edaa-41a0-a690-87d294842fe2", "value": "T1793302A217AD6DE651F04777FC33F819929C27E8589330DA3CF0AA59B3C18154EF2585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698411604, "uuid": "9c738f70-a340-4c17-b5c3-a6f7a51c31b0", "value": "1536:u9O/ZMAXIxNUk091fPqF1aBexo4opKZb5:u9O/ZNKyJ13qFUFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698411604, "uuid": "53a2f2e3-5a0c-40c5-87af-0f47c790cc3f", "value": 52656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698411604, "uuid": "e2228ec5-ad6c-4d35-8b00-3564c74a27da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698411604, "uuid": "67567934-f5f5-43c9-b7f0-23fb71786049", "value": "syms.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c15a1b-74d9-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698418752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418752, "uuid": "f39499c6-8bbd-4e0d-a92b-67a11fb46565", "comment": "Malware payload (RedLineStealer)", "value": "215099da8574c9cd715ecf8309beee09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418752, "uuid": "bf9094e4-2767-467a-9558-8c31b8709cba", "comment": "Malware payload (RedLineStealer)", "value": "7ba93b3f58365c561d0ab9b9bbd4128a41036b574889e6bd20c1b1cfc3c3e149", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418752, "uuid": "4a3ecb7b-d502-4876-a0b1-2cc736e61868", "comment": "Malware payload (RedLineStealer)", "value": "fa913b085ac0221809145d099eb1528d95adab50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418752, "uuid": "3b27227d-efb2-414c-b2b6-65eed34101e5", "comment": "Malware payload (RedLineStealer)", "value": "f01d395bbf976cdab5686e101d885c65ca3279b80f21836c833d14f64fa0a00ed17a5bcff103de1a3f6efa7ae3a1116c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418752, "uuid": "e08ec5c0-eefb-48fb-9055-96dc66318b7f", "value": "T1FE653309B6D48437DA612B7007FB0AE30B327CE07435865F2789E5291673AE674B277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418752, "uuid": "ca978550-1155-42c2-8284-eeb7f1a59c52", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418752, "uuid": "1289359e-3019-48da-89ce-acc74ff72727", "value": "24576:IyLPtv2yT3yhcntiGnBXUkXvdR14EjRvvfwevfoRrxDx9sMDhdrpLIo:PLoyT3ymnhnB7VL4ARpcxDx9sMDzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698418752, "uuid": "c12b8cd1-cb88-4e21-9a7e-852898e78b5c", "value": 1537024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698418752, "uuid": "27a1a40c-5e0e-4fa3-98f7-d83ee5f9fc70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418752, "uuid": "76ec617d-a667-45e1-a1fc-fa14636ed050", "value": "215099da8574c9cd715ecf8309beee09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d589de29-7498-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698391026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391026, "uuid": "e6ece582-bd2a-4920-adda-8d31dc66f433", "comment": "Malware payload (Mirai)", "value": "e9ac357234e76d9ab8e953bf3584d6b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391026, "uuid": "4fa0fa78-4ffc-49be-a066-c364a4bc55df", "comment": "Malware payload (Mirai)", "value": "7c0bab2a0d5f66a553a58f4f9681e40d555aabe31aaa1a11ec7934c2e6cb5b46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391026, "uuid": "664b2561-f8e4-4f86-9cfb-debf96ad0560", "comment": "Malware payload (Mirai)", "value": "f84bfcbe16802b213ed635b436c7f4faeafe4462", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391026, "uuid": "7e8fec72-3606-42eb-abe1-59bdc73c08c9", "comment": "Malware payload (Mirai)", "value": "63f3d5b2f2b2cc996c360f154391c08d4b780ab394c8a3b744d8fa4efc1d5bb73c8766a8be7ee5d556d0916dc5527c73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391026, "uuid": "8fde36e5-4e99-4fac-a142-cb4b9d700778", "value": "T1AC03E17B12CAC3E1C46F297925FF7E060411AE2AD1608DB4FF6C78755470F22A62CB92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391026, "uuid": "af001f81-0541-4717-90ad-183aa6271c90", "value": "768:OwC0Smsz+g4k67+o23sqpx0E4D+WyX5IsAP19cUElb7EAqnbcuyD7Uiyqc:zSmszT4k64zND/X5IsD4Aqnouy8Zqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698391026, "uuid": "1237c80d-c71a-462f-aa02-07fce066375c", "value": 39848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698391026, "uuid": "c12ed104-f2da-4f84-809b-6568b3bc7e8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391026, "uuid": "1fdf253c-e5a1-4dc7-a835-8aa6c61d2269", "value": "e9ac357234e76d9ab8e953bf3584d6b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b19e1e-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698422089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422089, "uuid": "f277dad0-3d29-4a74-9bae-883733737551", "comment": "Malware payload", "value": "5b56a5e7cadc63b83a0a52596767b55e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422089, "uuid": "cb025f1c-0ea1-456f-8c8b-3df1201bac0b", "comment": "Malware payload", "value": "7d690f8cfdf68e8778ded0c4e25f0ec46b5e3048bb2aed680eca16ba1e101421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422089, "uuid": "a0044193-f368-466d-b7df-4b993e1bd730", "comment": "Malware payload", "value": "8b45f1fa9fd55d45b902e057a5290e05db5babe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422089, "uuid": "947f0b78-ea64-4928-933f-44550fdd2848", "comment": "Malware payload", "value": "41d43112d792b0785a701bf85fd028b029018011bb8af4ef11a9cc7dc5db284c3841a5d839c45fb41c168710099c6af9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422089, "uuid": "e6ad4f15-68d4-401d-be40-36d9b3f33c87", "value": "T1A40501003695CA56C2AA4F7B59B251012FF1E947EA0BF78B3CC8779C49AB3DC0942797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422089, "uuid": "7e281b94-af78-40e5-a18b-9af2b041f7af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422089, "uuid": "4b4c7c40-6053-4953-987e-60539ab2f90c", "value": "12288:RX9gQl8ejaaea9HbumFFpvBpB8hPDgEuoMC1kpr/6z23Nx8GMm1s4:rgQXDj7jFp7B8hPcEMCmpGQx8GMm1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422089, "uuid": "9201ed06-2c4b-4afc-8d29-2b31f2b187f6", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422089, "uuid": "f85f360f-d61c-4af5-8f5a-a1de16d8fe6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422089, "uuid": "5cc8d6a0-1b0f-49ce-a251-b8069d2132ac", "value": "SIP_10172023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6740495-7524-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698451130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451130, "uuid": "35eabf14-b2c9-484f-a56e-985056eeea2f", "comment": "Malware payload", "value": "976e6d5f53d70ad0616d627e69fccd88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451130, "uuid": "3bcf5949-d5eb-4266-9a20-93d2af91fe46", "comment": "Malware payload", "value": "7dbfb716abaafac81b085ecccf7b0e870b2ce42866e7559b4a70e1f033752e83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451130, "uuid": "ba7b2ba1-9183-450c-abd2-d69937ce98e3", "comment": "Malware payload", "value": "7e590e60be55a129eba96a85c5b97f67dffaf652", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698451130, "uuid": "d760087c-0850-4eb0-8fcd-90bdb03c77b5", "comment": "Malware payload", "value": "9849a4fd2e485e71fe56aa03395ad50ecab1c02dfbc589d03a13a4bfc3d178d6f03c7436b923e393458fad107ac3f320", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698451130, "uuid": "2a5d45a6-dfac-4757-b71d-20f5390dae8b", "value": "T19335AE2178C08176EEF214F743ECB62A82ADE4B4071526DF46D846EFDB606C17B72687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698451130, "uuid": "f6988b8d-f095-457d-8e61-38454030c7a1", "value": "d880d0ae07cf434dea838358ed4c863f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698451130, "uuid": "ec2e5943-c865-42ed-9332-aa6befff6ba7", "value": "24576:2ipkiHWdgAw/26p6AuVGbySOfzkHtxY4sMj:2kWw/26p6dTSeMm4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698451130, "uuid": "22871b62-5f4a-45ea-bf0b-38229a00c176", "value": 1122816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698451130, "uuid": "804e3e34-84dd-4ca2-992f-6544cc367540", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698451130, "uuid": "fda412ce-6ea2-471b-97d8-a4ce82d42a3a", "value": "976e6d5f53d70ad0616d627e69fccd88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d4521e-749c-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1698392420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698392420, "uuid": "e23dbad7-d75a-4aca-b326-70b00eb6a2a6", "comment": "Malware payload (njrat)", "value": "1fe2a55e3e5183ca8b0261b1582d2ff2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698392420, "uuid": "e987da04-7015-464d-bac0-76ce6770853b", "comment": "Malware payload (njrat)", "value": "7dcaef0a3442fdb263af59d4af0cd67cc08f61c04db6bdbfaf6609b478a52e1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698392420, "uuid": "fd8d5f1b-7a82-4b84-b4d8-4e61aa8db246", "comment": "Malware payload (njrat)", "value": "3297a8497f16778f3a94689fd3d5ec4d4aecec25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698392420, "uuid": "b4765160-53ba-42ab-9091-eae79331c3e3", "comment": "Malware payload (njrat)", "value": "f9b7331d872b67cc6a4569816ed719c2d4f2b42783dbaf5dbece5772bacf214c126d86abd559e1eb0b87afb382d97392", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698392420, "uuid": "af3cc7a4-284b-4c03-ab6d-635bee9392f6", "value": "T18E232C4E3FB98856C9AC177486A5965003B4D1470423EE2FCCD554CBAFB3BD92D48AF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698392420, "uuid": "24687da7-36ac-4803-9721-107b8845f462", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698392420, "uuid": "a33169db-c1e0-4b4f-ab7c-403a1e42a8e2", "value": "384:UsqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZvOhy:7f65K2Yf1jKRpcnu5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698392420, "uuid": "25317fb8-1070-42bd-aa4e-a3a5ddb162c0", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698392420, "uuid": "735a690a-96aa-4f56-b1de-05583f5b102d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698392420, "uuid": "caf83c7c-d593-4523-849a-5917de2d991d", "value": "1fe2a55e3e5183ca8b0261b1582d2ff2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103101ce-7498-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698390695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698390695, "uuid": "d6252cfe-698c-4d2d-ade3-4584a8a509ae", "comment": "Malware payload (IRATA)", "value": "1662e07239f77ff764c523c8dc324095", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698390695, "uuid": "b6a825cc-c2de-4a90-b5a4-d7b9add33a47", "comment": "Malware payload (IRATA)", "value": "7eb52afd47c1e158850edbd94ba0b8944868daae93cea2116c7f7a5d7d9d6414", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698390695, "uuid": "e73cf2d8-8740-4e4f-9f2e-72cfbf32c313", "comment": "Malware payload (IRATA)", "value": "3d376267ad74a90f2942e24b0f0ebf255ec2a1a6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698390695, "uuid": "58139047-7bb3-48ec-b5ea-002de2c7939f", "comment": "Malware payload (IRATA)", "value": "b229029c05f51ac31c3f4aeaabd2fa26fb9b17ed2cd93752c4b761deb97af47445931bfc033673459f156214355b813b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698390695, "uuid": "107feedf-abca-4013-a571-dab0705a7ced", "value": "T15D951253F266E85BC9F6C33320B4123615768D29CB43F68A2E0977BE65BB9DC4B815C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698390695, "uuid": "7c6071a6-70da-48bb-a30d-39d4cba1283e", "value": "49152:W/ASNsBECa6DcNemtbJAyasmcYLa4DS0rjzXYzyqj:sxN8ECa6AbtG/BLaWrjzozr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698390695, "uuid": "34b33c86-ffc2-4340-8889-25e62390ad55", "value": 1987310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698390695, "uuid": "0e16a872-50b6-466a-b6a1-106f9bbd0f38", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698390695, "uuid": "83a9e514-5399-43cc-8377-77d6a61f0e68", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05c9cfd-74ac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698399661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399661, "uuid": "42de41fb-ce82-4fcf-bc0c-100aa1bb4e76", "comment": "Malware payload (Mirai)", "value": "6f3a583f44e9cb9590a21b002e1a138c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399661, "uuid": "d1976824-30ca-4505-9146-d9995f46720c", "comment": "Malware payload (Mirai)", "value": "7ee04e6d28c585fc4fa4f3526c7d071a68bcade89ac246143d3924d285913564", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399661, "uuid": "8d5b7827-4e3a-4159-b99e-90470cc8afb4", "comment": "Malware payload (Mirai)", "value": "1ba74871d9dd61ce9d1e8bafb44a24356c7c9a3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399661, "uuid": "84d6c219-a79a-4b35-b8c0-4061b9df8ddc", "comment": "Malware payload (Mirai)", "value": "fd007f2aeba5f25483c35efe53952d394c589b5321832b6aee1c07fffc728d07c3b194c6094be315cb12ece4544f055a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399661, "uuid": "f73e19f6-d139-4ee4-b30a-53f1a9158027", "value": "T14F337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399661, "uuid": "dd329ef5-687b-41b4-ba9b-bb51b9ea1f82", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvg:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698399661, "uuid": "824391ee-291f-4527-b18a-d99fe0690c6d", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698399661, "uuid": "b466b9da-6133-419d-b8c4-2fb6e5cbc5fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399661, "uuid": "2de44835-cef6-4e07-baf4-38a68ac63ee1", "value": "6f3a583f44e9cb9590a21b002e1a138c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1537668c-74e2-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698422486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422486, "uuid": "9163c08e-db51-4c35-bb22-f0dad52e3a9f", "comment": "Malware payload (RedLineStealer)", "value": "b38161b44cd732420af8b4e0a63e0315", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422486, "uuid": "22f6227b-e8ff-4a06-b484-9aa54c0df5af", "comment": "Malware payload (RedLineStealer)", "value": "7f9a67e0213810c8cfe971c3d5fbdf64f88d771563d6f82401cd43b1409543db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422486, "uuid": "07017233-8edc-40a2-b1d3-bf026b66e60b", "comment": "Malware payload (RedLineStealer)", "value": "8567d407de9386e4545d3929d917a1e9a265af8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422486, "uuid": "3abb5a59-5557-4ba9-8045-01ed6d9c0b1c", "comment": "Malware payload (RedLineStealer)", "value": "6c7f4c3270c6da12e84239400f380ea6ff252e30b61f2909a98cb6e99bb3fe9350fe56c1d60bae1fb1eb5462356ea00e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422486, "uuid": "a74cf77a-e77d-4936-a61f-3f6c1963705b", "value": "T1E87523A6F7F11532EAF4A3B10CF26383073279A249658A5E37D7695D0C7379626B0323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422486, "uuid": "a4a4f041-deba-4a40-8bed-48f2c0867f43", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422486, "uuid": "4d8be600-9aad-4e02-92be-ee6a6b5acb08", "value": "24576:WyI3yLrdPzwnOEbW7F9S5iiQsZg0bOxFE3HUDsc3ZkMJYwoQGHCK:lI3ynxzOpW73OcFc2kMJX/GHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422486, "uuid": "ee78d82f-715a-42ff-a5a1-3b54405fa540", "value": 1628672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422486, "uuid": "6f812c5b-cbd0-49ba-82e3-d31d1528f99b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422486, "uuid": "b9edc39b-c27b-491a-ae57-bc700a4c0300", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304acc84-74b2-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698401915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698401915, "uuid": "180dab99-ec52-46f3-9939-4d20d14dc26f", "comment": "Malware payload (RedLineStealer)", "value": "4ffa52df84b580d7f62ca0199ea1ca63", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698401915, "uuid": "2d04f9fb-db94-4dec-bd89-53a8878ccc4c", "comment": "Malware payload (RedLineStealer)", "value": "802eacded56b837e1024c4fa7b94d71229f94d5540d562ed4e9f622fcac4ae5a", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698401915, "uuid": "66d1f51a-1ad3-4d27-a441-baf62247978f", "comment": "Malware payload (RedLineStealer)", "value": "06c5824ed2582f3487b067855e26c742ed46342f", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698401915, "uuid": "43833929-19d5-4805-bf87-c064c2fab8c4", "comment": "Malware payload (RedLineStealer)", "value": "30ac9231f98f0c9f7039a62e6f0f476297e4d16551172b867111bc48076d2012342a0c1df2eba9624a4851a9e609c78c", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698401915, "uuid": "0af25587-b5eb-44f3-af1e-c8a14ba65679", "value": "T1A83633970C2E6B9AF3AC31BFCC745129EB411BE58F68C5888499185BDC538B223DF58D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698401915, "uuid": "eff53967-7fe0-4293-989f-c4cc3c39827b", "value": "98304:TDUEbYFJyTNADATwuNbV5bT+k5IqVhT4+WJm2oNgFczC:TDhccAXuNbVFyNqVtum2osczC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698401915, "uuid": "c7c1a4a1-88c1-4c23-bf15-edf1f4cad6ad", "value": 5229988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698401915, "uuid": "a799e7fa-9fc9-4d95-9937-9236187cfd57", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698401915, "uuid": "0e93e9f9-598c-4364-b7d9-b11acd6bf0b1", "value": "Setup.exe.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e925d4-7493-11ee-8907-42010a9c0042", "comment": "Malware payload (AsyncRAT)", "timestamp": 1698388820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388820, "uuid": "5670fde1-069e-4ed1-af0f-e357c8de08b6", "comment": "Malware payload (AsyncRAT)", "value": "3ce23e92922211a15efd24940cfd77e3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388820, "uuid": "1d928e30-9954-4f96-ac3f-4a52a54df3d6", "comment": "Malware payload (AsyncRAT)", "value": "85b4167417d416880d3e9f1ff438e1e5b125ceb28de4e3ebd9b5725717815157", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388820, "uuid": "2569da1b-3461-47d3-acbd-974de594e52e", "comment": "Malware payload (AsyncRAT)", "value": "dde27c5d0067443b82d13769e77874f76bf9ef22", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388820, "uuid": "f56d386d-2c46-443e-aaad-6e476209a037", "comment": "Malware payload (AsyncRAT)", "value": "8e0b6ca655746af9d01c94c94beafa055cbe72f63fe08864ac340a9d8d1e24d5fff6495f2645e6e983ff8f2373101b1c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388820, "uuid": "44d61c61-8368-43ea-9458-2fbade6be92e", "value": "T148E44681A6D14761E56E193225ADBAF094EDFD2C1A20CDCF62F4EB58C53334FD213A62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388820, "uuid": "c6eb9e87-ee2b-420d-a087-cc7d47868707", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388820, "uuid": "6715562a-727e-4489-a940-f110b7d79581", "value": "12288:PcrNS33L10QdrXPLWwrwn56HLOpu7WjcchzSE767P6:WNA3R5drXPbrw56rO/Hhf78i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698388820, "uuid": "a7d9f5b6-cb1a-4a3a-b1f3-6510ea59f9ee", "value": 668639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698388820, "uuid": "5807cba2-5c14-4e28-8895-80ab6b7ac726", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388820, "uuid": "24d99770-0833-474d-a548-6ff7a2f958bf", "value": "Comprobante.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6d5506-7512-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698443493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698443493, "uuid": "9d5168c6-fa8a-4961-83a6-f51a83597b93", "comment": "Malware payload (Stealc)", "value": "d71b1701274bbc28257c0ae3c1c589f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698443493, "uuid": "6e95f386-0dad-4b2b-9ea6-a87a529d485b", "comment": "Malware payload (Stealc)", "value": "86d9471d56a6882413c72628c79b3e58350c58b6e4c2785ca3e15944aa1f9d6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698443493, "uuid": "5d7f210e-3e16-4d28-9363-35e7a62fcfc8", "comment": "Malware payload (Stealc)", "value": "c1809d7bb340ea05e8716d6d0529f8019e32ae7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698443493, "uuid": "31f9170e-8593-473f-8318-6464bc314f4e", "comment": "Malware payload (Stealc)", "value": "193790ac0cb879b96e9dd0619ac681e6a79f8de641af14930f3151f719049b95288efd69793d16a4f987b45d1e05c665", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698443493, "uuid": "51c03a88-fce6-4e8e-b889-1e9e2cf592d6", "value": "T18604D02172D0D072E4B30A705971C2766E7B78322B7695CF2B941A7F8E707C0ABB8356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698443493, "uuid": "9b1de2cf-258d-4cca-ac9b-e568fe065c3e", "value": "64d367eca3013d5efcb3099af3d7bb6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698443493, "uuid": "7599e363-da36-4c40-a0bb-2a62d6da7e98", "value": "3072:K4BNL1sCv84qoqXHcHHV+i/WkG0Ab4hDUCSiSIGZtgXpqa0gonhUBd2z:3cCvNqoqXHcEP1b4hDyha0gQhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698443493, "uuid": "836cb40f-5ec9-4772-bc3f-7d61e6cc660a", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698443493, "uuid": "a238542a-b7b5-46ae-a47b-609dc7a0f558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698443493, "uuid": "db0a28b9-439f-46ca-9497-3c5ddd3cf11c", "value": "SecuriteInfo.com.Trojan.Win32.Ranumbot.14951.11102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553c9991-74c1-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698408420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698408420, "uuid": "8f157826-69f7-4c91-a0f3-f49c1dce8db2", "comment": "Malware payload (Smoke Loader)", "value": "784430458c79b0864235549804b08ed9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698408420, "uuid": "acd01b4a-7023-452d-a282-5d79b6c14bea", "comment": "Malware payload (Smoke Loader)", "value": "88834bff834d0b0fff494a0edc3171fe9186a14a3a36c101c9b85700fb83c217", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698408420, "uuid": "7d0a39cd-0595-4c21-9f4b-c826b4d55717", "comment": "Malware payload (Smoke Loader)", "value": "2b43e9e762952341e7cdf7867b5c94cbf696b1f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698408420, "uuid": "32b54797-2944-4545-99fc-af2fe3866135", "comment": "Malware payload (Smoke Loader)", "value": "4d40368ab69bd073ccb63abe12037d93cecb4cf7135e1ad157ee84258d3e3a4db9810e73aa415653abe851a9ec2423a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698408420, "uuid": "8818538e-1699-4b07-8dfb-0de57dd17532", "value": "T188752363B3EA9077CCBA273058B646C30B36BCB0C934465719A9E8476D336B5693472F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698408420, "uuid": "a0456817-109e-4532-b59e-474a47a02e37", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698408420, "uuid": "3f603af1-55b3-44d4-8602-9f03c183a08c", "value": "24576:6ylyZk8HcoLuN6DNqvICaSVZvtSokfrkhNoa+WxjJXpmq:BN88PN6DTSFSihKa+W9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698408420, "uuid": "3962a0ac-46ef-49ac-ae1a-c28909093668", "value": 1635328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698408420, "uuid": "2ebed406-3c8a-4b94-a97c-853c79d70b93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698408420, "uuid": "d8cb3bec-49f5-4360-9282-8c324bb25f09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3385c04-74ac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698399665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399665, "uuid": "751a3176-5aad-4231-b4fe-9234b2518602", "comment": "Malware payload (Mirai)", "value": "16714dc43b7e7ff78b66ea9a9f3b543e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399665, "uuid": "64c95a05-9247-4b73-b341-cb42cf91bfc9", "comment": "Malware payload (Mirai)", "value": "8a116b76d06fc5328baa3a2811ff61cfcc5f06a3fb0b654b27a2c104df42fb97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399665, "uuid": "a6315afb-6b87-4ecc-8c30-ffec74886a97", "comment": "Malware payload (Mirai)", "value": "091dbdb1a77bddce19e4c7b5a56d2c95f8b7fd2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399665, "uuid": "219eb63a-8857-4173-a8d5-e2ce5c800270", "comment": "Malware payload (Mirai)", "value": "fb38ed24930dd21bc0b3c21a32debe0eb5510721b949d93030f77f6be5819cdbaf71ab24e0f1d314056aefc62d56cf37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399665, "uuid": "81643a19-7426-4c23-96e3-7d936efeb706", "value": "T16BC2C07DE8A4BD46CDED08388CDD13B8089D66C6B68E4F6DD3261DC46B2518B3C9A4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399665, "uuid": "53e66164-79bd-4712-aa5c-e430da707dc5", "value": "384:PmWTv+78AdGa2nS3xbjJUFbviosPlozhfbIAawprR9gICSk3kImQ0KnEzrEcftwi:a7ddenS3j6Koolozxfk5JmsEzrtthoWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698399665, "uuid": "7a3f6f9c-6cc0-47c6-aa91-258939de0b5f", "value": 27252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698399665, "uuid": "1ec196da-2287-48b9-8318-37eca467a93e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399665, "uuid": "72ac6fb5-22c7-4fa4-b58b-4775685a2ab7", "value": "16714dc43b7e7ff78b66ea9a9f3b543e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fd2aa5-7512-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1698443422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698443422, "uuid": "d888e1a6-ef8e-4f1b-b284-415e428f6d5e", "comment": "Malware payload (njrat)", "value": "ac4ed71ff3de39c6947dbafbb65c79d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698443422, "uuid": "4d7e2af7-377f-4ba0-be44-d18007832140", "comment": "Malware payload (njrat)", "value": "9047ddcbf9543f15012a46ccbd905d8d967e475487148babd38ca3e0cca33da2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698443422, "uuid": "30a83c19-6f00-4652-a506-940c08a69186", "comment": "Malware payload (njrat)", "value": "7c859e9b926ae050db5eebc90eb9175485c7a21b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698443422, "uuid": "30bfed01-792a-4959-8315-043d74dfed72", "comment": "Malware payload (njrat)", "value": "8a74bfa4c960c6e3cb493c4f3647a835f2f1b5c85fe4cac6d457357d35876979b3b309538a414af9a7f7d97e715a9eb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698443422, "uuid": "33aaa29e-3437-468e-ab33-00d6c210fedf", "value": "T1F493E94977E52524E0BF56F75471F2014E34B48B1612E39D58F219AA0B33AC48F8AFEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698443422, "uuid": "6e9b52ba-f302-448c-b280-72db3593c5e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698443422, "uuid": "f77ff03c-61b8-4445-8958-e5bda3e2cff3", "value": "1536:hUNJD/HBZbszKu9AZp77r1jEwzGi1dDqDrgS:hUUzK4AZtHCi1d8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698443422, "uuid": "6e509c27-ac04-45bb-83f2-c14b533286cc", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698443422, "uuid": "4fd249dd-ec48-4f3d-9d24-eb4a1384ae46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698443422, "uuid": "ee5e3a07-75cd-4a7c-97ff-b18343b7fe6b", "value": "ac4ed71ff3de39c6947dbafbb65c79d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27dd0234-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698422088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422088, "uuid": "edbca1d0-3fb0-4d7f-b9bc-781e63ea73ad", "comment": "Malware payload (GuLoader)", "value": "f2e62219807ff58ea21ecdd6ccf16064", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422088, "uuid": "9b7bfaaa-cf11-4ae5-b26a-871f025eba9f", "comment": "Malware payload (GuLoader)", "value": "9155355baf8df04eb80c98c785632b808e63e255d92fe05572f2e5dc29ca69bc", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422088, "uuid": "ed5e025e-b779-4e53-9ad8-ed9f0c24e6a9", "comment": "Malware payload (GuLoader)", "value": "6b03322af58c9b3b9725837b3d480b967a814e35", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422088, "uuid": "65f537bf-7766-475f-bcbe-7bad45fcb691", "comment": "Malware payload (GuLoader)", "value": "e8181041eb76f0ae4d21511597f59ef6616b6f9762059b3d10dc18adc502c0354a26ea02e611823866ff69cf74578ee0", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422088, "uuid": "419c945f-184a-48f0-9ff5-a60633104f83", "value": "T151337DE5EAA0062B0C0B37D9DC420D8985BC815905369165FEED13DEA21B95CE3BDF2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422088, "uuid": "3cf1b70c-da69-4418-afc4-a33b26d8007f", "value": "768:kVvv/koXiysuD1FdWzngqW1OAT7U3RTuTlZ40HhVuP815Ecvtc+Qt6AiFj0:ef2Xu3dwngqfATYx2vb59vW0Fj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422088, "uuid": "ccab831c-e014-4313-a209-e961dd0f595c", "value": 53727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422088, "uuid": "8a2991a1-583f-4e8c-a9ca-18d03f895687", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422088, "uuid": "a2217f40-51d5-43d5-a137-b11d23a658b8", "value": "Dopis_prenova 922, DE, EN, SL, HR.docx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a066dcf-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698422037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422037, "uuid": "22395578-c434-4ded-9595-32b78d1440ef", "comment": "Malware payload (AgentTesla)", "value": "02f6e97995f4641dfcc9e8076af5a509", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422037, "uuid": "636c7088-7f1f-48b4-a887-6bfa70ce7539", "comment": "Malware payload (AgentTesla)", "value": "92ad6bc5a2acb0797e5e3b2c277400d7df2804b375a0fd16e4e49f1bd129ef96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422037, "uuid": "cdd33017-79ad-40fb-ad7a-1b8747a5a6bf", "comment": "Malware payload (AgentTesla)", "value": "d457c4f60e172e4ac17081dc8df30e5d7e00db4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422037, "uuid": "0c2b573c-3127-482e-883b-6ec2f2c16667", "comment": "Malware payload (AgentTesla)", "value": "2f8abb49e62f17ce3bd6ec578205adb64cc7ec95bda0a505695ff14c637ccf28ebeb9ca31788e35658bd9e8eab8cc0fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422037, "uuid": "7c5fee0e-8c6d-4bb6-8630-da8e5edc6697", "value": "T1D2B311426BEA2108B5B7BB444A7A51744F2BB9DA6C7DD54E01CC5A4C0BF3E80CC60BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422037, "uuid": "2077a736-f5cf-4d7f-a426-1dd699d8a15a", "value": "1536:F+hrVr/e4Mi3mI2hb7KZ18C2NGkikGkFjGkikGkKEt0eEKU+kCKGWGPrbrbTDDp5:CrVr/eBQZxNj53e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422037, "uuid": "b83869f2-e9b3-4ee3-8a06-406c629ea8f7", "value": 109360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422037, "uuid": "bba02bdd-f610-447d-97f9-2e038f31804b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422037, "uuid": "b24f1b20-5f68-4f87-8af4-9c2ffd606779", "value": "INVOICE 140562.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e680da-7501-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698436092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436092, "uuid": "f9e4b53c-2102-4212-991a-4061269d6a76", "comment": "Malware payload (Mirai)", "value": "37bafd2562504a8845049cc8a534380a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436092, "uuid": "d3dea06b-ba44-426e-a2b7-8683b88f690d", "comment": "Malware payload (Mirai)", "value": "92bf0312b5035f2c5b4bead0987eba2e2e6c88b97d9563c44cef92d2e055f75b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436092, "uuid": "712feff9-f193-4ec4-91d3-d7649967f1af", "comment": "Malware payload (Mirai)", "value": "646f6027527e37a8d24bb459046cce2b9f76d716", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436092, "uuid": "af59a904-be86-4bd6-9936-ce18f4a2a8b2", "comment": "Malware payload (Mirai)", "value": "4bd25c89d4653419aac4a115ddb9b2ba42e7675687317407fe7b5e3d916c6ce925aac1cca1a9df5b9078f26eb2d232b4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436092, "uuid": "35d02e29-740f-4921-bde3-280e05ccc36a", "value": "T175D2E1B87B0245D7CAAAA1745DE50B263D60CFB2E1436C077598D9C7BB098AC3CB6DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436092, "uuid": "8471ffe0-adaa-4c20-b21e-48269d011b37", "value": "768:E4ylAtv6pqLJM0RXaxGyUbXtheU/SaVn9IJgGlzDpbuR1J0:XMBqTRXa+Zhr/5OVJuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698436092, "uuid": "b86607ad-127b-4a40-862a-a70aaf315dd1", "value": 28884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698436092, "uuid": "211c2298-c838-4872-a1aa-0feb6337a418", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436092, "uuid": "0d4d2331-2b3d-486d-b5d0-de2442924054", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e49b6cc-74bf-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698407495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698407495, "uuid": "d149846f-17d3-414e-8b27-1a4620961361", "comment": "Malware payload (RedLineStealer)", "value": "28a9def50d122f93c4f0de259944e369", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698407495, "uuid": "2c09d31d-ae5f-4565-8499-2441be13d7ad", "comment": "Malware payload (RedLineStealer)", "value": "92c824e81461ae24e514c4fee0d34a187cde7037d2ecddcbfa6bc89e8fdc5c4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698407495, "uuid": "9186bcbd-4942-4173-9e79-d5a6d765259a", "comment": "Malware payload (RedLineStealer)", "value": "c59237284ab6d92ac00e73d46efa2ef4343083c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698407495, "uuid": "5dccba5f-8873-4a17-b3de-6290278031bc", "comment": "Malware payload (RedLineStealer)", "value": "883adced561b575b47708f3f29bab03ba0d03412b77091aa81efa182c02e09ea2eefb3815af712473f6dc65b74cf1e32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698407495, "uuid": "f5f73d48-5324-4368-a705-7bfd5a600aa2", "value": "T1DE753302DDD8D2B3D83B6B741DF6861B0E263C926938669F2B1188DD1DB346CD0297E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698407495, "uuid": "2ec2ae1f-8744-4a2f-9593-3dfd4a2676df", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698407495, "uuid": "e78a34e9-263a-4946-8d73-b1a0e4bd37d8", "value": "49152:VQth1lTNNU/swP2hzgo+JxMqoFCdplmu:OtvlZCHP2t+JxdwCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698407495, "uuid": "7ebb2d33-1e92-4974-a80a-a97fbf73e81d", "value": 1632768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698407495, "uuid": "48641207-fc19-4b70-bf42-a0a4dd57b4c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698407495, "uuid": "eecb9e28-cc84-483f-bea9-a3986084e066", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cb28a9-74ad-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698399744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399744, "uuid": "add78070-a6a0-4767-b5d2-ab0bedfd7033", "comment": "Malware payload (Amadey)", "value": "39e79a2614a7494949779fdca934b9f5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399744, "uuid": "748699d1-6600-42fd-81c8-9a32676a281f", "comment": "Malware payload (Amadey)", "value": "944a748d508cb32b9f04f81b81b8493ae97e11ab7ce91ccb8047388c66df1ee7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399744, "uuid": "1d265bb2-ea04-477f-b460-0e46a8c37321", "comment": "Malware payload (Amadey)", "value": "0b25159ee40c6c19cb747941965e6874f3600566", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399744, "uuid": "5f5a1fe2-c035-4a1d-a242-18327c7c07bc", "comment": "Malware payload (Amadey)", "value": "d6f4847acc290fc37991cdad71909967ab74e899255a7bae66f1bfdccc044e3c8434fd229d70280eb4b58738108a3a5f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399744, "uuid": "ed3935f7-61fd-4e85-a97c-8be5270b19c8", "value": "T10E7523176BC544F2FCA95BB008F601EB0B35BCD6483A06B763DAACDA19B3186553173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399744, "uuid": "18e3dba1-37e1-4858-b55c-594b480ddc41", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399744, "uuid": "253fe15f-b2f1-4ec6-9e2e-8398697dd640", "value": "49152:c2sO+7Mco0128ZawxqNpRSdk6gwhzRNTmNbulR8/qWA:N+7PJxqNuK6hBmNKWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698399744, "uuid": "50d74dbf-7bc5-4c99-a002-c1196abbbd46", "value": 1632256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698399744, "uuid": "659d4885-744b-4921-bd2d-a22858b1935b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399744, "uuid": "f859142f-9c9b-4e91-a5e9-e82d43b6395f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37657964-750a-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698439723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439723, "uuid": "1deec3c1-b0b9-4114-b64d-10c5c7b11a02", "comment": "Malware payload (Mirai)", "value": "4c87f6f3ef374b8d56b51fb848f9de2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439723, "uuid": "54d2be61-529f-41fe-843e-18c974639f53", "comment": "Malware payload (Mirai)", "value": "957ebda24acb9d25bffa65d5256f37df7fb85c4bef5b025be5d0dd9973bff9f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439723, "uuid": "56096691-6858-485f-9203-f5149e42bbee", "comment": "Malware payload (Mirai)", "value": "30f3e9a1ba55f180eb3d9873b60878bde4dc25fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439723, "uuid": "fc6ab10d-fc9a-4418-af9e-39c790b7a720", "comment": "Malware payload (Mirai)", "value": "2600741056ac879eb07436dd9e2cc4721b08dcb96d6babb48829d0b90cef9c4e28d610b2a336a36477f842c4b07cf76e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439723, "uuid": "6d38fc1e-f83d-49ce-afce-6af4ef3cc8c8", "value": "T192538D75D12DAEA8C0424AB4A9598E704F13A0C046732EF7DA9587A69443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439723, "uuid": "5829cc6c-ba85-4631-b682-80b625c4fcb5", "value": "1536:zag/Vdf5F1LwtkbaOoQ3veifs3guba/qzCEZaCw:zJzf5TLcQfPf+gehCEZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698439723, "uuid": "8b75ff98-69a5-4b15-b0b8-cfe78f41bf15", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698439723, "uuid": "68f63b40-9b2e-4122-83f2-b0996dc792e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439723, "uuid": "b43b36e9-7768-44d9-a2b1-579cee18fe0d", "value": "4c87f6f3ef374b8d56b51fb848f9de2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4605ed3a-74ce-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698413978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413978, "uuid": "e12caaaa-8e5b-4f88-b3db-71a018dc3cc1", "comment": "Malware payload (Mirai)", "value": "b9f77c5e8689db69dd4c478d30b0f438", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413978, "uuid": "7f27f7b7-1756-4c59-b41f-954ca7b96a8a", "comment": "Malware payload (Mirai)", "value": "95f3face19038e02fc8d5be8b2cfece75b1e4a5407afa866217855b6ec54c7a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413978, "uuid": "069ed973-3e7e-4912-8c44-d88a3df83296", "comment": "Malware payload (Mirai)", "value": "934da7a6b8300835a35f07773f643a6934f65164", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413978, "uuid": "8779b837-4575-4a85-9d90-f6eb63c6b4c2", "comment": "Malware payload (Mirai)", "value": "52ca3b72febd0e9a28e68c0382564f67ece8d9f3b954a97c3f1bb7bbd0708e4e68b9759205dc6f95fe7eeeeae2647d28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413978, "uuid": "851a30d2-e57e-4b44-a169-01810746bcca", "value": "T101D2D01CCD2E7944C69D3EBD90DE65F63448B480A369EA8E1666C418E717E4BFC1B0A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413978, "uuid": "719760fd-0510-4a56-87d0-5f1dcc7fb4dc", "value": "768:z1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KN0JbbWGPOB:zbDs06t4BEub4sU/MbU0ZPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698413978, "uuid": "d120decd-ebac-4cd2-bc65-0757f4f381be", "value": 30548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698413978, "uuid": "5da633e5-35ac-4fa3-9289-15b77eb73390", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413978, "uuid": "c07a7999-65eb-45ad-a9dd-83e03ac3ed31", "value": "b9f77c5e8689db69dd4c478d30b0f438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3379d155-74ec-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698426831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426831, "uuid": "1977b869-45ea-46de-b1db-7bc2d4ae2c62", "comment": "Malware payload", "value": "0f7cfd3410d3656af64fd28bb3edb980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426831, "uuid": "128b91df-573a-4e04-a221-e29a262e7120", "comment": "Malware payload", "value": "9602d17014b9c1e507d88bb95d61707b87ccc8bbf6ae28076326d040305776a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426831, "uuid": "be3066e2-4f79-4fb2-b4e1-50dfba2964ab", "comment": "Malware payload", "value": "39bbd5603ca9683979f8077dfc3f97ab38974c5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426831, "uuid": "d106c1ad-25e9-478c-8a85-371fa4493de0", "comment": "Malware payload", "value": "3d0b939c5a5809ed0e10967e975f26982ec0e1fad202c3c2a959127263ea14b3ad3d65c72dbd786813590d90c69dbff7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426831, "uuid": "50738929-aa7f-4fe9-9f84-c632cfbc9679", "value": "T153359E3138C09571EEEA10B742EDFB2982ADD6A0071556DF76DC16EEC7606C36B326C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426831, "uuid": "9e0768f4-e997-4a50-8c6c-2718f5b58be5", "value": "d880d0ae07cf434dea838358ed4c863f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426831, "uuid": "871e6009-3b7c-442d-9426-3d1aed95e7b6", "value": "12288:46ygL5y6zHWdgAw/26p6LT9LLnM6GbSy9opulOdjlOus8Fr4bI0iqhfGdniG:0C5yqHWdgAw/26p6Xy6GbSROMh4F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698426831, "uuid": "dc1c0e09-e37a-4ebd-af5d-cc5f5d8eba21", "value": 1122816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698426831, "uuid": "ebae4b7d-48d4-4853-8daa-f9fad3f6c121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426831, "uuid": "26d7c668-9ba5-470f-b731-b1aeaf70c39d", "value": "2LU7635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260395b5-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698422084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422084, "uuid": "94fad5f4-e44a-4858-88bf-5a6e720c5133", "comment": "Malware payload (AgentTesla)", "value": "bdb8fe4e46b5391e922c8891f0577f29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422084, "uuid": "c87e0d45-1caf-494a-acab-5bae5096e1d9", "comment": "Malware payload (AgentTesla)", "value": "9796d0375e5f16703f8dde41e915b217bcf2886d285c22971aeadc7ab71197a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422084, "uuid": "5b962142-f5f5-4099-85b3-47be9cb2ebe8", "comment": "Malware payload (AgentTesla)", "value": "57f6ce2d4129c820a048692398d9c7ed54dc7879", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422084, "uuid": "36a948e3-e07b-4b49-a778-b3ff0f646515", "comment": "Malware payload (AgentTesla)", "value": "e2b251f0ed21c6044571cbe91b4f8b007f64baa57792648ab665d9bc4c1ca6639e3547ff43322b0dd591f17aaa930fd6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422084, "uuid": "708de6c3-8476-46af-9295-d3879fb160f3", "value": "T153D39B526BEA2108B1F7BA88597A11344F2B7CD66D7DD54E05CC2A4D0BF3EC4C860BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422084, "uuid": "46948f66-46e6-44df-ad85-36a75fc10b74", "value": "1536:F+JMH1e4Mi3mI2hb7KZ18C2NGkikGkFjGkikGkKEt0eEKU+kCKGWGPrbrbTDDpO+:C0eBQFJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422084, "uuid": "d6610af4-e9d1-4af4-85a4-398061318cda", "value": 140102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422084, "uuid": "2454bb1f-2995-481c-b70d-5134e67f37f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422084, "uuid": "15ce4777-6046-4edc-8672-9beed7e4c784", "value": "LPO PO109913.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c1338d-74bd-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698406562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406562, "uuid": "7486e00e-9cad-47f5-9048-ac52db8f1b9e", "comment": "Malware payload (RedLineStealer)", "value": "c29f728db90d9a1ac842288776e6d13e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406562, "uuid": "82be1a26-379a-4a21-9fa7-cb69c05b6070", "comment": "Malware payload (RedLineStealer)", "value": "9856a3f642fe8b44230b453100df51a456c7f4f27341fc02b2039283cb8cc946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406562, "uuid": "6a72ed9e-201b-4a80-864f-037e0f9b33da", "comment": "Malware payload (RedLineStealer)", "value": "f2453cb14da315eb654ca0026516111c600509ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406562, "uuid": "512a579c-439c-4887-8869-e8cf2ba13b31", "comment": "Malware payload (RedLineStealer)", "value": "b401d1544a68279864148a54c5e4c2273547e27aa474d102d61aadfd8fb4bcf157a4e20a0126c6c768842aeab3c5035a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406562, "uuid": "79930bc1-df63-41bc-8cb8-bd0c09d11ea8", "value": "T19F752313A7E8E275E8B42BB268B706831B36BC934CF0567F1540DD4A4DB3981A57232F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406562, "uuid": "20cc04c9-5073-4653-a194-7be562a90bd9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406562, "uuid": "0071aff7-cbb7-4c7a-8aaf-bca52f7a6b8b", "value": "49152:nkWM7aal+V+Jj8XzeEuO3yyLc5CtO3V0yW1mxa:k3g0wXyu3yyJ6dX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698406562, "uuid": "406af62b-396a-44ff-90f3-25a4de6f103e", "value": 1633280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698406562, "uuid": "c8eace48-9c8b-4f86-afab-42080bd534a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406562, "uuid": "c067b8f5-8401-49b2-bae4-09d8290def55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199e1759-7521-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698449551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449551, "uuid": "932996cc-ef58-4917-8dce-8273daaa23f4", "comment": "Malware payload", "value": "f53345ca72d38729418bd374235b3c85", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449551, "uuid": "477c0433-fe3c-4291-990a-015a56809d78", "comment": "Malware payload", "value": "98fd865d11103fc4c053105e74c52957491bcf3f3964eeb52b8d67e535d07fe8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449551, "uuid": "b71c9aed-f2c8-4e6a-bd22-0e3ca2bf1037", "comment": "Malware payload", "value": "50c8fe712c8b643bafb22392ae4c890af1c54760", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449551, "uuid": "8b4e9acf-bbef-489c-9433-b3760ee38313", "comment": "Malware payload", "value": "f4c46689760ebe3664dc1d5d8f64f1637b6cc14428097c6d597bd1f5ec67d32e5859f378e3a527fa1d26a5d662f73e51", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449551, "uuid": "ea932510-3459-479c-a970-77de89d3fed3", "value": "T19343851E6D168FBCFB59863447B78E219A5833D627D1D642E16CDA002EA034E741FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449551, "uuid": "e490a69f-9b2a-42a6-adb9-581591443121", "value": "768:bvaLxUxyQpPT5rhmurrFtSmSnoh2Lt3ug+31IZi0e4fyMnup//dujgtywJz:bvJFP1PtkF+31t0lk16gtLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698449551, "uuid": "5f6ad44a-82d8-4d7c-a40e-bbba5a0c0388", "value": 59768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698449551, "uuid": "f9bacb8d-34ca-469f-bae0-956809dacc78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449551, "uuid": "81321a05-d1df-4c42-bd5d-6ce527a1f0c2", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505abbf8-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421726, "uuid": "0841a496-0b82-423b-b42f-a9f622e71452", "comment": "Malware payload", "value": "26fa99146c75be50a081dca2ee36d562", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421726, "uuid": "fb2f1f50-1473-4463-af5f-1d96b37c05ac", "comment": "Malware payload", "value": "9a24a5dd9dfc460c7a30c7b6c659172180b1866e1c1eb637f3850d5ce0bdcee3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421726, "uuid": "14a5a65c-ed6a-46e2-92fd-a9b94a1bb4cc", "comment": "Malware payload", "value": "cd8621b4a8a0349b3382319be6ae41623e310612", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421726, "uuid": "978015c7-30da-462c-8b5e-26b5bab46604", "comment": "Malware payload", "value": "5becbe5f339cd55ec4683a6ac3c5fb7cb2b37b84d705aaa5b9cd3fc2cfe3661a35f2d41b7912cff0e5e4ea409c958410", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421726, "uuid": "15b39860-5a23-4bf2-8d05-84a5917e8d67", "value": "T1B8F1DCF4EB45EC375CDFCBBAE540DFADA152C23191C5321B23EAEA8B8243D86815D494", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421726, "uuid": "6d4f7323-fae1-4ea1-8ce8-2a9f92dbbcbc", "value": "96:Cmlo3lyPrRYB2LYLno9RM3CA92SyPrRYB2K9:C4o3lyjKE/MSA92SyjKj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421726, "uuid": "e4e94d7e-9239-4118-9c0f-1c26361e453d", "value": 8004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421726, "uuid": "f08e3332-61e4-474a-9936-83f37cf7dad6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421726, "uuid": "2dad0cea-eb21-4a36-be5e-fd1406f42cfe", "value": "PDF200309040902.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c383ae-74d9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698418886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418886, "uuid": "b1a10e53-49d7-4261-a8ca-3e079917c9ec", "comment": "Malware payload (AgentTesla)", "value": "66ec89e53c71c478001e4ff67201e912", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418886, "uuid": "9fa290f6-7cdd-4cda-99bb-ffb46f26f8fa", "comment": "Malware payload (AgentTesla)", "value": "9b136db92b75e20751e10345853beaa2077338ff657a3fbc221933de1eb69680", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418886, "uuid": "8021d62f-d330-47bd-9884-3fa8f5b0d3b9", "comment": "Malware payload (AgentTesla)", "value": "1e1182242d9990d5fe2857fbe6b32ca7ed3cdf50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418886, "uuid": "aaf45a89-3157-4aea-a332-bc554b928565", "comment": "Malware payload (AgentTesla)", "value": "4cfab4f56d8868c378c0803be994a5911804dde173dd5e97b343ab2c6edaba1f9691f768daf9b31ed04a9d62b2e8a932", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418886, "uuid": "9e5423b6-4094-4c5c-8ce9-87cc054f0dc3", "value": "T14914F21E726AD81AC063557A4ED9C5F7170CBCA08E52870F3540BB2E06B7983CB9B76D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418886, "uuid": "bc635e0b-a0b0-4e48-85f1-1af7fd215139", "value": "3072:tTgyvcEEmzcgBbq3MesTNI8UoGoIZs+DPdAuPij4hc9V29:dg0cEEmzcOU6B6t5bDPdJs6OI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698418886, "uuid": "3e180538-c594-4dbc-b766-929e016bbd69", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698418886, "uuid": "606bf1ea-b319-4b09-a0c6-f5bb11a1d551", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418886, "uuid": "eab744ef-1996-4e9d-8268-247426bed2e3", "value": "MOTORTRONIC20230509-1.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d156f9-74df-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698421438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421438, "uuid": "f97d9397-0a1a-4baf-97f6-5b8ba6378136", "comment": "Malware payload (AgentTesla)", "value": "da0909cd9832770242737f37f733e04d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421438, "uuid": "e3f200d9-fa41-4c7a-8f53-0670384c0b5e", "comment": "Malware payload (AgentTesla)", "value": "9d01b1cc324d3aab6509ae533ee07506a46e73094cc72f3024804c3fc18e2bbb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421438, "uuid": "5bebb00d-df8d-4bd8-939d-6319c1ce4e44", "comment": "Malware payload (AgentTesla)", "value": "3967cda77eb86055f592f853002d5db8e2b9a08b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421438, "uuid": "fe057dee-2517-4ac4-a425-d06980cabe0f", "comment": "Malware payload (AgentTesla)", "value": "4bb531d4afe7715cbbd778d81df70da03bc2cba03d20af8a0a93d813e8337a61c06ba1db5596d25d4aa280cc5549707a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421438, "uuid": "4fdcef35-9fdc-4c6c-a9ce-60e7bb3efb1d", "value": "T167336CA1EE95161A8D0F27CDDC814841D2BD8029383601A5BEED03CDA20B99CD77FF9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421438, "uuid": "ffa7f129-841a-4ebb-830f-6fddf776b1eb", "value": "1536:s7iXS3v9dY1gOaAwRB2V6Kt52FTx8y0kFj0:s/1egOaACB20KtST+yTFj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421438, "uuid": "59e5c812-b76e-4e6b-9e10-b09dcd832d3a", "value": 53670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421438, "uuid": "6a9bc032-ffd3-4191-b42b-3597140eea56", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421438, "uuid": "91794c6c-0666-4e21-8aa0-8026c9c1e2e8", "value": "RFQ20231026_Lista commerciale_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6401a8-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421716, "uuid": "afbd9008-6941-40d0-8ba9-61089f0740c2", "comment": "Malware payload", "value": "5ba137cf483a9175539d7a1f3d3d1df4", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421716, "uuid": "01aa441a-51c6-4072-9951-6d3f4df1b9cf", "comment": "Malware payload", "value": "9d9269b7fa71569743924f6847f4a77eb13ff8c3a357fbd254c3c221958933ab", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421716, "uuid": "2b4f968f-1975-4353-a3d4-bb9b12ef18a5", "comment": "Malware payload", "value": "64e39df2eec3ac26e4762f0626c9ff79c6219d7b", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421716, "uuid": "528b8da7-b82e-4a2c-ad30-24329bb47708", "comment": "Malware payload", "value": "f1a9b5fcb27f5127a878d65be1d55336a6dc300581cc7cefa8e5b13e769c3ce45dd0565b36876243a6bee581866ba914", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421716, "uuid": "e379c548-6b95-492e-90b3-68bad4bf4344", "value": "T147F433E5D580C295CBF826ADC00269F66B6D3F83A98F40F111F3826663767679A7F10C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421716, "uuid": "7c45867a-2fdd-40c4-87cb-81978861eada", "value": "12288:iG0dnqBsiH0Mgaf0mn3WQuarCcE/AweR4lsIdCUU23UOc8bLAJZ:X0dnqIM90WWBaTweR4uP30UOrQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421716, "uuid": "495235fa-dfbc-424d-b8b8-1e87e34c8bc0", "value": 724252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421716, "uuid": "28bbe9ce-2cb1-4b14-9ee8-f7e8e13dd96a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421716, "uuid": "c6ba58fc-a56d-4468-bfa5-211a613d28f8", "value": "Novi poredak_HR-WJO-10-26.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4166eb-74df-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698421207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421207, "uuid": "00cd6c02-2b05-477b-a388-a80e93fa17c0", "comment": "Malware payload (AgentTesla)", "value": "ad0080738beb0f1c978ebd471e918ffe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421207, "uuid": "5e2964ac-0bf6-4941-9299-18cc49e182ee", "comment": "Malware payload (AgentTesla)", "value": "9ed555c344789d67c554ca9f0d159113a587f9986e30f981942707d6fe46ffef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421207, "uuid": "511322a0-faec-439f-b05e-6a92f6e87d51", "comment": "Malware payload (AgentTesla)", "value": "cbf08426bf786016bb1669cfa91433b65558f246", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421207, "uuid": "a7156d01-af91-498c-b3f5-c8b15cc19e22", "comment": "Malware payload (AgentTesla)", "value": "9407bea978d87dfb7e06e155734802d38d11dcb3677f7e6a622c1488254bf78f01c06cda7e9b609715116c3b8e946f03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421207, "uuid": "5ac18cda-ccb5-4686-ae1e-cb75382ee06f", "value": "T13E340E03BE48EB15E5A83E3792EF6C2413B2B4C71673C60F6F49AA6524517825C3E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421207, "uuid": "e1a85818-bd52-418c-b8f0-ba7cd0166ad0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421207, "uuid": "9e5633f9-5caf-4583-879e-3f4ceaffafec", "value": "6144:xb/Zv3nffjLb44Hk5SrgalVqYVKpKx/QVaL:9Zv3nff/b44Hk5+2vKxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421207, "uuid": "9d70e850-4884-4535-bbbf-85b250f452ff", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421207, "uuid": "d9bac5b9-d9c4-4cb5-be9b-632a22de8297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421207, "uuid": "411d9337-21be-4781-b6af-2a84d5d1b731", "value": "169842120662b3844748bff8b1fa934e13db83d640105533c677dad0a577ab42035f547c11341.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e51f922-74ce-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698413965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413965, "uuid": "dbeea693-3d29-4831-a7ea-7cb79fa65b52", "comment": "Malware payload (Mirai)", "value": "fdb0d398c93d04cdc49aea01f5647a42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413965, "uuid": "7cc8bafc-67d1-4432-b1ef-f01847ef45ec", "comment": "Malware payload (Mirai)", "value": "9f4dc5614f1f64b4126d90f8bd97415ae0f23266aed9cc5d1bf6990904e3090b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413965, "uuid": "1aaf926b-637a-47d3-8377-5294cb290644", "comment": "Malware payload (Mirai)", "value": "d0b3b1f0a2000d4e2afdab01ada72a5b092b26b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413965, "uuid": "abef9366-4be5-456f-9709-bc6d1c6050fa", "comment": "Malware payload (Mirai)", "value": "2a49b1521ef2b99cae6ac32310967d2c778ad302d145b105e79d1c0e89b72970c45a220e68c87e65dcadbd32569cbfe1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413965, "uuid": "53c5169b-41a8-4f18-9dc0-ae5d9231c6bb", "value": "T15AD2E18875D653FACCCEC9BD771F002A70A9B5A166A2A337F306C8134776280F695D4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413965, "uuid": "14530b83-f718-4f27-9438-7f825f3929f2", "value": "768:UlxKd29WcxEns+V6IHE4RlY990Bx1rnzk9/:xd29tn+9HEw0aBzk9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698413965, "uuid": "3e08c6c2-266d-46e9-aab4-537b8d7e2cf9", "value": 29680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698413965, "uuid": "da07431b-ea84-4e9e-99c0-f4b6b900971b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413965, "uuid": "060f60e5-ff52-42c0-ab0f-caee353271f2", "value": "fdb0d398c93d04cdc49aea01f5647a42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805c17eb-74b7-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698404197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698404197, "uuid": "8e05471d-5902-4946-8424-f467633be1e3", "comment": "Malware payload (IRATA)", "value": "52e2440f059c200d7571f58fa584494c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698404197, "uuid": "159a933f-98d0-49fc-b146-c2a2fe8ad983", "comment": "Malware payload (IRATA)", "value": "a341c6ee3ed053c5fb45873272e96667f585209dd102a093212d3d5d632558f6", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698404197, "uuid": "5b74bbcd-7511-4554-a7e1-caf70d2efcda", "comment": "Malware payload (IRATA)", "value": "d1b928ce0eebab063cbc0f0103ea6f9e0a75a04e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698404197, "uuid": "71d710d8-f6e7-4260-aca6-c8ffeccd6cce", "comment": "Malware payload (IRATA)", "value": "daaa7c148988ae6b0a54594dd2eb106147d386873d0593bc8b247f41910d97a89da876bd3a5ad06cb45f292d5e8a2a96", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698404197, "uuid": "29514f24-7b0f-43e0-9b22-8afc37e41ebb", "value": "T166D52383F271A46BC8F6D37261742A3554B64D55DB43B246762833FA24BBEEC0B807D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698404197, "uuid": "0b3c8e78-216d-413a-98d9-8f22b36883a3", "value": "49152:T/6EtHou52ssp6UyQDiifU2jKH/3ii6Q76B+ZkqNY10jmNe6i+uXFqjB1nnvxfz:76Go5eUyQDXjKH/SiT76EZkMYqD+uur1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698404197, "uuid": "95328f6c-00c1-4201-aec9-b5e599f34f3f", "value": 2834562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698404197, "uuid": "642c89d0-70a7-4fad-84a3-132e816af6a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698404197, "uuid": "df70dd41-ee64-461e-a765-0cdc9827a6fb", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec56fb25-74ab-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698399224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399224, "uuid": "da5f46cd-229a-44f9-b9bc-4eb8d6920840", "comment": "Malware payload (IRATA)", "value": "bf231a9306cbf20bfc6c21b9a90045da", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399224, "uuid": "17ddf353-3548-4f8b-ac55-05af7612055c", "comment": "Malware payload (IRATA)", "value": "a3a268044ae7e28459b7663521d97f6b0c18f319c9f217bd6fa1cad3dec2e98a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399224, "uuid": "32f890d4-8636-4c6a-9b53-e6e3737a2d46", "comment": "Malware payload (IRATA)", "value": "7cca31424b1b4fc8644dd6fef21ea0a3e4469b5a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399224, "uuid": "ae8a69c7-8bd6-4739-af02-29a59e9fd669", "comment": "Malware payload (IRATA)", "value": "3edf8fec6c22cb7aa7f99e42f1150fded56badd4bfa84b9252c7d18992dbbd66d60405c47217c2cfe3dc1ddaa46fe25e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399224, "uuid": "1e025d90-e975-4386-902c-d07d4dcebf7b", "value": "T102851293F276B857C8F6C33621742635517B9C25DB03FA89388873B924BBDE80B856D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399224, "uuid": "df8f9bcf-2be1-4384-88b6-5c693303b2f4", "value": "24576:Hws6xxnq+OeOvjozgLGNNUVqIYMWClxFiDB5ySEV0KmK6mH2r/uB5RQU:HwsMXOjMKSuVqqvLFYFG0rK6C2DuvR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698399224, "uuid": "45026c4e-e9c6-49b8-b83c-8ea73b5da32f", "value": 1756120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698399224, "uuid": "8cde9f52-c93c-4c77-9333-fcbc0bb4918a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399224, "uuid": "e76cb7fd-2275-4c3e-bdcf-24af7766cb71", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c35d2f-74df-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698421492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421492, "uuid": "2db32de4-7a62-4076-86ee-80f56526b5f3", "comment": "Malware payload (Formbook)", "value": "4fbb009cb5d734a5f526c3cdbc650862", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421492, "uuid": "8e530966-77d1-45cf-9064-4510e416433b", "comment": "Malware payload (Formbook)", "value": "a3e89265c9a9a606c8dc5675055926944fbd877bdb8f72fb12d4224d0cdeb788", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421492, "uuid": "28e828cb-c008-4225-9c69-b5614857b4ea", "comment": "Malware payload (Formbook)", "value": "05b2c3cd0afc12b59f657ee3d5e5f573049a1428", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421492, "uuid": "26893bd2-094e-45fc-9cfd-0631651246a1", "comment": "Malware payload (Formbook)", "value": "3ab5d4a84a68b51f3460dd6183aef3054c37a56da3eadb0737c04ed8fb38cf9411eb992c5feba3067595763a44adc3c0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421492, "uuid": "24e70d56-4b62-4574-89fa-334a9afa6b21", "value": "T1F405E11AB696DD11C1685A33C1D761148B71DB929227EB0F39CA37950E033AFEC4A7CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421492, "uuid": "e2d9a941-f918-4700-8f41-b5f198f3ede9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421492, "uuid": "033bcb34-eedf-4e2d-bd5e-deaaa1cba0f5", "value": "12288:HNPzxyzYys2iyVFFpvx48OMoBKes8GtUVo4xhDDnNtdRRfMr8DZZ2pt:8Fp5fOMvhjtUO4xdNtdrK8DZZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421492, "uuid": "2cb6403a-a723-4396-8e6e-96fe7d9e64bc", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421492, "uuid": "03b55b5f-99e8-484c-aabc-b339b96c144c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421492, "uuid": "f9d96465-984e-4c38-a963-106d9b4c4a25", "value": "DHL Shipment DOC_AWB#20905829822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d4fa9a-7493-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698388644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388644, "uuid": "9abebc69-a0b3-401d-93b7-cea9127e2cdc", "comment": "Malware payload", "value": "c797e1fd29f4bf77bd89605fbc3147ae", "object_relation": "md5", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388644, "uuid": "351aae84-da3f-4e6d-84a7-f9a5d969c250", "comment": "Malware payload", "value": "a4d8071b2250176b7a52b0250896c082e860f7d36cbdd8b71fdbdf16a41d3f19", "object_relation": "sha256", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388644, "uuid": "fa6b46a1-fb52-423a-8b44-f78827632704", "comment": "Malware payload", "value": "c5f4b2bd465b1ac1314a2a60794ab2d27cbc45c8", "object_relation": "sha1", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388644, "uuid": "b6f8dcf1-44eb-40aa-9650-4d0a03a4a1de", "comment": "Malware payload", "value": "7556c1582464aa192a944b0312d10a0d826171f9893c1891d19537171f84aa7466ff8b4babf5dcf5d5b10d852136df6a", "object_relation": "sha3-384", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388644, "uuid": "9a7de5c3-a4c0-4588-b3b3-32eda9b94e84", "value": "T131E4337FF185E962AC344CB9B3C3529200966E1635A1C86F656B75C4BFF301ACA37AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388644, "uuid": "9bdb5ace-6d7a-498f-8b15-f8c76b641d65", "value": "12288:WiSxbCu6hoGvzMmmxYrtBYMgofKxNtyKDR8Ooe+HN9aL/+qoXQ4VmgUoQ+pEr0:RusHvDgYprC3tHEleLLuYgdQ1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698388644, "uuid": "c77152cc-c374-4ffb-b76d-617031d222a2", "value": 716705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698388644, "uuid": "afe2e62a-d8d1-4204-b39f-13281db40b91", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388644, "uuid": "715cb371-e7b4-464b-8cf4-de1840f85c6b", "value": "PRE ALERT NOTICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6899a7-74d9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698418929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418929, "uuid": "100e1448-7a57-42ee-be84-3c2bfb3c2e90", "comment": "Malware payload", "value": "eb1fc53e33520266896af46f00c11690", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418929, "uuid": "428d120f-2b06-4dfb-bc3a-4bbae7e714d8", "comment": "Malware payload", "value": "a59a677e0459654ead32dd4b38069c9ad97c2094633ff144dca5b51bf6a64d8c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418929, "uuid": "fe047f48-44c3-4eda-992c-5325a5e673c4", "comment": "Malware payload", "value": "4903567a95f328a10125f0e0d8c59662d08d1324", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418929, "uuid": "1d7f59cf-03d8-4da6-ba78-114442e97dfa", "comment": "Malware payload", "value": "6924cf17492d06fcd17cf0219a002ebcbb53eeb25085885d7898bb852425fb6a108447f8b1cbed47914f9ae88d602213", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418929, "uuid": "48397a19-2d60-48c5-ada5-f3907fe998cf", "value": "T18D452342B3E4DF06F16715326873C211A0B9FC5DAE90921F71613B2F2875A7196A33AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418929, "uuid": "7d811092-9cce-4bbd-b4da-c18d0ce823c1", "value": "24576:gpexIQAeImy8+dhOLpxvGm2s2x26cwsaSkALhaYOQa9zCegkd7bbcePFG:gdQAlmy8whO15Gm2gwsaSkA8YtyCelbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698418929, "uuid": "8c84af0a-fcb6-40bb-b8e8-87c00e0dafc3", "value": 1264640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698418929, "uuid": "b2a6c3d6-b61d-4587-9bfe-3113ff824e56", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418929, "uuid": "69dbd9c2-bf40-4c33-9b9d-8da44767f22b", "value": "I-05a20231026 161132.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c466321a-7501-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698436094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436094, "uuid": "6e0fc42e-7e8d-4c8b-95de-a0f785443e6f", "comment": "Malware payload (Mirai)", "value": "1fe4005e9df7011c3f2916c30188306f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436094, "uuid": "c1f0940a-7c57-45f3-bc7f-e7830b926497", "comment": "Malware payload (Mirai)", "value": "aaa02814fa243691ff74512902570ba3ed03bb2ad8c3c1b28a0693f16d047895", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436094, "uuid": "7e20429b-ae4a-4a9b-93cc-8920f6966543", "comment": "Malware payload (Mirai)", "value": "879380db32463b5c7e2c2d4a54c570ee3c56370b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436094, "uuid": "53057800-f59f-4172-9546-ac05f7025791", "comment": "Malware payload (Mirai)", "value": "50f84d0aca3dd12b511ba48f2a25e893bfc6fe0fecff4776a37a65732a41733a21fe3d96140b7829a2a5a6dcb7c9ce8d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436094, "uuid": "864afd81-6c08-4cff-8c09-e664f8ae4c59", "value": "T137B2E172E1463E62CB70213A697CCB0157AB96F8A4EA72753124F6AC4BD2C4B247814E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436094, "uuid": "0a24e95c-296a-4b27-b68d-28a79f0ea7ed", "value": "384:vZUX11S49enZh57fYONQ/yQVQbFxD+ckPvDxqSwPzMvdjnhymdGUop5hKN:yX1De9kONQG5xD+jHMDzuLs3UozYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698436094, "uuid": "6914ced6-aa33-4978-a1f2-5f967298b3df", "value": 23732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698436094, "uuid": "9fcf154c-6b60-4759-a2fc-e9db8bda0b0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436094, "uuid": "4bfe8789-d1a2-4dcf-81e3-57ba081ccb0a", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff465581-74ec-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698427173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698427173, "uuid": "60e5a3d4-08d9-47ba-ac07-a2730e3724ae", "comment": "Malware payload", "value": "70792fb6a70bfece0699465eb519821e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698427173, "uuid": "f2fe3561-5b33-44a9-b859-d6e7129270da", "comment": "Malware payload", "value": "ab43dea67c9306a8a94a3db7859d5807574a2089eea4d4db575fd2c5f157cd9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698427173, "uuid": "1e6f7189-57d6-4cd6-ba63-c92265553d73", "comment": "Malware payload", "value": "49b18409c7d430078df118ca240aaccaf6ba557d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698427173, "uuid": "56305b0d-3e6d-4424-ba86-7805c25b68b0", "comment": "Malware payload", "value": "fc1d154586af3504afccf20cf6ee9a949b6d6b541a3673ba7f6ad75b0436c5ab0e605c11c5f4cc3a4ed70c3de9ba2323", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698427173, "uuid": "9c2e51b4-f489-4e95-95dc-2dd689d4fc64", "value": "T1C504AF01F6E180B1D437187909F1A7B0AABE7DA409EE4DDF87CC0B7E4A2157CD62257A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698427173, "uuid": "7593c22e-7b1c-4452-8e76-3fdb8d71f3b3", "value": "120fcd59b8cf88c88d1af5610e72d569", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698427173, "uuid": "2d9cc8d2-bcbd-4731-aae4-2b53b066ba0b", "value": "3072:BiA6dj2OGfZH6VpZkblgnqqSsqRLAHlvEviDPjwEt5MjLOhEZQGFpAdPCZo3824f:U92Oh+beqqSPWFveiw5oECGfoe28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698427173, "uuid": "3ce62505-5050-4a53-a640-c9188b371f6a", "value": 187777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698427173, "uuid": "5cf52b00-dbe7-4c88-93aa-e7608ecc2994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698427173, "uuid": "4deda3b8-62bb-4c4a-a958-aab792bc8455", "value": "6UW9Po5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7228bdc2-74ec-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698426937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426937, "uuid": "d7573cd6-ff6e-4afe-87be-18bc0eabcd65", "comment": "Malware payload", "value": "976cc29119f006dd7152e5d11e5b359e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426937, "uuid": "53b2b9ba-c6c8-4992-9e65-9a872ea94bf8", "comment": "Malware payload", "value": "ac9164d42a28408f3785db154b19f04f29cce3e39b404af07a8ce5d4751f967e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426937, "uuid": "a714d0df-9645-4014-a990-80dd4359f620", "comment": "Malware payload", "value": "14039a86f36b3e0b15d62d237f4943cd7f2c7277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426937, "uuid": "b9b97bb2-1a85-42c4-ad48-ded557d75687", "comment": "Malware payload", "value": "ebb2174cd70db3012e9153d62d6534e8c5ab895a0cc80fbb458a00326d9ad4aed5b3968f30045c3c63e1a715756fdaaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426937, "uuid": "1ad7c322-9a35-42c8-be74-c606e4121353", "value": "T17C936C41F3E142F7EAF2053100A6722F973663389724E8DBC75C2E529913AD5A63D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426937, "uuid": "bab834ab-5d57-434f-9554-d8eca8baef6e", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426937, "uuid": "016ebac1-fe3f-402a-808b-b55d6c8f3d5a", "value": "1536:f7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfUwWO:T7DhdC6kzWypvaQ0FxyNTBfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698426937, "uuid": "b7661682-3aff-48cf-907e-3a541909d072", "value": 92187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698426937, "uuid": "e9d4ec3b-fe80-427a-925b-5f263ccbe9b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426937, "uuid": "5720010c-29f2-46ed-ab7a-8f068e69899a", "value": "7FN9uZ53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50232b42-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698421726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421726, "uuid": "3fbbd062-b8f5-456a-bda1-60788c7c17db", "comment": "Malware payload (AgentTesla)", "value": "2026a193cf938258c8b284f3a5ef3095", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421726, "uuid": "f50110de-af64-4a1d-8de6-3d566533ce8f", "comment": "Malware payload (AgentTesla)", "value": "acb082e436026a410f0b67b07eb9a49539a4592cc2f859bfb6e4454c9dd20ef3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421726, "uuid": "103a17a7-19b8-4b33-a100-692d5b26e9fe", "comment": "Malware payload (AgentTesla)", "value": "cde426d2745ed3b80b5f0d9f92d99ab499065a30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421726, "uuid": "d2ad02b3-8f57-4414-80ea-01cbc8cdd39b", "comment": "Malware payload (AgentTesla)", "value": "0b4deb323146d41067216776eebfeb1fc688639f087b8bac52ddd1ec4a56509fc160f1eaaf6e69e9b45d90ca082ef54f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421726, "uuid": "593cb33f-052a-4c50-8671-01638a64cb4f", "value": "T16DF4235FE15293BDE51E57B3884000DC02F5D3B93276D36B38AD5A68E3E9C1C63EA984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421726, "uuid": "82c8601a-b0ba-415c-acd6-274b65b17ccd", "value": "12288:ZenWSRMUyELXQA/pG8jfZs4g4AjCitAXNWEHCxkIfFJ31w6vGhA7DYVgCQrr50nS:Q7MoLQARRV/AjCjXkfKAJ31fGh4ygCof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421726, "uuid": "52d36b4d-a193-461e-a33d-e9bb1cc4de20", "value": 742692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421726, "uuid": "f05fef32-fdff-42bd-9056-9c484a304f05", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421726, "uuid": "258ca74e-63f5-4f1e-bd8d-63315e692ed7", "value": "RFQ - 231067 .xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c403e27-74c9-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698411868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698411868, "uuid": "f7c7f45a-f307-4ebe-b9cd-ff42ce4e56d4", "comment": "Malware payload (Smoke Loader)", "value": "8c6413372c7c55a063c9bbd0ed5570d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698411868, "uuid": "4503aa41-7a5b-43d4-8cd0-a1d4dbea2046", "comment": "Malware payload (Smoke Loader)", "value": "ada687d54c14b26911b5f37cefcea7568d6987c5aa24a546a1d36840182cb3ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698411868, "uuid": "aa1c9232-27a7-4590-8a58-de70214f12e4", "comment": "Malware payload (Smoke Loader)", "value": "9a16bcec445bb80d1b8c236870f2350a49ea9036", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698411868, "uuid": "5bebbf50-8177-4a39-a9da-487d99b0ae74", "comment": "Malware payload (Smoke Loader)", "value": "2a317c26013a2a2cf4633d46510cb5f02e0c2e190de0e627e82e439986bd6d7872139a5e5e1fdba717ade3f0aa3911f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698411868, "uuid": "d57144f9-3649-4a89-82cf-4ca64aaf42e6", "value": "T1E575239B3AE95566E4F127706CF607871D35BCE0ACB4C3A61B42E64D09731C4F932B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698411868, "uuid": "c7bf92c9-deaf-4d2b-ba72-58c4831b80e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698411868, "uuid": "aae7e8ca-eae5-46a0-be9e-b5001581e0f0", "value": "49152:+62PHj3vuOdEnWcmaGJd+UE9prRXdPHd5:/KDvLEpmaGJd+UE/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698411868, "uuid": "c4dd66cd-3401-4535-8fd3-44a609081674", "value": 1626112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698411868, "uuid": "8283a510-8fc5-4b4f-8edd-0f55f69c166f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698411868, "uuid": "8088789a-c443-4256-9b03-80ef23c819c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc33bfab-7500-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698435758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698435758, "uuid": "4c60557a-7646-4110-9178-1480f0590610", "comment": "Malware payload (Smoke Loader)", "value": "093153ad80ed08c92c000853b32dd051", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698435758, "uuid": "55e2dcc2-38c9-4e98-918a-60316738d375", "comment": "Malware payload (Smoke Loader)", "value": "adb6d89cae18f5501ce8c7e25a22de907bec44d74f583f9c5b2499a5e955534b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698435758, "uuid": "1f6c8ae7-ad7d-492a-af6f-01e3dcdf72fe", "comment": "Malware payload (Smoke Loader)", "value": "515ba6b3a388dcff62beb21d1af02975b4dc3dc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698435758, "uuid": "6b664075-3e38-43be-a2fb-d40fdc6e2a57", "comment": "Malware payload (Smoke Loader)", "value": "ee9a2eb9bb5c6f2469458edfe7bccdf4bf4c1a55cbb73e28bf3abf8dfd39cc69df2a9df2837ed9e948a5f17e21b184fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698435758, "uuid": "58914ef7-5a53-4520-8174-3f7ced6b9917", "value": "T187D6F174ABCD648BEFF149F0D256B631F9EE38801A1A75993C175CE8A872330DD152AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698435758, "uuid": "af09722d-141e-4cd1-977d-446f48613eb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698435758, "uuid": "b4919005-059c-421d-af59-45d2fb31c300", "value": "196608:hkRp4NeNJVqZg719pODjTvNpbegdfXxOy1N6Hnygxmf8NOj0Rp3Cl:WT4mVrhT0TvNrf/HeH2j0DC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698435758, "uuid": "5b50b5ac-24fc-4fae-9174-05f097bef0b6", "value": 13023232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698435758, "uuid": "e29e7453-91dd-47ea-94b2-53c684169a68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698435758, "uuid": "45e697fb-fd5f-4d76-b0b5-19430f784085", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bc1a33-7493-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698388905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388905, "uuid": "fdd30785-86dd-4cb8-a64f-ec074633b933", "comment": "Malware payload (AgentTesla)", "value": "1ec5a7cd2dbff3f5e867c55f10e25ca3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388905, "uuid": "08a5235b-a758-4f28-b16e-c6f8c9d1ccfd", "comment": "Malware payload (AgentTesla)", "value": "ae4df0469791475d054b855d85cd7fbae2b1a92bf75f276b93ce18150117d85b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388905, "uuid": "47843147-9162-4efd-9d7e-6ae339321ff4", "comment": "Malware payload (AgentTesla)", "value": "0449d27a5e2d098c846d981fec0e80b2a5271e93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388905, "uuid": "cd0a492c-cb7b-4a4d-bf4e-f8c9a09a33ea", "comment": "Malware payload (AgentTesla)", "value": "117c02217bd51d9edb9eb5ef0127634329de36fad58c7a1bceef8e5bff6d6b02f3baf69ea4324e1fe060e6e5684ba307", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388905, "uuid": "0b36c5f2-5708-40e5-9b7e-a84937cac610", "value": "T12AB42366CE8EBA4D71540BB2501B1209AB5D1EF9ECF0CC3536BBEE696485FB4812C4DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388905, "uuid": "c684876f-a2bc-419e-be28-0aaae753c9f9", "value": "12288:Utu1jPOpETkLbliIZM49W5WsawEweDZVez+KOlph:XSETkLbliIW5ryezVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698388905, "uuid": "42b4f7ee-e00d-4426-b8b4-f1b47a3a2ab1", "value": 525934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698388905, "uuid": "5a32ac07-9e93-4112-a8d4-023210f05990", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388905, "uuid": "3978918a-a70c-49b1-b638-f8dcf121bfdd", "value": "INVOICE & LR COPY.pdf____________________________________________________________________________________.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9d61909-7498-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698391033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391033, "uuid": "6845fc7b-2d76-40bd-b64c-061823813129", "comment": "Malware payload (Mirai)", "value": "e3d71bc62b03bcb0be42455e57d0fccc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391033, "uuid": "4de740f4-e9f7-4b08-a5a7-558fd1d8ad31", "comment": "Malware payload (Mirai)", "value": "ae8bf90f3f04814c4f1e740f814a1dce82e1ea3d2114c81deaa5217d231d6564", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391033, "uuid": "e8b193f2-edf1-4c23-b5e1-d2689ad61536", "comment": "Malware payload (Mirai)", "value": "d6a1b1a6b019fd311bb3c9a0ac81752a2fb9f1b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391033, "uuid": "30dfd7fd-a46d-43f2-9acb-7b49f2f47dbc", "comment": "Malware payload (Mirai)", "value": "b9b12e4b0b07bcd83cc6fde906460e4056480fc78dd6ae09050a7c62a18fb0f72729cb245a411b5c5eb139679131bdcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391033, "uuid": "27c2c0a2-ce07-440b-8757-7c8879e07bd1", "value": "T18C13F2FE7276463385F308348A564BC665CC1BB5E0683A7E46BC4C5CE662EC123BA167", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391033, "uuid": "13ab62b4-53db-4432-8b7f-21f98f4056d9", "value": "768:rBs2R+YsUEQ11tbWGb4zpi6JxvcYeK1uVSzzva90LIHEXb/xIzAjq3UIpL:iS+YlEQ11RWG0tTEYhS90LYqJIMEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698391033, "uuid": "8ce494de-a831-4f02-8bcf-f482b619bf3f", "value": 42532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698391033, "uuid": "8a24a97c-b59b-46c3-80d9-bdfaed62b590", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391033, "uuid": "e5ea41d2-4417-465f-82f7-860d8aa134a9", "value": "e3d71bc62b03bcb0be42455e57d0fccc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a8641a-74ce-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698413982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413982, "uuid": "4a8aa1af-4722-4c92-83c6-c23d69471afe", "comment": "Malware payload (Mirai)", "value": "772cf86a9953ba0e24712e1f117a49c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413982, "uuid": "62c342fb-f186-4d02-8307-4cf6041258d0", "comment": "Malware payload (Mirai)", "value": "afd26480450509725c2addbe6b879afc1c005b59606ebaca4e3abb0eb1f0dee2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413982, "uuid": "532e7acb-e7e0-4578-9f2c-53dbd0b09e0d", "comment": "Malware payload (Mirai)", "value": "ca083e078f6bbeaf2f6bcbbd36cab7f9c4a31414", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413982, "uuid": "6cdd94ad-7aa1-4fc3-8169-8ae1534aa465", "comment": "Malware payload (Mirai)", "value": "53f6048ff2d2dbfd79ed2c22e261ff91c803edaba4e688bc7cc51ae1b4f923b32ffd719320565634792eff51eceb46b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413982, "uuid": "d9b1c947-3fba-4d91-88f9-ee7042bdd612", "value": "T163B2D0D48A909707C1B07875D27C8B516A3F19B0DAF639272610D67DDA828A633FC9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413982, "uuid": "a2d90c2c-3d1a-473b-9c9d-9c2c430678cd", "value": "768:WaKQFH0rs3zWoDDRsjt7LB9U+B2UV3UQen7V:bK7rs3Kktsjt7IJUfe7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698413982, "uuid": "c9058530-dcb9-42e2-afb4-a1c5fcbc6af1", "value": 24672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698413982, "uuid": "fc30656e-ad8e-49db-84fa-105b2f3ecf99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413982, "uuid": "81a9c20f-c08b-4cdf-89dc-37809f44d969", "value": "772cf86a9953ba0e24712e1f117a49c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120b1f54-7521-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698449539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449539, "uuid": "7ca40b9a-8c2c-4634-8647-7a77f9ea0e33", "comment": "Malware payload", "value": "cc93779bd7fd17b2e0b2afffc84494a8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449539, "uuid": "dc46485e-7513-4fb6-9e35-6721285bdbcc", "comment": "Malware payload", "value": "b027460581afa1f811c6825c439141de5827755de60799d33e2c133f0486947b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449539, "uuid": "16798ea2-8339-4be0-b167-aaf254b3635c", "comment": "Malware payload", "value": "554c6893d2842bae71a28d967065bfdc2a18bed7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449539, "uuid": "5851ed9d-1c5a-4ae5-946b-a83c7b9af2ce", "comment": "Malware payload", "value": "72d0bf7dd93e801d4b107c562bf1a9583dbbed83762e18595f55017de5c0c2257aa7402ac0af92e0d78957c11eb69125", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449539, "uuid": "04caabd6-f064-4bd7-acb2-0d5887d5cbe3", "value": "T12E1318C4F553D8F0EC5A06703076EB365E35F1FA222DE553D3A5DA32BC82602E60699C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449539, "uuid": "f6fd6c71-3266-4047-ab56-4e8fd779409e", "value": "768:xMlB2zs8ssGfrRI6aQ2nEenz0q8uDOycM3U95VlVs:YYzs8ssGfrRI6aVnEeYWOrMErVla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698449539, "uuid": "f066dde2-3c0e-4a93-b2ff-1e7d5f0053d3", "value": 41776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698449539, "uuid": "2ac930fb-636c-4d11-a8bd-55315e9a1975", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449539, "uuid": "1271fdb4-c2f9-4c91-8056-b301608f928e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b3994d-7493-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1698388793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388793, "uuid": "eb325de2-79ee-439a-a82f-5913db7b945e", "comment": "Malware payload (GuLoader)", "value": "f13739d9508a87d03259133e9d39e159", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388793, "uuid": "08c60089-f33c-4156-b273-fc18e05f5f47", "comment": "Malware payload (GuLoader)", "value": "b0b9e19d4fc8e80b6815bdddd73a1d9b47fe856542da4663c9cd5cebd7ba2506", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388793, "uuid": "12111290-1a0a-4937-a924-ecca339a2c97", "comment": "Malware payload (GuLoader)", "value": "fbd2daac009f71ac89d2e9181ca84ec72971905e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698388793, "uuid": "0e80cfb1-86ff-4aec-90a3-c7ebb00f7a66", "comment": "Malware payload (GuLoader)", "value": "94f6360127478c506864e0db65a125a96d68dbc149f979bf0b64ed43156672627814baad7f229fa223d1325d85655a16", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388793, "uuid": "e4ab3bc8-14e3-4f46-ba5c-1462e884a2fd", "value": "T10BC423EA0B442D2562FEA5359E86061ADF62C8F2873D14666250F09EFCB7475F8237F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388793, "uuid": "77dd3082-2b20-4ad3-a732-613db8c6687b", "value": "12288:vaN/NPuqLnVXMHL/d7zcpHmlXSdCNvzPKk0y7BRM/BUbx:vwPfLBO9KmliA5zyk0y7Bnbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698388793, "uuid": "2e7d099c-5683-4950-993f-0daae39e558c", "value": 584342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698388793, "uuid": "c3e229a8-475a-4a3c-a5b8-378291294c36", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698388793, "uuid": "70fa097e-902b-443b-82de-941a616edb3c", "value": "G-SRL-OFFERTA65756737884495739578582950023Synsmand.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fd17f9-7461-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698367134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367134, "uuid": "e5a39463-da5f-4505-a967-ec7ef0beb5b8", "comment": "Malware payload", "value": "a2a88a2617e1c800fde4d07370e01946", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367134, "uuid": "89653835-0f7a-4aa6-a14d-8591945843cc", "comment": "Malware payload", "value": "b0d1fbe94c695caec879cd440e77c59a3d338f941978ee87bda2aab4caf377de", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367134, "uuid": "f6347f06-1e40-40a1-be87-5170e981b2d4", "comment": "Malware payload", "value": "5355175f862d8371742e13074fc5004a98f14596", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367134, "uuid": "1fbaa999-2ff6-48b6-881f-1693ad78384d", "comment": "Malware payload", "value": "82b8294b883486a8ed2df11219d56b4c2c70e95713a3941266889315b41c0c90eee6d84bf1056bbb8564a5359633107e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367134, "uuid": "30667bbc-67d2-4364-bc89-eaf4c6eb3670", "value": "T18274C528B5ECDC32C49CC93F0E97A7F8A572F8228D52854BA558975E2D3E1E06D32173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367134, "uuid": "39058048-5b5e-4e4f-b968-6a77b5633504", "value": "af2938a54b4b0469558e4d7cf91ba1aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367134, "uuid": "8b4fd092-df9b-4a83-964b-a6a25b43b3f3", "value": "3072:fSaP8coNJoskeH0YyYekqBGxt0NelM+pSdVe+A9Q1pl6YF7E6q8:ft+JWXx8X6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698367134, "uuid": "d3f9b2d9-8391-4ad1-b22f-70e72aea3ba4", "value": 356439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698367134, "uuid": "9b177757-02e9-47a2-a3c9-204a4435ded7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367134, "uuid": "7f7c707b-82bb-4aa5-9ce7-429a6529c6c0", "value": "SecuriteInfo.com.Trojan.Win32.Sasfis.25913.26190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833afbc7-74b3-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698402484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698402484, "uuid": "627457e6-195e-4f27-bcea-5e1111957d78", "comment": "Malware payload (IRATA)", "value": "955af509360b8540adfda731f751de59", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698402484, "uuid": "3caa0949-4d6b-473a-90f1-a85e1521060e", "comment": "Malware payload (IRATA)", "value": "b24adfcd5438d7efca8a4ddde212615c48aa79c331b14bd42e3c0fd1c7327b9b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698402484, "uuid": "dbaef918-33b2-42c6-b0df-d7d332b59593", "comment": "Malware payload (IRATA)", "value": "70b8fa389f33477d4522230f63e0b6a42e433114", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698402484, "uuid": "a0da8016-9fd4-4839-abc9-78e113f1eb06", "comment": "Malware payload (IRATA)", "value": "0a9a24f53cedc8d1e957fcc20892ab265f7a1da090c158c0e722d84dd8defe0a874a9874e1bb4d7ae73bf82de449425a", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698402484, "uuid": "0638999c-9134-41fc-9d3e-bb79b7205953", "value": "T12C951203F766EA9BC9F6D3332134063650775D198B03A78B2D583BB938B79E80B916D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698402484, "uuid": "5febe140-b58f-449b-9914-bd07baf44ddc", "value": "49152:0/gSmpv9NBKCJcPPpTKcUaEjCp0fOdFTa6o0U90EFQQC5KF9:iRmpv9KCKXpTejCCyLJQ0zG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698402484, "uuid": "9ffbab97-033d-4c23-b0a4-5cef20b11db7", "value": 1991406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698402484, "uuid": "8afefee5-df79-418e-8eeb-378c4784aa1b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698402484, "uuid": "ea2f150d-efbb-4676-abad-a7e960212e9d", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7ec384-7496-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698389937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698389937, "uuid": "d7e7e7d3-e8a8-4009-816e-56ff3febd717", "comment": "Malware payload (IRATA)", "value": "6e514393d2c35ea58ba0853a83fd455a", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698389937, "uuid": "8cffedf6-10b4-4046-bf73-456169df7636", "comment": "Malware payload (IRATA)", "value": "b2cf863aabd48ace2c63a8b56cb683f5007fbbb7a97b1e87a079e3efa5bc4dea", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698389937, "uuid": "3d0ae175-6540-4291-aadf-9e9a5968d3dc", "comment": "Malware payload (IRATA)", "value": "32d7e6383712ccc7b71ca6eb9be8db1f7a25ab71", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698389937, "uuid": "9e30faca-b9a1-4be8-b110-a702c0466b48", "comment": "Malware payload (IRATA)", "value": "75f91fbd90d1bcce6bac3fcc91e85874bb27c3f49deefeab674cfb567d0a031b6e1b856caf651624555344cc182968d3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698389937, "uuid": "a6690bc3-74df-4823-8498-3dcefc160fd4", "value": "T1F2C5331AC5379019D5C3C035E3A9CD93690F3A8A0D6DD9373BBA52C821F7D64A693CE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698389937, "uuid": "92c64505-5e00-46e2-b868-e3a34c2ed937", "value": "49152:d/4pW8P7U9mRI7UdEbuH84htc4MdCTXV1UcKvVKN4KIFpA+lOnHvxPOTqc:d/4pWsHRI7Ccotedoca4KI7WmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698389937, "uuid": "6a27a4e2-54d9-477f-85d6-e0f497390dc4", "value": 2694303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698389937, "uuid": "26be9fee-fe5c-4f89-a284-dfbe071ef1ea", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698389937, "uuid": "fce49422-4a52-460c-9bc9-8a5433277936", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9cd7ef-749d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698393187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698393187, "uuid": "3de75c67-cb08-46b9-97d7-e591b55d5f5c", "comment": "Malware payload (AgentTesla)", "value": "584252105f5f7f2ab0bad8d1cc9a1bd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698393187, "uuid": "57a2d30f-9dd1-42d0-8448-f6941919cc41", "comment": "Malware payload (AgentTesla)", "value": "b3dfc07d5bc2408921c8f04ea90ef5d3b44bef78ac4ea905e338acd98f7df8de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698393187, "uuid": "9dfd2933-16e3-481b-afca-fdf70608da41", "comment": "Malware payload (AgentTesla)", "value": "6fddd362df0fc43144880016fff5f1464f9f4fda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698393187, "uuid": "5cc4b046-403d-47a1-840d-e26492634b99", "comment": "Malware payload (AgentTesla)", "value": "c1cc202ec39300450076c0bf67dec0b349a6a25437fccef75842c31be5f20efea50177bd109467afa970b2a71a96dbd7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698393187, "uuid": "182749e9-c5fc-48e7-8a24-38c17c7b871f", "value": "T1F2340F027E88EB15E5A83E3792EF2C2413B2B0C71773D60B6F499E9524517826C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698393187, "uuid": "25825e9b-d483-4e3f-b6a7-bc4eb59a31c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698393187, "uuid": "25d4b961-c448-47fb-aa6c-db81f2a4b819", "value": "3072:+TKG2v3nffg7ZzOGfaD9Sbv0XMsP+IVunPyF5WRjPJyQE:+KG2v3nffCZzOGfaDWvWMsWIs6wjPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698393187, "uuid": "11cf5eef-30fd-425f-9b08-2d3699783738", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698393187, "uuid": "4c8ec686-3990-4c66-b979-063ffea48569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698393187, "uuid": "671f05d7-6fa8-480a-ad5e-922203c5ffe5", "value": "1698393185e540f566b497e11d8cdc65102ea2255b2a7e3d137eca5be1d10217bfcb32f2ec688.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9255b6-7499-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698391336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391336, "uuid": "5046fa09-2232-42a0-976a-49227c1c53a8", "comment": "Malware payload (Mirai)", "value": "db646fff2598fcdec67a5ecafb0c120e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391336, "uuid": "56cae8b6-5405-4a89-90db-68450562b13b", "comment": "Malware payload (Mirai)", "value": "b41d31d552922af6c36cb1cbc001bb74745d2ae6efcd42ab167bc25d35d23a28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391336, "uuid": "7ff4fc2c-2dbe-4325-9796-bbd00b4efa5a", "comment": "Malware payload (Mirai)", "value": "7579fc49a456e18714fa5253a237e376f9b2f330", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391336, "uuid": "3aecb2ba-24dc-4cae-947c-f8014c4ae2b8", "comment": "Malware payload (Mirai)", "value": "aa34049b7353c97200a640b981ba0a726e1a1d2810fc6653636c757976c327edfe34b86db9754a8cfba6eb0314dcfc6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391336, "uuid": "edc99a37-b8fe-4961-a33b-b8193b68fd78", "value": "T119F2F16ED5C82868F8F86CF56DAE57E8B7D50F5DB253CC92AB48FF200A409175B31884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391336, "uuid": "e8324924-965c-43b2-8c6a-141d4257c5a7", "value": "768:2mNE13RPADJuTDDi4sQDRiFQvRzUvBS5alrR07aqjTVVIo/GfRyvouQPUkF+wNuy:v4BAD2mZEwFQpzUmaZSWqjTVVIoeJ+8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698391336, "uuid": "0c63c618-7ce2-4a5b-9d0a-7beeb299980a", "value": 36060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698391336, "uuid": "0b69baf9-ebb7-4a66-942a-ad68af629e36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391336, "uuid": "c8c64527-4b28-4f09-86cc-2bf288d3c063", "value": "db646fff2598fcdec67a5ecafb0c120e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd261c01-74b5-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698403494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403494, "uuid": "52602f28-4b5e-47fe-83bc-5707f5e60c8b", "comment": "Malware payload (IRATA)", "value": "b77fd78fcf9468e4e1c06b3c7a65a249", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403494, "uuid": "999e536e-e697-4e6e-8943-54ba13d05ea3", "comment": "Malware payload (IRATA)", "value": "b50c496e512969595e8e86c21e982bd287ed13f13adb51933a8523ea87cf7c61", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403494, "uuid": "2ba6b5e4-54d8-4307-8d66-f34a72f2b2f8", "comment": "Malware payload (IRATA)", "value": "dc2c562a559218e635f7839b1745977349c7a4ce", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403494, "uuid": "71eb16ea-2c6a-4f84-9dc3-013a5650506b", "comment": "Malware payload (IRATA)", "value": "948bbd960f8756c0870ba70e466109e988c19c31e16ae7631961876c16d303e12c76293669334465d14e7417f362a9be", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403494, "uuid": "2aa1d287-aba8-42a0-ba6d-18f4a0994aa5", "value": "T1DD06BFD7F399986BC4F39372817613A5424B4C228F83ABC76D14767C28BB5D42E49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403494, "uuid": "94133834-a2d9-48f4-81b0-c32136e78966", "value": "98304:Y1wXCzajr7gLCr846y1GQkl5iSkuYSCrk4:Y1WHjLh1yiY4rk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698403494, "uuid": "4671ef48-5c08-4d8d-bff7-1a15e84b8a7b", "value": 3825023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698403494, "uuid": "b375a336-995b-45fd-a1d9-8d0696f1a9ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403494, "uuid": "c335ece3-8b32-4eb0-bdcd-555f48dfbee6", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadaf70a-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421878, "uuid": "2b6228b0-dbce-44d3-b629-ac8f3e6b387d", "comment": "Malware payload", "value": "47f009b82e8831d48ba0efe454dee001", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421878, "uuid": "9385a6ea-b963-405b-a7bd-4646864a80bd", "comment": "Malware payload", "value": "b5ace22540c22f88955711b17922f7027001e451b67e570d359ec83e863fd201", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421878, "uuid": "b23bab40-e0e3-49e1-9d1d-3522b9ced2e4", "comment": "Malware payload", "value": "1526958609d41d1c64018aa1e7f1340304df136a", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421878, "uuid": "4b6d7136-1edf-450d-a094-a6b331b863d1", "comment": "Malware payload", "value": "022720dadaff237202bf066e56cd8e709d60897ad0afe82548e19010ac15e91a5917c3ba7e6c2e3b981c90a3c2aa916b", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421878, "uuid": "57f84fcf-ee13-46d1-b198-540d6a124be3", "value": "T1F772492EFBA75778C526907082F38779F6F9F02012524B6E86F4D7365E64B24D23A508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421878, "uuid": "0542003d-ecf7-4fdf-9f39-509c09474efb", "value": "8b7d6f218f07082b5df448bc58285040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421878, "uuid": "5b06537f-6ded-4cb4-8f95-ee1b6ad1da48", "value": "192:SO9i9WTTteTJV76vSvc9OJO4+7JJ+3VZhHPU4Xixgv4e/0HNungho7oYr7Ah:1i9UTtaV2vF0JOF+Z0onghuFr7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421878, "uuid": "e62f0f23-22ac-4f7f-914e-269887bdf512", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421878, "uuid": "dcb88d7c-0ad6-4119-aafa-2c06cd34de86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421878, "uuid": "b21308d7-680f-4ba0-a0b4-e9a1d657b9e7", "value": "Billing_Statement_NOV-23_R0.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478f4954-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421711, "uuid": "abc86088-5809-48cd-85a4-1227961c06cc", "comment": "Malware payload", "value": "897b8d3d3550aa66886b471d16f218a7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421711, "uuid": "695a7371-54c6-46e3-84fd-5307664d8fe7", "comment": "Malware payload", "value": "b60deb55e3c3c619e09a414c5f2efc6d345bbc519b7cde2609e7522e7c50287b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421711, "uuid": "8eb7b3dd-4895-44c9-81b3-deebf9532f4c", "comment": "Malware payload", "value": "876cd2d6e8ce150f6253dd934a2f90b6c74c1cea", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421711, "uuid": "5f71ff06-7d1e-4398-86a5-6d189f99df19", "comment": "Malware payload", "value": "937112e6a23a063c2e147ef9dc8019104fbf5733ae3df83348efc8753b7b5e647f5d9e32b758b4bf183f44d83bbabc76", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421711, "uuid": "a3829856-3549-421a-8463-6634ddac6126", "value": "T144D433A3D6C2618DE1B1E3AF4F79A263D36C71238471C7A671B5712C812BD8ECD1D252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421711, "uuid": "02396513-e370-42fd-9858-285bcf2d7be8", "value": "12288:9ZFM3KF7GhtsGt8iHnb+GIxQBKRfT5Eq4Wnxniq1t91c/58ybBZID:9ZFB4h1HajxN1T5v4WYq1tc/NZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421711, "uuid": "5859361d-2dc1-43f8-8899-914d0fd828d2", "value": 621919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421711, "uuid": "55b4b748-053e-4e93-9cd1-4e084368e596", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421711, "uuid": "c4852161-e0ee-4a93-9c9a-707ba3cb47f0", "value": "NEW QUOTATION.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c176c369-7501-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698436089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436089, "uuid": "9413155a-887f-400d-989b-afc04121a9da", "comment": "Malware payload (Mirai)", "value": "3bb4c94cc328eaee925972f0fb6b3baf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436089, "uuid": "c337f751-1a9c-44bc-b954-ba7c9d51c9d7", "comment": "Malware payload (Mirai)", "value": "b68df19704b095296983f05893f42f0fafb0e83b24fb93a3c9244253692ff8bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436089, "uuid": "741864c0-9b39-469b-8c40-14ff8656b3c4", "comment": "Malware payload (Mirai)", "value": "8e8d59f18855450d0282b0d0c5ad15cedad6adec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436089, "uuid": "7707eeb5-f071-4080-96a6-961d32375e5f", "comment": "Malware payload (Mirai)", "value": "11feb687b7ed78a931ddd322c5dd7591cfb3f5b6b491660744e043d915d92383b94d820373273576490349602b51112e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436089, "uuid": "db1c82f4-1b14-4f64-b39f-ed5cb6351075", "value": "T1CCC2E193A0F6CA03C8B3837B5A3D596622749435634EEE2D736A9BC473460D0657ACCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436089, "uuid": "16bf0900-1d39-4852-a5c1-56ff2e8a502d", "value": "384:MIe9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5QwDNN5DyBTwfflrTHOBFR0j/y5ZCJ:Y5+Kcrb9VDJeU8ETgdTHOBcK5ZCAy5Gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698436089, "uuid": "86db7f9e-d4c1-47bf-bf2a-725c44736ffd", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698436089, "uuid": "0b2d7285-4532-414b-97d4-6352c0d5d469", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436089, "uuid": "7084edd6-5b56-4f45-aab7-0e3a321e96f0", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fefbac7-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421752, "uuid": "43bd07dc-7076-4f17-a707-f6a48e95a422", "comment": "Malware payload", "value": "6b9e707cfa378c9fee43d111666a02c8", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421752, "uuid": "37239992-725b-4b7e-bfdd-5dca9cc2bb2c", "comment": "Malware payload", "value": "b77773a55dec95eeb1bb436f8be7d77292edba8481354de8ce30ccc01f92f50f", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421752, "uuid": "030910d9-7636-4e42-969a-5e5c7c44b238", "comment": "Malware payload", "value": "8c057b611fbdd0d9fcf5aa6e4163a5ed2e724c44", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421752, "uuid": "42ad2b94-a53f-4573-a98e-ac4f32016151", "comment": "Malware payload", "value": "a4f3b08abf3dcba99e608d01b8b86e4c3430da454642552689b230e2288bd09503fd70ac79a3aaf23169de31fef2e2ba", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421752, "uuid": "1d4c099a-eba3-41e2-94d5-2e5a5dfd694f", "value": "T17C724A2EBF97477CC969917482F38F35F6F9F02012124B6E86F4D7365E68A24D32A508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421752, "uuid": "dbc659c9-7770-4900-ad9a-6eaff01aad0d", "value": "8b7d6f218f07082b5df448bc58285040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421752, "uuid": "baff29cd-5156-4dd6-91ff-7acc3f138ee0", "value": "192:6O9i9WajDN4RSTJV76vSvc9OJO4C7JJ+3VZhHPU4Xixgv4e/0HWujZho7oYr7Ah:ti9lnN4ReV2vF0JOZ+Z0vjZhuFr7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421752, "uuid": "529880ea-eada-49fe-8071-37a991c48f77", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421752, "uuid": "c0b428e1-ec9c-4b5c-bd16-5659903856d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421752, "uuid": "13a1af7d-d218-4d39-b9d8-a3d7811efc0f", "value": "Voicemail.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c17965-74f0-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698428708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698428708, "uuid": "4aefcf97-993a-487d-a706-bd1f7f2c2b40", "comment": "Malware payload (Stealc)", "value": "a015662b98fbeba4f29238e1e540e071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698428708, "uuid": "b8564501-9efd-40a2-9640-d096d8238b0f", "comment": "Malware payload (Stealc)", "value": "b7bdd4a889c4bcb2605ccadb649c9e3c5b6bd51174c67c9a6f0a92ca3f88ebce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698428708, "uuid": "b9120fc9-172c-4cf9-81f8-d25bac053710", "comment": "Malware payload (Stealc)", "value": "edc14547d3150bf8b9e892996c60bfac30cf8953", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698428708, "uuid": "af5ebf18-f22b-455f-a155-6c83fc4a1cf6", "comment": "Malware payload (Stealc)", "value": "405c2386a16b51f5b87394dd10caa0af55b2f4584a0e666df10e7867fa9aaaa03907f3df0179a78ffe450d535d9fa780", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698428708, "uuid": "d66de953-2189-4353-8b20-65c70cb64379", "value": "T1C1157C2139C18135FDF320BB87ECBA3986ADD4B0071912DB16D856EED7606D27F32692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698428708, "uuid": "6b86a0b9-dd46-4d61-b7f7-a9e1499e6ee5", "value": "d7ba208feadbc5004adbbe24711c2488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698428708, "uuid": "6f8d3826-a1b8-4f2e-b7e0-058a1e75f4e3", "value": "24576:wKl+XJMRrxbhxJgSYF2z9OOuvjxobu5e:wKLthxJgSAYu7xob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698428708, "uuid": "c9858ff8-0c98-4e4f-8068-2492de1bbd82", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698428708, "uuid": "73d67d2e-849a-466f-affa-0d95f54d2dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698428708, "uuid": "6600f9ba-32d4-4f11-9d5b-8c988e492cb5", "value": "a015662b98fbeba4f29238e1e540e071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b04f874-74ce-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698413959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413959, "uuid": "270e3441-6983-4af7-9bc9-df03587d9d52", "comment": "Malware payload (Mirai)", "value": "927f56f06561b2e5f2efe0e1e3f7260e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413959, "uuid": "28ef1117-7bb7-43c7-ad99-0933ee4f951e", "comment": "Malware payload (Mirai)", "value": "b98c365726d6d62fd4529f1a6f7e09d11adba4ac7009a256107b94b09a171c88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413959, "uuid": "d0fff0ff-e304-4179-8395-7812ab3c6dde", "comment": "Malware payload (Mirai)", "value": "748a8ef3307cfc1c62ab61bb13958f1708a7645e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413959, "uuid": "665c9187-3cde-4100-bea6-843ba41b14f5", "comment": "Malware payload (Mirai)", "value": "33c9a7132a92f5868ed4573a776264f724a34e66a7d07cc9318032a7be3c858b29061b8d44fb366e249ba994b2ede5ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413959, "uuid": "0e6af1d6-a5ea-48d7-a99e-40e3dbc9165b", "value": "T149535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413959, "uuid": "c6b035dd-2503-409c-839f-fbbf605e5de9", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8U:N1GjR8EVGOW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698413959, "uuid": "e6d3f494-240c-4b33-8e79-dba8908558f2", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698413959, "uuid": "849bca2f-477a-4b69-a08e-22a7e756e259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413959, "uuid": "64d2b6d4-644a-4ba5-9a69-31cf1cfd3925", "value": "927f56f06561b2e5f2efe0e1e3f7260e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f660142-74bf-11ee-8907-42010a9c0042", "comment": "Malware payload (Havoc)", "timestamp": 1698407551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698407551, "uuid": "cd2b6398-d59b-4f32-b507-3fa4e8f24ca0", "comment": "Malware payload (Havoc)", "value": "61b73c507cb6f6d4cc87a64bf993a1e9", "object_relation": "md5", "Tag": [ { "name": "Demon", "colour": "#CD5328", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698407551, "uuid": "5f24a985-eac0-4686-80bb-578e98ec3414", "comment": "Malware payload (Havoc)", "value": "ba7bdc1eac155a61767e3bef3c6c43d66cec335298830e8e55369f68ee3928f0", "object_relation": "sha256", "Tag": [ { "name": "Demon", "colour": "#CD5328", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698407551, "uuid": "2c3ce830-800e-4730-ad2c-6b632a0b57fa", "comment": "Malware payload (Havoc)", "value": "95a5ecdb9b8b272dcfe7bf53a310e3a0553772c3", "object_relation": "sha1", "Tag": [ { "name": "Demon", "colour": "#CD5328", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698407551, "uuid": "8ab72a20-2338-4eb9-9475-ed033c81b4c1", "comment": "Malware payload (Havoc)", "value": "61ffbc3b0cb9b830b957fd5e2c5786e8e67b0edfcb322ffaf803a2e2c0dbce18238e94bf28727cedf189c32fa0ebcb46", "object_relation": "sha3-384", "Tag": [ { "name": "Demon", "colour": "#CD5328", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698407551, "uuid": "0669ca20-3141-4fb8-b97a-af713894cc20", "value": "T1CA93B406E16330FEC9BAC27047DFBA32FA72F45D15345F0A5B20C7092F60A71666EA59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698407551, "uuid": "36b0457b-a200-4088-a0c0-754b90ea9f21", "value": "1536:hlU1j+O+eLXf4wQR8Jo4gj7vC5Abt1lsZ3iYFikr:hlu+O+eEw1FgX6ksZ3zFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698407551, "uuid": "5f173c1c-cfa3-4f87-937e-5516e3f386fa", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698407551, "uuid": "ccde2592-f36f-4b99-9ef4-4212a4a3b6b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698407551, "uuid": "7c36606d-1cef-428f-99c4-a7be8ab59fc8", "value": "demon.x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26abfef6-74d2-11ee-8907-42010a9c0042", "comment": "Malware payload (QuasarRAT)", "timestamp": 1698415643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415643, "uuid": "65d84bee-f504-413e-a86c-ff70025a425d", "comment": "Malware payload (QuasarRAT)", "value": "2478e98b069e595f8f026c806fe33cca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415643, "uuid": "599494f7-c0d7-4369-b8a4-60b9f4930db0", "comment": "Malware payload (QuasarRAT)", "value": "ba919450c172866f0582820ec65e1a45d9bffdd2984032155d11999280e77e15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415643, "uuid": "a95c00e1-c549-4062-bc5c-76b0cd0a800a", "comment": "Malware payload (QuasarRAT)", "value": "541eb1e89353879d8719919f7389b3997633a3dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698415643, "uuid": "e8aceaf6-98ae-44c8-b60c-0717ee6d6ed9", "comment": "Malware payload (QuasarRAT)", "value": "8fb764e38e3cf4c2b4de763ab3c0bd63adb5b6cd8418c52bbb721485d70ead75f99e7aecdf7d5fd122d7960bec196dcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415643, "uuid": "31b3c194-354d-48dc-a20e-d968d91d603b", "value": "T160748C5773A8E93BD0BE173AE43246054BB0D4077B16F38B5A6C55B86E233868D523B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415643, "uuid": "f61974b7-146e-46d7-b8cb-69b7b71001df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415643, "uuid": "e36fcfc9-ece2-4be3-a48d-ef5e711cb238", "value": "6144:pzNHXf500MRbMYrMEbugp6/liYMYqX/IamedS:Nd50LMYrMipSliYMYqX/I+dS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698415643, "uuid": "b6a6dc03-353c-44ce-a66f-178c73b6c4d9", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698415643, "uuid": "ea87279f-99a9-4bb8-a7db-d7ab7048a69f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698415643, "uuid": "8ccde724-cf7e-4077-bd93-504fb988a90e", "value": "bQXD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5984f8dd-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421741, "uuid": "ce16e33f-a685-4e14-9148-623ca251a3de", "comment": "Malware payload", "value": "1b6085ad06657a1dab7785f48e325492", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421741, "uuid": "83d1665e-19dc-4b48-9afb-8b0cf0d6d1c8", "comment": "Malware payload", "value": "baf2d48bd0712d9e82f942c51dfcc8b6ab4d71ccab001ca317fc77a7cb7e204e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421741, "uuid": "35d6518d-5e03-4ba6-b7ff-6fa8460d421f", "comment": "Malware payload", "value": "b14b3ff435ebff5639ac7d013c53bca1da9ffa8e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421741, "uuid": "6f5cc0fa-b788-4140-8a07-f6deee9bb938", "comment": "Malware payload", "value": "1c030541147efc8febe1e3c841ab38a294a76459d09eab1bac2aa0b407a63791b2bb83ccfbab16d69dbd1078230dabdb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421741, "uuid": "3ce797f6-51eb-41cf-a4a3-b39368d76ea6", "value": "T1E4E4230D0875DBAE69A3E3E11D19B2936137716ECE508B17BC5203B9C58BFE253438B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421741, "uuid": "835c9032-719a-4a57-874c-da6b1906fe2e", "value": "12288:PUWmAbiav0gia+568e8hfEJ24SzXleJKKuMLZT1fxRGlOKW1xqzWwJ+KOyxgV7a7:PU17av0gimNE844SBC1ZJTG8rqzWwlVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421741, "uuid": "312452bc-41ac-42db-8a43-44ee797001cb", "value": 701874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421741, "uuid": "cdd8cdfa-c2fd-4c5f-b349-9f0ae72799c0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421741, "uuid": "57a1fc5a-230d-46bb-9cb4-8a7967a25274", "value": "Product lists .xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f942396c-74df-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698421580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421580, "uuid": "8928f253-1e9e-44bf-8210-8039f60b6c3c", "comment": "Malware payload (RemcosRAT)", "value": "a1f7ee9051df2df85fb54fc506220b51", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421580, "uuid": "7a5a5723-f31a-4ef1-bf5c-8ca5fbc5eaa7", "comment": "Malware payload (RemcosRAT)", "value": "bbc2088b4c90ccf8407bbde7f2f3865747921c777850c04589bd6ee2febaf177", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421580, "uuid": "cc8236b6-c476-46cc-ba57-00f85b39a5e1", "comment": "Malware payload (RemcosRAT)", "value": "ac556330fa93a5d8030d45d80ddf6e147c779013", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421580, "uuid": "3400a96a-f0c8-4a38-966f-09b1e1a8c180", "comment": "Malware payload (RemcosRAT)", "value": "a6bda8076559a719d2a532aee3cc15e52627506aede73175e742930c1930a2809f5cf1ff13ec9f92df203a0d8ccfa5e3", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421580, "uuid": "d7d80505-b8dd-4d27-8b3a-8a0a44d48b1f", "value": "T1A4852312AECF5F23F84ECAB591E7A16267F2BD03C527924956150E1F2643C13F6A09CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421580, "uuid": "8675fd9d-e81d-4923-af89-7a81333b3a7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421580, "uuid": "f96274f8-771f-4733-932e-72bbb3482296", "value": "24576:gPJMQoRiUCzYI3W2LGCR93wsZQayULdjfDTUjfpznGhaak4S:gPHSI3W2LtR9g8Qay6d7UDpLGh/k4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421580, "uuid": "ff270331-b3dd-462a-be3a-3ef53cbbc758", "value": 1710992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421580, "uuid": "542b4f94-eb9f-4cbc-9565-91656e8726b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421580, "uuid": "322a1892-4eee-4c08-97ce-9d8119aa812c", "value": "BBVA COZURENT 7152 FBO TULUM..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa56e5f-7461-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698367117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367117, "uuid": "1514301a-fea3-4293-8aaf-2327ceb4f066", "comment": "Malware payload", "value": "94f7b45a9c97c7af46be7bc0ce4b68df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367117, "uuid": "f4dfa1fb-8f7f-4453-8552-767e8476064a", "comment": "Malware payload", "value": "bd8430d12475e8ed33bedbedec627ae37bc83bfa012ce1bbce55bffee57b5441", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367117, "uuid": "ecfd0845-03bf-48a5-a807-e3501f8788ba", "comment": "Malware payload", "value": "454d268db5f716d3f0b6952dda4f920693d613d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367117, "uuid": "81ab11ac-a385-4d7e-bbd2-71047eb76bf1", "comment": "Malware payload", "value": "f9b9d8bf0a421c8c86a6a2fd8d389dd7d1ee90b7d3a20bc44c0760876cdbb092592de285df93bbeeec77f0c2a4ba76bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367117, "uuid": "a7f911e0-722d-4567-b201-f6b7c4e64fe4", "value": "T1D825152165049376F8B1FEBD0717DE182310F8226CA4C726F3D62B59A57E39EA874F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367117, "uuid": "a29d213b-1014-4c30-901a-33c26630370a", "value": "85bdfea8ee421ef8b02e68ac5d19d2f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367117, "uuid": "60456593-6a77-45b0-ac56-7af0878e61c1", "value": "24576:Wi5Th55oxtBMvZ+cAST6eacmqBo+jof8ESR2L3JNO1fLQ6rdbi5Th55oxtBMvZ+R:Wi5Th55oxtBMvZ+cAST6eacmqBo+jofE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698367117, "uuid": "8dc68300-4bca-42c7-abee-3e2a6a175a8f", "value": 983040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698367117, "uuid": "1ef3218d-9b1e-4c8f-a5c1-e9c012f9f08a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367117, "uuid": "24e36167-6723-4206-899c-88ab62d7da52", "value": "SecuriteInfo.com.BScope.Trojan.Wacatac.15407.3056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93be819-74ac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698399675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399675, "uuid": "1b4eeec4-1ae6-474f-9b19-11d1a50c4708", "comment": "Malware payload (Mirai)", "value": "8d4f7e34ddebe801c6ca92e6e90b9f56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399675, "uuid": "3a201960-d481-46b1-b1bb-5800442ea377", "comment": "Malware payload (Mirai)", "value": "bddb3e699f8d2d18eb597d28a9e6fa80ab8920f7f983f5ff1015aed5209fd94b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399675, "uuid": "d90a6f6b-c533-447c-8b57-2a4a8a5ae275", "comment": "Malware payload (Mirai)", "value": "14b67e9f6737838ce31460a13ace325d65a770f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399675, "uuid": "1c3bcf0f-b9cc-438b-bfa3-7a6beb313172", "comment": "Malware payload (Mirai)", "value": "12bb1619f6fe74d6f071f23c97b26f725bd1c48e39d5e22ef72e6f3f7fce04ec978cd215548862aa7f9c6df93996fc10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399675, "uuid": "e9ea8b2d-fa79-48df-88cc-55c761b87e9c", "value": "T194B2D01DC0AA6EB4FEDBBD355D41F2817FA15BDF3A61CDC016C15A110622E281F9CAE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399675, "uuid": "1ad9a188-94a5-4ab8-9192-9e0dfc772461", "value": "384:2OA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIo39OJM4uVcqgw05c:2AApCdvwJr69VJoA8FZtxCo8ekm4uVcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698399675, "uuid": "86b8e5dc-107c-426f-b435-0d6e370ee50e", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698399675, "uuid": "891ca24a-f3d2-4745-a2c9-59562044e294", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399675, "uuid": "8e19a4d8-0c90-46b7-832c-e8f815b7706f", "value": "8d4f7e34ddebe801c6ca92e6e90b9f56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ad24de-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698422034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422034, "uuid": "360c39b9-a7fa-416a-8876-0123a9b39a3e", "comment": "Malware payload", "value": "5b3bf7494660d65af9f131107edebf24", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422034, "uuid": "610a1cda-7b18-4aa3-bf27-e56a631d1551", "comment": "Malware payload", "value": "bf2d43353a2568a7c2908cd10752ba52e11599e713db5047eb4b74a8e93e6cfc", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422034, "uuid": "a8b45cb4-8cb5-4257-b00f-41b5a0ffdbc8", "comment": "Malware payload", "value": "da9289139cf1f130412db8b153a90cb13090913a", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422034, "uuid": "1b4bdfb8-2cd3-41af-8cbf-d5949af99998", "comment": "Malware payload", "value": "58e68260f5c87394c174e36ad3404b4a046fe555ec71cb2f7f50cf624530c660238cbad3011c7564d6e62fec431a7920", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422034, "uuid": "b3eee255-6078-4b08-94ee-51c9140bb698", "value": "T1E665E095BEC67EA6EEAF55F78360AA3D1116336D03B05ADF734304993944EC2523EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422034, "uuid": "d716a202-c7ad-4ff1-ac2a-ee47bffac76c", "value": "0d65617cfd2eeeccf3175fc27ca72f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422034, "uuid": "954c8460-462e-4e70-a89b-63508e3978e9", "value": "24576:d22LDHGVX18+QHT+dvvy8nMC5eKUtyTFcv9c34yjWJ/Mugwde1:LLv+QHs3KtYF89gJsgsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422034, "uuid": "fa16ca23-a63c-49c6-ac96-4b4010bac986", "value": 1457664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422034, "uuid": "cc152cfb-2edc-4462-a6df-464a7951b3e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422034, "uuid": "8463e78a-1f32-4236-a1a3-4b620d982227", "value": "Quotation & Sample Products.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082b2092-74da-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698419028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419028, "uuid": "c461cbff-436e-4650-a017-8747fddc1500", "comment": "Malware payload (Formbook)", "value": "731aab7c8c39f57db9f147b9f04f875d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419028, "uuid": "59fe813f-51e1-4706-8f4f-96825417a2e2", "comment": "Malware payload (Formbook)", "value": "bf6ccdb40c75ee410046cf7c4590b73d9d9f6e0c16e7d9bf0659b2ae264893e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419028, "uuid": "e51dd620-609c-474c-b55b-bae15e7d8816", "comment": "Malware payload (Formbook)", "value": "c6d736b2a7a384f7e502445b93f000aca4e74314", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419028, "uuid": "aa0a5c59-a2f3-42f9-9a84-3ab399f80c0f", "comment": "Malware payload (Formbook)", "value": "e6471e0d2e46c139d619b7bfdfeba3a0d3111cc0193c4c7496c1757f2557856709987ab71186b8d80a3b3807fc2e3ec4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419028, "uuid": "2821ca6f-71f2-4642-97e4-62d9565f8eab", "value": "T1FAE4BF49F5C81A91C82963B81F7BCC784722BDBA7935C10D18D579EB3FB6B830026667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419028, "uuid": "d013c996-6a08-4764-9a2d-732e4d60d804", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419028, "uuid": "4d877347-36b0-473d-aa21-814222c1a59b", "value": "12288:17MOY2gZl5vvh7yQfWrIQg4JJKYpFL1ggzbL:17MJ2SlfODMQhDFeQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698419028, "uuid": "82fed870-04f9-4206-be70-16c5b94d89ca", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698419028, "uuid": "f6df9f25-99e3-48b5-ba66-f458fc78b807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419028, "uuid": "203c397c-0e6f-48b0-a3fa-2a8cc5101569", "value": "Purchase_Order-SAFCO_110162021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7a116c-74aa-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698398501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398501, "uuid": "ce999af9-e325-401b-8999-56627b9288f4", "comment": "Malware payload (Formbook)", "value": "cecbf0cf5527bf4252418ea951f75339", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398501, "uuid": "9962c03f-ef41-45a9-a052-0898605db951", "comment": "Malware payload (Formbook)", "value": "bf9584e32236ebb05f71641930612dffee8a9029881c5ff3a4fc20cd246dadb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398501, "uuid": "4f79966b-1149-406f-ac1a-fe681c416c39", "comment": "Malware payload (Formbook)", "value": "4a6d6c3f277905bf3851293aba1eed717d81b02c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398501, "uuid": "ef2052b8-2a7d-475b-bb55-f613b79bf864", "comment": "Malware payload (Formbook)", "value": "07c1f5b8cb33d2c6867ee5eb5d90bb6890ec0e7fd8d915ed408955c710eca5e3e9edb9e5caaf9b1177c62c12fe27ca0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398501, "uuid": "5e902fe1-87a4-46bc-82db-0eb47fc44587", "value": "T13B05E10EB686EE02C3655633C5D761144B719782A217DA0F7ACA37D50E033AFAD4A6CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398501, "uuid": "e3fc8727-6646-4112-9139-7953429bab4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398501, "uuid": "d639fb9b-e8fc-4c8e-bfbf-bb0fe0e6ce55", "value": "24576:1h/GLZe71KqAFp5vRrDH2dVjxvq1XZysTbJlyA:T/Kc0qAFvvJDHEjxupysa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698398501, "uuid": "8a515c06-befb-4fde-9243-8f01fffbf27a", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698398501, "uuid": "116477c3-4b58-4a33-8080-02fc7fa34044", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398501, "uuid": "2a80cb2f-ce59-452f-ab89-395d0ce9add7", "value": "27102023_267897635409878.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f468ff67-74b6-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698403962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403962, "uuid": "e11b1a1e-c663-451d-8839-7970278682b8", "comment": "Malware payload (IRATA)", "value": "a2de12fe16adeec00374ff6c6433d236", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403962, "uuid": "70a101c5-b106-4a37-942e-2dcb920fe225", "comment": "Malware payload (IRATA)", "value": "bff2802ee8911511bf4f9274014315efa67e26ffe8c0b605458012ee2eb6eecd", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403962, "uuid": "f943463f-7341-4863-a73d-1bb6e3e1b293", "comment": "Malware payload (IRATA)", "value": "bc39d7ff087d89442fd37589f4657f293211b4ca", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698403962, "uuid": "2d4167e8-5692-4d7d-ae67-3929ecad5446", "comment": "Malware payload (IRATA)", "value": "22a02c3bd9315662ce2b23ca5fe56d1d01da51525b964b431363fc656591ca209f82ac7897d5cf89cd13695c56a9e00f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403962, "uuid": "ccfb1048-ef5a-4456-b685-0f0aad782668", "value": "T1A0851243F366B827C8F2C33224B5263626764D25DB47B747291873BA64BBDE80BC52D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403962, "uuid": "b0ab63a5-9494-4da5-9961-1f9d13b1ca61", "value": "49152:ZsgkkU0XYGDsn0wFFJu3Q3hSoA6z055wb1S:5kkDXfir/JugxInh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698403962, "uuid": "d483b4ca-a7e2-4eaa-9c61-fbad11ae168d", "value": 1772565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698403962, "uuid": "fc4516dd-7e53-4464-a95d-7067e25380bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698403962, "uuid": "716e1470-8024-4e12-8f12-8df822273eb8", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359ef986-7461-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698367135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367135, "uuid": "79f38db0-a273-4ced-a596-53f74cd8fcf6", "comment": "Malware payload", "value": "ce41b4c942e20814d914523e6ca227e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367135, "uuid": "f3f48a8e-89ae-48bf-bbbc-6dd6e81cab84", "comment": "Malware payload", "value": "c00281ce990265c1621eb1a66e7af54aeff6ca19a39047bc3ff7a0b5bd5e4a3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367135, "uuid": "0a079e95-5b8b-4479-85d8-480a1d1b994b", "comment": "Malware payload", "value": "69b94d4bf3ddd074125906548f922a2e12df4464", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367135, "uuid": "d02eded1-59b9-4dea-8c92-c576cb3327a2", "comment": "Malware payload", "value": "55268b805a029b5af676b35006f8ef8c556f71bd2b1ba8f14e350c102c6a2359501296f1760b488512b439388025e299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367135, "uuid": "7a129acd-8235-4071-84d5-e3e005cae206", "value": "T17DD45D23E3A15437C1631B749C1B8669AD2EBE113D24A8462FE43E0C6F397B1753B297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367135, "uuid": "d57728d5-319f-4e0f-8845-bd915dda9936", "value": "6144:6dVAQ40GCAkxu4YqhnupWkMbIoaXqLcM/EuDEGfQR+/QUtV0jnSyu87Oicp+lZ:kVk0rAkxXTZRIGtBtyqIORa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698367135, "uuid": "2acc8672-a0a5-4d71-8fe9-6841a1fc962c", "value": 607232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698367135, "uuid": "5a76156d-b43f-4ef1-b1f1-cfff93463c13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367135, "uuid": "7300ac84-4b76-4899-9f5a-8e25d2cbbd33", "value": "SecuriteInfo.com.Trojan.DownLoader5.4490.15577.15542", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e672ce90-7490-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1698387618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698387618, "uuid": "5b520db4-b91b-4f8b-acfa-7fbd441270e3", "comment": "Malware payload (njrat)", "value": "038caecf86bda277b8ce7138cf2b2d19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698387618, "uuid": "70a17f10-97ca-48d0-8c97-18c5ed27cc6f", "comment": "Malware payload (njrat)", "value": "c020a9240ec765e7ac049c4531bd1beadd2303983cb024f4b5731bda25a7d140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698387618, "uuid": "58792a0c-b201-4814-8303-4407865670ff", "comment": "Malware payload (njrat)", "value": "63e4863d4e56317b6cba3087292a92c5ab0ec0e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698387618, "uuid": "31c0bff7-df21-417e-94e5-987f0012161a", "comment": "Malware payload (njrat)", "value": "210a9c55f1b559e0ff944f0720f6a439a8f695186036906ae7c5c1887347a7e741eeb445d97d06a7b4aaeb3f4f47567b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698387618, "uuid": "b6331173-0d4e-4fc6-a80e-570279c13255", "value": "T17C93E84D37E550A5E2FE4AF3A870B2400FB9F0471742938D49E1A9761A33AD84F94DBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698387618, "uuid": "208774fd-99a6-4997-a0c3-3a426c01969e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698387618, "uuid": "cb968e30-7f32-4576-9a30-4f3c12bfc175", "value": "768:mGZefAM+0uGAfIi+qXuzMywjZdLJakHX+xWvYR4SYzktFI3tr3/iTnRVOR1MY4FX:wfAl0pUjBjZdL4kHG5mktQJVR1Mppv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698387618, "uuid": "e81bd1d1-49a1-48dc-8060-788dc071b03f", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698387618, "uuid": "be10839b-b7c1-4c46-8ac6-6044e867a9be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698387618, "uuid": "68a00929-92e2-4052-a5eb-0b3d8311de42", "value": "038caecf86bda277b8ce7138cf2b2d19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726b0b89-749e-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698393436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698393436, "uuid": "84a39fcc-3337-4c03-a13c-2c3b742db7f3", "comment": "Malware payload (IRATA)", "value": "6092c65df1203749198932e9350e7b35", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698393436, "uuid": "b7c58791-8e36-42d9-b5df-13e301186b83", "comment": "Malware payload (IRATA)", "value": "c0ccdbbf892b396bdc0289adbb38699035611aead28b8bf6604bd4f72dbc129f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698393436, "uuid": "f0129138-4ca7-410c-bcbe-345825c97808", "comment": "Malware payload (IRATA)", "value": "dffac938db2d19275d8ad92f3a1076c606b3c8ea", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698393436, "uuid": "a846ac41-94a4-44ea-949e-49aa86c65854", "comment": "Malware payload (IRATA)", "value": "891ad3da5161a1355d713d44280003fb4a58295a30d6fe9509564e381464ac36a33f1d02eedfe4808c996a7c27d6cafb", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698393436, "uuid": "8e6bd022-abe8-4f87-abd1-8f588bb31fc8", "value": "T13E06BF8BFB98A85BC4F35372827513A651474C268F83EBC36D44777C29BB5C01E89AC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698393436, "uuid": "bd449c09-eb6c-4ddd-b008-de7bd87419fc", "value": "98304:vUgprAiaAdlS0zV861Xj2gLCr8GQES25XbTpKOLk:vRpMiFXZzV86ztcfp9Lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698393436, "uuid": "881a466d-4b35-477e-a36b-425e72cc80d1", "value": 3867927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698393436, "uuid": "ff6ad195-5833-46ef-a8ba-3df04c3fa374", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698393436, "uuid": "673ea3c1-4842-45b9-9486-48208ff9e108", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8344063-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421873, "uuid": "9ce84652-e6cd-4309-a1c9-14ba28439a69", "comment": "Malware payload", "value": "d64f9b3bc9197ddcc99e1812f97fa06e", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421873, "uuid": "2bc6f3bb-4341-48e1-abe5-a320c8e18e21", "comment": "Malware payload", "value": "c0db04bc29e4f631a3dbb2f7d7cc22aeebd518425cbbcce643e07712922930e7", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421873, "uuid": "7f3b4bf7-b7c1-47b9-9493-6cf150593156", "comment": "Malware payload", "value": "82d0cd2fcfacf1d88b8f6e0de906dc3f8e49c949", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421873, "uuid": "5a92fd24-154c-4b24-9d53-bd7fb86ab5c9", "comment": "Malware payload", "value": "f8df84a885189257ea2a11c6347cdeedb351e08768df0574b2cc63494b82af98f933f392b00f19dc4a3f7126adfd2e84", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421873, "uuid": "a72c2d38-afb6-4877-8c8d-33c8c64208c3", "value": "T19172182FBF97577CC855A1B4C2E3C739F6B8F01012514B6E86F4D7365E60B189A2A508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421873, "uuid": "04b17f58-2c92-411c-85ea-f94355367122", "value": "8b7d6f218f07082b5df448bc58285040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421873, "uuid": "07aed4bb-914e-4a34-8c78-e438b508a58b", "value": "192:S3uNpN9GU4FJuI5lfWqV1vSMteJOvK7JJ+3VZhHPU4Xixgv4e/0H86wniho7oYru:OWT9z4vlfxV1v10JOw+Z0VwnihuFr7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421873, "uuid": "b30cd0c6-9573-468a-9285-9d7728c50ed6", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421873, "uuid": "c0d974af-9cb1-4a06-8045-ec175e15e5d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421873, "uuid": "5fffbade-68fd-4a34-9d4a-cf0743c906d4", "value": "Billing_Statement_NOV-23_VB.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0704813-749b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698392225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698392225, "uuid": "c27b0f9b-8467-4c2f-8f6d-d215eee7f585", "comment": "Malware payload", "value": "1940141f673cf5536ff354391ff0f05f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698392225, "uuid": "c72184e5-5ff0-4149-ba94-339803191736", "comment": "Malware payload", "value": "c2c3665fcc34cfb52d73b9b5c28f04b3ce1c0d585dceb614d3759626d1326631", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698392225, "uuid": "964e7350-caf3-45cb-8a6f-1d0e88e8e850", "comment": "Malware payload", "value": "17e1c27edb8a1c0414db9ed4a1191a362f1b9d6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698392225, "uuid": "354bc28f-9987-4a19-952e-11102084daaf", "comment": "Malware payload", "value": "53b4090e3cf0cd511127835f65d5709f77243555e5ea888f03d56c7c70f8f6cf3fc580811acaff8d41e2a2bf076b3a5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698392225, "uuid": "0c835d60-e9d9-4b1f-a6a9-1c3a211aad02", "value": "T1721601589F4EEE13DE100270A457C6F72A49DD8BD602A3339BEDBDB3708738556882E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698392225, "uuid": "45577bbf-9d62-410b-a60c-913bc811b05e", "value": "98304:MGAavs46NdN7YJhb1l3dL1NzpOnnhgdTZmaZ9kYNX9AHD8YgDCyi1cQJXu25+Z2X:MG3vUhYJTl3d5NVOnhgdTZlZ9kYNX9CN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698392225, "uuid": "d01aff30-f718-4ac9-99b1-2bffe1b27317", "value": 4351488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698392225, "uuid": "10c27e0f-ab96-4c71-a78c-3591f25f4204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698392225, "uuid": "fa6b162b-c1e5-4a15-8e6f-8fc82459a2c7", "value": "SecuriteInfo.com.Win64.MalwareX-gen.11543.22989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffbf892-74d9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698419014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419014, "uuid": "8afb668d-b4a9-48b4-a6fe-6317d7292bc0", "comment": "Malware payload", "value": "4cbed83680b65ce73173b9f5fec67493", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419014, "uuid": "2546a8f8-f565-4d01-bdea-0cfdcd745586", "comment": "Malware payload", "value": "c34e93e56ef856e60b9b2df138d2cfd32d112259d87c4a274a9e2318bf8b555f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419014, "uuid": "624e2cdd-5405-4773-b7a5-b5b7d25b31df", "comment": "Malware payload", "value": "684354895d3f78d1fac4ce2f6dd16d290301de44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419014, "uuid": "ef905c22-87af-4b7e-b4ec-1678e99b1ac8", "comment": "Malware payload", "value": "50ac7eb147698b52da7dd990d2f4600f2ab2441976e5bad5c0b6550dcbebbe1fa006e7f4160391b34d36f9d668547a79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419014, "uuid": "f70478ce-74d1-4ac5-a649-838ce602edb6", "value": "T114B46D4DBA942890D8B5573A9C7AD8785736BE6EAC35DB5E00C439DB1F363C34813A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419014, "uuid": "11fd6708-ad72-454c-a805-3e6bdb3ec0d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419014, "uuid": "85cb6dea-d451-4292-94b5-f0edeca600f9", "value": "6144:EMdWCxOwzr11MpPver9qAaSg4JJKYpxzLzpggzbL:ndWCxuWrIQg4JJKYpFL1ggzbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698419014, "uuid": "5baae679-53f2-4c7c-b950-34655741017a", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698419014, "uuid": "52a6cf32-aac6-4790-9a64-dc2c0bf993c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419014, "uuid": "c83fae25-43c9-48e7-b20d-94c3c999badb", "value": "4cbed83680b65ce73173b9f5fec67493.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c66442a-74d9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698418767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418767, "uuid": "e2b58801-c4f6-434a-869a-d84cce6eaee5", "comment": "Malware payload", "value": "9d3ff29bb3a7834ecab9d30a29f38bf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418767, "uuid": "0be327cd-75fc-49b4-9219-762cf6e7aeb5", "comment": "Malware payload", "value": "c4355c12cdb30a5ab2fe97828b1b189abcef20d9b651be38fb61283f94aa9918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418767, "uuid": "908e00d9-452d-41f7-8a46-9af859238090", "comment": "Malware payload", "value": "667dad8bbfbbad428d229d383d00e90ed89565a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418767, "uuid": "b3ea5f7d-d9c7-4559-94f2-da12c99a5ca8", "comment": "Malware payload", "value": "98616e71446c74e2a253eff18dc4dfaa5d8f665137c0fc94ffeba9216f8a07aaaf78a6ab49cd1e5e3b3194175af953df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418767, "uuid": "2849d477-b8f3-4455-a90d-d293b2d35b78", "value": "T1D0641847BBA418E0E8B7C1398992221AF971BCA68330D7DB53911A4F4F33AD4AD3D751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418767, "uuid": "13c538a6-c7f5-460c-acb6-ae105fbcd327", "value": "fd5d9d1cbcf99ec36a28bc74087df1e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418767, "uuid": "a968e60a-966c-48d2-942e-c266a1f4927b", "value": "3072:dYQbijezGcxjdUC3zgLLWIpZegtfsE7PHAZ7EfY0m09w5F9e8YHpHOfYZGDQbHAi:doQRUCMLPpFtfsEDAZwfBmmMZIbZKUgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698418767, "uuid": "3a08a37e-8552-4ec1-ab4b-9c3ac3082cc2", "value": 314032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698418767, "uuid": "26121d68-db61-4d5f-935c-79011254db4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418767, "uuid": "5df35ec0-9874-46dd-b371-3f16d8e8d86a", "value": "9d3ff29bb3a7834ecab9d30a29f38bf4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc5bb47-74c3-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698409535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409535, "uuid": "2249ed95-2ea4-447d-9b01-34bafdada0bd", "comment": "Malware payload (RedLineStealer)", "value": "1eb95515e37a82ee15b008256ad06444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409535, "uuid": "911501ba-c7b9-441f-b5b3-3c89f094fffd", "comment": "Malware payload (RedLineStealer)", "value": "c5b6f1fb4284c8e7941d48becf370434bd2fc306b116399b26752fc834e4dafe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409535, "uuid": "a362469a-2728-41cd-bcc7-508a9d8da38f", "comment": "Malware payload (RedLineStealer)", "value": "eafd392f9c197252617571bf18e5e4ee520c153d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409535, "uuid": "c0b42e78-7b63-4c73-8095-19ce592d3aae", "comment": "Malware payload (RedLineStealer)", "value": "7d71d90534f4973a212e02dfaf6e5cf2ba5f3e7c0b41937d06c23d9fda60847b7f10d767cae0697086fcddb327bbd2ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409535, "uuid": "2a758606-f250-4ee5-9ae1-8faa351abb29", "value": "T195458C307CCE402ADDD6607242DDBA3696ADC174375451DB16EC2AEADA307C27E32E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409535, "uuid": "37f68f2f-91fe-4227-8abd-970cadd8a0ff", "value": "024577db1b2f78d9648d80f0a068dab4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409535, "uuid": "5294bf54-d175-41a4-97aa-373cd09529e0", "value": "24576:eWDC3mv/a3W9fWKN60imiLX3SJQlkOVaeS:eKa3W9f40KLXCJkVae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698409535, "uuid": "c08825eb-f5b3-4c44-beb7-b3f7184520cb", "value": 1168896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698409535, "uuid": "29f60378-c76f-4c28-9ac9-366cd3a758c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409535, "uuid": "895bb0cf-d1f3-40b4-b028-ae60873e73c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc2472cb-74df-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698421585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421585, "uuid": "cb1689bb-15e0-4d48-9b46-debeaa2c115c", "comment": "Malware payload (AgentTesla)", "value": "ce296bb106eaae9d71c60c5b200c0773", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421585, "uuid": "e700f97d-f7a5-4f73-b452-8aeb1b32d9d3", "comment": "Malware payload (AgentTesla)", "value": "c5f23ffa1d65c9fbf3ca8a880ac2738b3ae188da2011db2430f3cc1bf3dcc5d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421585, "uuid": "ff7e3edf-9fb7-463b-8e5d-05dab8a7c366", "comment": "Malware payload (AgentTesla)", "value": "5f81c1463aa1a796e3de0bfeb0a623d600842d93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421585, "uuid": "aba61cf6-c38c-4250-873f-eb26b3354805", "comment": "Malware payload (AgentTesla)", "value": "e9b359a871ebf66bb52248eb96e723188fb787ee56c75604610a375880794c67c7d148d7ed0819ca9a8e8dde0c1928b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421585, "uuid": "c5a975bb-ada8-46e9-acb9-fac28b8519ed", "value": "T151E4235C1002DAA9D9166AB8F5C7A1609BF46F09C51EBE48EF215C3CF0B0D9FAD3E244", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421585, "uuid": "6aeb07b1-066e-4d63-b86e-fa7decaab34b", "value": "12288:BqnWUwO2AaD8kN+Rf7N+ZZkuLYUe+s4Nl0bJjv1yvzACqrDNiH11Th:4d2xZeDkfkNUkKCbJjv1yv5sDNiHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421585, "uuid": "d7276951-9daa-4845-a495-734e0476c9f8", "value": 693656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421585, "uuid": "972079dc-7e90-4fe9-ad12-2f36fd5c8b39", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421585, "uuid": "d43a47ee-059e-4af7-b8bb-99cbbdabe4fe", "value": "Ashok Dargar. CV.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb77779-7472-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698374395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698374395, "uuid": "6865bd16-168c-4d89-b07c-1ec0bc14cba5", "comment": "Malware payload (AgentTesla)", "value": "6d7a489bc91e7089fe11ea0929efe0d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698374395, "uuid": "46cbc53f-1e12-43b6-a0b0-59c7415fb469", "comment": "Malware payload (AgentTesla)", "value": "c73264784126296cb14e0780c35c61af7e9e6b430cbc2957623e53ba52fc5d88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698374395, "uuid": "ddc6f84a-45d5-40d5-bcfa-e61738311cfa", "comment": "Malware payload (AgentTesla)", "value": "08f937f801365dbe5fcd5c527e68127c423298e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698374395, "uuid": "705dabaf-65d0-4a38-b300-b925fd4565b6", "comment": "Malware payload (AgentTesla)", "value": "a70e5b8de201edb757204a9a4e3cf81fb8172293b34b678deee81184f7c793081adb1bdefc2ed410c22713dbb50e64a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698374395, "uuid": "ce380aac-8253-4105-ab0f-c6276a79c88b", "value": "T157E4230936A85BF1D7BD5BF7B470122957B06A27A5E0E39C1C9368C9253E7420CA1E3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698374395, "uuid": "1fe54abf-6925-447c-b25f-a4b09afd8fae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698374395, "uuid": "bc0471ff-6358-40b2-a9cd-7164c363bcd2", "value": "12288:FaBU+WAX5k0FFpvGKsWDTFp86t0k/DCxl25Canq9Hfc9wzmXzD4Zae+bu89+YJCp:FaBUZXYFpJsWDTFpp0k/Dm5aq1f6w6g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698374395, "uuid": "e1d35d9f-ace0-4c02-bfa2-60b3bf1ff2e0", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698374395, "uuid": "a76ae89c-91b7-4ba1-89a1-c4f257921d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698374395, "uuid": "8f59a317-2bcc-43b1-b616-9ae7d3dc426b", "value": "SecuriteInfo.com.Win32.PWSX-gen.10829.12489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f58d22-7501-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698436097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436097, "uuid": "57a77ed4-e9dc-40fe-8fbf-b48992f5cc76", "comment": "Malware payload (Mirai)", "value": "b1eb9622064137404319d796e7aa0d27", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436097, "uuid": "c88d61c8-48df-4f1c-af20-b21ea76925bc", "comment": "Malware payload (Mirai)", "value": "c842c76ba576fe015b86508e1d6eae4647544983a4ace339869125ca030e9a2e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436097, "uuid": "fc2426a2-1aa9-457b-a48c-0a910429872a", "comment": "Malware payload (Mirai)", "value": "a41a1a09b5c450c3ea377c9333287035432c501c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436097, "uuid": "1b7ca122-781a-4c00-9c59-33a011c230c5", "comment": "Malware payload (Mirai)", "value": "27a57f6b77c9efafae76882d1df93a46a95c2d820327259665b1b4b9dd815eb27a2dfca5c84de0388645b773bd769dde", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436097, "uuid": "09b8e874-4869-4afd-87a0-481f2409989e", "value": "T150E2F111692AC57AFA308471E0F6868736661F7CB9FFB1A24466020DDCC2A4293F16DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436097, "uuid": "76b2ec2f-e201-4234-8866-de74f7cb2e1f", "value": "768:5EKkUgXAnURCr6HmDFStmYtrS9q3UELdR:tkEn7uHEemqHL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698436097, "uuid": "f2cde5c9-8275-42b4-b5e8-1fb8c848365a", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698436097, "uuid": "dc5799ca-34dd-47dc-b167-394e19009fd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436097, "uuid": "3400a406-d7c4-4b80-b0d6-4266e9a1244b", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690e51dc-74b9-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1698405017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698405017, "uuid": "dd7cdfea-5438-4b0a-b7b9-921ad9199d4a", "comment": "Malware payload (LummaStealer)", "value": "2b047121c8f94659a5a83bbcd6a46e38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698405017, "uuid": "98bf39d6-8685-4944-849d-21e32be443a5", "comment": "Malware payload (LummaStealer)", "value": "c89400e70500cd0faad8ea9d0c8d3cc2fc58408c1123dd3fbcd02e80d4bbed65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698405017, "uuid": "0905a00b-a7e1-463b-bd77-9c9b81be25e1", "comment": "Malware payload (LummaStealer)", "value": "ad978e4a03be057bc5bfd3e7b222873d74738e52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698405017, "uuid": "ff21653a-bd81-4992-b0e7-aeffc4574fd8", "comment": "Malware payload (LummaStealer)", "value": "6302106c15be31d3a8fe03a17fc67575902f89ec37d11950c676d62f63fe0ca6d1df1858d3c6a72137a00d7de07e880f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698405017, "uuid": "4ff8335a-050b-4b25-a48e-d214dfabd79e", "value": "T11F65BF20B8C0917EEDE321F387ADBA39055DF5E8077945DF85D80AEA97201C27F36685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698405017, "uuid": "35adcda1-7247-4aae-98bc-335b2191de40", "value": "eb953be94fd05c947d0863e280730026", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698405017, "uuid": "2fe57f87-66d1-4fca-b606-f52bb242e3de", "value": "24576:lidvz/22dAleBJd84cX/LoK5muc6hGlfstbcyW28V:lMvz/keBJd8tWd6OfyUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698405017, "uuid": "d8027646-61b5-47a3-9068-e9518d719570", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698405017, "uuid": "0b3a74a0-5fa7-4ad9-a13d-d3aeb0b52008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698405017, "uuid": "a47156a1-1a55-41e6-848b-ad46ed0552f7", "value": "2b047121c8f94659a5a83bbcd6a46e38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27595328-74af-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698400612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698400612, "uuid": "02d25c89-f62f-4cd0-b6fc-24089b44c3a5", "comment": "Malware payload (IRATA)", "value": "c927170e6b8263e79fdea7dc7708f9b5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698400612, "uuid": "27ba6dfd-51ea-47ab-85c3-7f1599a47a98", "comment": "Malware payload (IRATA)", "value": "ca8afae44aa1cc30158a386e4ac5056e404e48789bde33f2caf1ac66262e8f6b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698400612, "uuid": "67640351-334c-4fdd-af23-4476103310c7", "comment": "Malware payload (IRATA)", "value": "65151bebe8d230f2689ce7b1ec5ab4673885aadb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698400612, "uuid": "6cde5e7f-da53-4c60-b55a-0d97aaba4f82", "comment": "Malware payload (IRATA)", "value": "31c86412ac290aa2b01760194bf16164aa2f5e76df154ae999a44dddabdd7e907db06f4e62ed1b29743460cf4c902705", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698400612, "uuid": "8ce05d36-355d-4285-8a35-699f5216446e", "value": "T16BC52353F27AA91BC832D0727245273A51568E58CA43FB4A3A4873E924FFEEC47817C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698400612, "uuid": "7deef38d-5a51-4f35-b479-d7847469ef83", "value": "49152:BE7unzUR6/a7AZGN68nHF1yaQIxHHBxbLBASpHn8B49QFP3coVZ8:BVAOa7AkNRHF1fXPBAsO49QN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698400612, "uuid": "c8368228-5f29-4d0e-a02d-e96814062044", "value": 2744397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698400612, "uuid": "6f8c5d41-3969-4fbf-90af-b221a33f3892", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698400612, "uuid": "1b51cff1-788b-44cf-856c-2ef2170bd951", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2c7c92-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421744, "uuid": "d711a830-a5d4-4eef-9f03-5d2711c62d1b", "comment": "Malware payload", "value": "38b017ab62ecebd7bf019c75536d5b64", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421744, "uuid": "df4dd6b1-e7e3-477a-bbcc-bb0c870a09d0", "comment": "Malware payload", "value": "cc9e86cdf4406a5fb6f80eba880f08568e86d95b64d087923c219e154d6b6505", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421744, "uuid": "3f4ac394-f2e1-4fc5-99d4-4c5ad061ea43", "comment": "Malware payload", "value": "d0bc6e8ac9c8974de6903a1f178278398e957d90", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421744, "uuid": "a3a1eb84-2c26-4891-a3c8-02d7bc3647fb", "comment": "Malware payload", "value": "c342b1f6678d68360282ea74f8aa33cd027cbee726b2f6aeffaadebe4f9cf49d8424d54a4680ec18d06a8f68ee22bf7f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421744, "uuid": "8fc42158-f372-4c47-be6a-4bd7a3d52f0f", "value": "T16EF433E828E78965BF09BB9ED151FB31039CA1E0F3773DEF2026B93D14D44A661D1229", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421744, "uuid": "716ef444-f651-4764-83fb-cdd4fbd8951e", "value": "12288:NBU/RrtZ25DWZv5x+oKC2hCxX4bmi9/GIQHwFKiHzrPSp8YOa:o/Rrt05DAUoGhClJIl5HnSmYOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421744, "uuid": "831a0b3a-4e1b-454c-906b-8df07d1062dc", "value": 738891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421744, "uuid": "6559508e-c71e-470e-9bee-81b263ac3df9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421744, "uuid": "b3e079db-b390-4681-a2a2-0ce6be8d402f", "value": "comprobante.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2a487f-74f0-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698428676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698428676, "uuid": "ac4fba64-f4fd-41f0-bcb7-32d34e10a6b9", "comment": "Malware payload (RedLineStealer)", "value": "46b84c27dc9cb003f2de87fa041894c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698428676, "uuid": "3d855aaf-b927-40e0-9540-1f64a959938d", "comment": "Malware payload (RedLineStealer)", "value": "ccf11983ca3937cc907007b9fd6cbe9eab518c4bdc49eaa754186a7e9960839e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698428676, "uuid": "002e30d8-8c1d-4a30-be79-551c459118a7", "comment": "Malware payload (RedLineStealer)", "value": "f774ea66673ad2f3a5d8ce6d9e7b9467085fe141", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698428676, "uuid": "ed9572fd-cbf7-4b2c-9cf5-aa798fa04f1a", "comment": "Malware payload (RedLineStealer)", "value": "e22dec4a274651c81ab220772ce1dfc62c1945caa8c41639fc009ddd543b4f43af54a0005772ef562ad2be94d75c3b19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698428676, "uuid": "e30fed8c-abca-41c1-bd20-6b1c8cacfb50", "value": "T1AD564B87FC9455E4C1AAE37086669252B6307C884F3127D36B60FFB82E36BD46E79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698428676, "uuid": "b89755e8-e62f-4f8e-943f-82f133c4f26c", "value": "85cddd6092e65c1a58dd1e6e9ab9fc63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698428676, "uuid": "cfb695c8-e475-43c7-9b6a-8ce7b250e1df", "value": "49152:m5n0Jt7HeMXgrb/TDvO90d7HjmAFd4A64nsfJaFpF00000hnxQxJ9F4vZtlje1pF:mOHyzK0IEp3wm4E87AuVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698428676, "uuid": "b623687c-25ed-4e7a-83cd-33dec53c4e3c", "value": 6218752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698428676, "uuid": "dd6cc5d6-4cfc-40bc-9376-c5c9312621b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698428676, "uuid": "b61bf4ea-b1c3-44db-832b-7ace8defe4cb", "value": "drive.google.com.folders.documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8cb62a-7521-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698449556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449556, "uuid": "69de9922-5997-4f4f-aae0-3b8e582fdc52", "comment": "Malware payload", "value": "bf7860801f56cff276b0162bac287f31", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449556, "uuid": "8869434b-649c-44a7-8182-277662f8c7cb", "comment": "Malware payload", "value": "ce0a06427c6e5959ac5f152ad81a2edc31207fd4813115d5ff23167b5b05cc05", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449556, "uuid": "2e714dec-945f-4886-8c53-f1cf7a133af0", "comment": "Malware payload", "value": "be467b23596db6b7c83699035f32c4487fa90ab6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449556, "uuid": "00d31f58-fecf-44f5-991f-c0bd7a03c791", "comment": "Malware payload", "value": "61797da300269ca584c8eed1897aa5b4fdd3ebadd2cbdb8695a151c5cd5e5d279c2e0d3c8f9c3fc989be6775aa932663", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449556, "uuid": "05c8564f-fe2f-4ac3-81a5-3e713e170c48", "value": "T1B823E807F54380FDC09AC274066BB93EAC2275FE1238F2B67BD4A7226CD5E225D19C46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449556, "uuid": "522e9973-f4d4-46f9-86ac-d44e2e9316fe", "value": "768:vZCLNaOGW6bQHT9XmB3OIB/c1cV9KFf8D+wdYFmuqpjikQ5jvI04Wx2fEj1skKhN:oLYOGW6bq5XmB3OIB/c1cvK++JMBFUIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698449556, "uuid": "900ee8d7-7097-4210-9aea-c0c2bb8d63b5", "value": 46336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698449556, "uuid": "901a1d08-e4a0-4df5-a9af-abc9f61e9c87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449556, "uuid": "842393f9-4391-4150-b947-64d9c61dea47", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4638fa59-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421709, "uuid": "70200b43-40c4-4ae3-a333-45b125305737", "comment": "Malware payload", "value": "41b8a5aadded29c7ef57e41bb0102152", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421709, "uuid": "d8a4edad-e63d-446f-9fe5-7f9a19472d6d", "comment": "Malware payload", "value": "cffadf4bee42624c634e37a15e3da2aa08cc080e359df25b39fdda5645a62f31", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421709, "uuid": "88458d11-02ca-46b3-997c-dc0723036105", "comment": "Malware payload", "value": "ab78de829952f86e61f2fa351ce7bddf0c4a23bb", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421709, "uuid": "edf49024-d5a8-4a54-b89e-a12129fb1c94", "comment": "Malware payload", "value": "1433193edac8082706622aa8d63a65a4d4b1ab6c5e35f6d235eeba2aa5a94382e383de043241c48c93dc498d736052d7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421709, "uuid": "9830521b-959b-4ac2-817b-2a4652f773c0", "value": "T113E423C67CDD906EF59173E589988C0BA07579D018450AF2826786F88B97FBF9EE0037", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421709, "uuid": "8e77cb03-5f4a-45e9-b9ac-29a84be660af", "value": "12288:OK+e21N8IWOpr1Mu+VXSnuM95oOVPMX6Yyhf69cHhIAIY+2AmSMIHgJjAbDs2sd:O02f8+prO1VXk5oa564kTdZHCkYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421709, "uuid": "a84a109b-d19c-4c05-98c4-cf5109fb7bd8", "value": 684690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421709, "uuid": "4b44a7d0-0234-4843-99cc-5f06a184bb51", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421709, "uuid": "b4d96d51-542e-4421-81cc-5874d195d8d7", "value": "Factura Proforma MX80952312.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0e102e-74af-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698400945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698400945, "uuid": "5d4c8013-bb25-4360-b9a6-580b0cd5726e", "comment": "Malware payload (IRATA)", "value": "2444a1061bce3530f6c69c0809d1bd32", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698400945, "uuid": "460b3207-ac44-47de-b861-a5c7c7c60a3d", "comment": "Malware payload (IRATA)", "value": "d0ca97c90ac9048cc7013653861058239a97ca0fd3be1ee6ba4516f398c25f2a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698400945, "uuid": "96b97975-d12f-4814-b1b9-46fca70a5280", "comment": "Malware payload (IRATA)", "value": "1f56e898011b52523990b21ed8d3eed111efb93b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698400945, "uuid": "3e33038a-fe12-4fc3-a674-346a9c7ee3b2", "comment": "Malware payload (IRATA)", "value": "7e9b94cf2ee39869de93faf55301a500043404adaea64aa21379c1134e037880cba98d8f2cb867e34dbd95b574a645ec", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698400945, "uuid": "2642401f-01a1-44a2-84a5-e7959375df91", "value": "T1A3D52343F2A6B92FC472C0762645273A55264D699F82FB0A2904B7F974FFDE84BC02C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698400945, "uuid": "a034142c-68b3-4666-bfd3-186d4f505866", "value": "49152:mE7WdOTKXhIfDvo0krziTfCYwBJIY0/FFGg8I0j/GsDvSg2xPftLfE1:m9ddiDvo0EpfBJICgt0jRa5BtLf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698400945, "uuid": "57592583-0f82-4fe0-9650-a8850b71d12e", "value": 2760842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698400945, "uuid": "834a63b9-741b-4ea8-972c-dc95f95d8ed4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698400945, "uuid": "e51afb9b-1b24-4cfa-a192-64a77bb6b4fd", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c88384-749f-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698394083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698394083, "uuid": "cdc6c3c1-4f0a-4dee-a4b0-04894cca1744", "comment": "Malware payload (Formbook)", "value": "1b4bc7eb054142c70e87755de845e039", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698394083, "uuid": "e49d8d61-3793-4a07-a04f-306e22c9f263", "comment": "Malware payload (Formbook)", "value": "d0cbf22d6b18d9544e3c1488b363c099a29b698205bcca18a7eb1ae1c92d4343", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698394083, "uuid": "b1c90168-1e0c-4d8a-800c-f7ce9c8dc373", "comment": "Malware payload (Formbook)", "value": "27cb58a3d2371199b006154845b9b28028227d23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698394083, "uuid": "fede97bc-f830-42e3-acf3-df9fb405d723", "comment": "Malware payload (Formbook)", "value": "928ee70ac44b25853d24ce574f4f4608f21329348150ab0b5f85036054445cc345ade3c6bce4a38cac291ab51dc572a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698394083, "uuid": "7b5a431c-ce91-4a54-9b3d-4e89fcf36512", "value": "T177A4011A672088FFDCD07CB6AC2663B2837BAC770765932167E2FF6B803548756251C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698394083, "uuid": "dddc8fb9-6390-44cd-acf4-6b5c1cc80dd9", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698394083, "uuid": "6ace090e-5355-4d20-b4a6-9ebbccc351e1", "value": "12288:1a1rrvMZImfPZl/g7U2l4vW2klU1gQ3sfJ:eroZ3wP6+XrVfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698394083, "uuid": "75c8bd60-4a0c-4dbf-91f4-6cb56b049632", "value": 483842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698394083, "uuid": "64810e2c-e448-4c6d-be36-538e3602ed0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698394083, "uuid": "eda07198-2e29-4ee3-a3ff-e246b6c9a352", "value": "1b4bc7eb054142c70e87755de845e039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf115122-7501-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698436112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436112, "uuid": "265b7743-7d30-4e4d-9808-80baf820fbf4", "comment": "Malware payload (Mirai)", "value": "18e29d4cfad845fa987d13a579b79396", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436112, "uuid": "162b921c-90d0-4062-892b-f96a1970f256", "comment": "Malware payload (Mirai)", "value": "d0f199c925890d1b8e23c01f9742746d5410fa4cc4c194a5f59b7ac6f940b7d5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436112, "uuid": "39d74435-d7bf-41b2-a0e1-f3a910d5598f", "comment": "Malware payload (Mirai)", "value": "54e419f6fc654883a26e7420c0d658455a6a6411", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436112, "uuid": "59b3e62d-926d-4372-9097-e887ddfc136f", "comment": "Malware payload (Mirai)", "value": "425351220d7a88a054014acf7d7c9609b3889475d6894fa99ba01cee5627bd44b125e61854c1eb0099a9e060c49cef4a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436112, "uuid": "7f602af1-ea72-4350-b2d1-025bdfc53378", "value": "T14CD2D0ADE57442C5FD4D1C3E80CC3FA14D19E681231BDB9567228C8E5B36C5BF26A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436112, "uuid": "a0a163ba-0cbe-43e9-91b5-de626f617303", "value": "384:Q8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjbopEf1RWGVCz0Nvs:FMYHb62x4ahQ3CfdwLjnwWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698436112, "uuid": "d70558cd-6825-4046-98c4-e35374d6114e", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698436112, "uuid": "ff7aad3b-e5f2-47ff-8d6f-88a29aa578d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436112, "uuid": "b421e2f8-019b-47e5-9e98-c2fd0a0458ef", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61688b7c-74df-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698421325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421325, "uuid": "9e8dc3b9-eb20-4439-b2af-56d2b7b16c3c", "comment": "Malware payload (AgentTesla)", "value": "cb9088db397e3a4cc261a65902056464", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421325, "uuid": "5db95286-c71a-4d6e-9ab4-926b36223f3f", "comment": "Malware payload (AgentTesla)", "value": "d1669f781c62b70d49b1864ba3d98e67c9082cfb50b7865925b596a4465bbc32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421325, "uuid": "3e668648-f227-4227-b9af-b3fe1c36a828", "comment": "Malware payload (AgentTesla)", "value": "0196a611ac13353ef871008c6716d575ff1bfee9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421325, "uuid": "7ac012d9-4bc7-4cce-8619-d93b70408744", "comment": "Malware payload (AgentTesla)", "value": "e93ce531c8f3df85b357ad7062d5b5599bdc1b240ba22f61017d2ce4ef79aadfdb3e6587dcd725d78734e3874fb76d86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421325, "uuid": "8b0e09eb-e164-4175-b53e-d4e116511e33", "value": "T1FE340F027E48EB15E5A83E3792EF6D2413B2B0C71673C60F6F49AB552451782AC3E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421325, "uuid": "74a2ff78-5a43-4377-b1f7-c48cfad9ca6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421325, "uuid": "1ade2064-f1cb-45ab-85e1-63ec0e165881", "value": "3072:LeSiGv3nffm2YhYuwg6CfUlscANWHsY/N5WSjkNGnR:CSiGv3nffm3hYuwg5fkX0WHx/VjkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421325, "uuid": "fadf59db-4ac3-4033-846d-265cc2b3969e", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421325, "uuid": "e89f28e9-48cd-482b-9727-177fee21266b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421325, "uuid": "dc100005-e3f5-433a-a099-218d8926e9bc", "value": "16984213240871bc2bf47b7d07ab61536800b98ecf40c64ee3a5f4949a8608d6120d68a63b704.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3494902-74a5-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698396525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396525, "uuid": "06acd825-b9d0-4d1c-8da2-169a7eb3a32d", "comment": "Malware payload (IRATA)", "value": "903c3d0e0a648734c44bbe2577095519", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396525, "uuid": "ec954408-2ef8-415b-ac83-c6e651b6ac38", "comment": "Malware payload (IRATA)", "value": "d1f1b5aa505a45bc51284f4ac68ece601b3986adc6249370eaf56aba0f4d05ae", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396525, "uuid": "0a7cce94-67fa-4ba2-b4a9-aa73dc999f97", "comment": "Malware payload (IRATA)", "value": "a8d579b8d22d69be927816537a218b1df9c1f1c1", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698396525, "uuid": "dc5dd531-6789-4957-8ca7-1284e55f079f", "comment": "Malware payload (IRATA)", "value": "b676a8098c81d71156ea0a74f849930cc261d0fe024db03d758d43b0cbb41759258ff9f43623fa02bf8989568aa10b63", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698396525, "uuid": "482df4dd-0f40-461f-8502-3dc1412230c0", "value": "T1EC851247F36AA957C8F2C33224751635213A5E15C787B646390D33BA6BBBDE80BC42E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698396525, "uuid": "c247d160-0e7d-4eea-af1c-f4cb929438fe", "value": "49152:JsmjkknGX7t+oiCVA9bDosV5UBg5uei4kcCYYg8bVm:DjkkGXx1isA9foO559isCLVm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698396525, "uuid": "c9d86a05-c21f-4b77-852e-448e30774928", "value": 1862870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698396525, "uuid": "e062ed12-8749-46e6-b0bb-8b38a08abd77", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698396525, "uuid": "d38ff0b5-1a8f-43e8-abd7-e5f5952e172f", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09479f3c-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698422036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422036, "uuid": "9610a07b-1360-4c01-9d85-f1e9f8055ca6", "comment": "Malware payload", "value": "b816479aecc3d939abfcad56330456e5", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422036, "uuid": "a8587368-f023-4f2b-9635-0b0c1f287cfb", "comment": "Malware payload", "value": "d2c3b3c2cf07c5faa5e8872da6097507ce956f98eee742409691446ccfcdbd80", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422036, "uuid": "333bded5-9d79-49e0-8f61-929356035dd2", "comment": "Malware payload", "value": "369a73da80dd0fac343fd4d8b6b9b04740ae10b0", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422036, "uuid": "ac19cb3a-4fa8-4157-bba3-dfbbcd2b4551", "comment": "Malware payload", "value": "6c13a4b2d44f236437a5bb0879df523ee3be2ed4acba0b2932b452c1f8f80dbb48f900b8a6f3e166b376a059c5667dc2", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422036, "uuid": "c2ed4c2e-fdaa-46f2-8d62-1e900a89b9ca", "value": "T19672493EFB97477CC555913486F38B39FAF9F02012126B6D86F8D3355E60B24A32A548", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422036, "uuid": "76f904bd-a10c-413f-824b-ed8a7d3ba4e8", "value": "8b7d6f218f07082b5df448bc58285040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422036, "uuid": "056c02c4-2c44-46ba-8a89-65f4b67e9bc5", "value": "192:1+t/9myWJfaZc7KYJsY+JOLC7JJ+3VZhHPU4Xixgv4e/0HZcq6Gho7oYr7Ah:E/9DsOcGYqpJO8+Z0j6GhuFr7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422036, "uuid": "cbcecb2f-5180-4ea9-9d08-ce9282d1aeff", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422036, "uuid": "546f77cd-bf3d-490d-b442-a3432323410d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422036, "uuid": "fbc05da8-e249-4e25-8fe9-ce9c708ae148", "value": "Billing_Statement_NOV-23_TD.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e26e79f-74c3-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698409186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409186, "uuid": "97c7088d-d21b-4704-8e28-9f7ccd8b621b", "comment": "Malware payload (Formbook)", "value": "5b4f7f27fe95479f93e6e7554b8c69ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409186, "uuid": "90f608c2-78d9-46ee-aae1-36f89bc40838", "comment": "Malware payload (Formbook)", "value": "d362e0e034354b095c7c280dc7da92cbda181e53cbc20503073a4208f8980c49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409186, "uuid": "93ab568b-800e-4e51-97cc-30b5070b0c26", "comment": "Malware payload (Formbook)", "value": "81593824367a0a07b7cc44983108b4dd845dedba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409186, "uuid": "91e31963-9b37-4a9d-80fa-b56e28bfe666", "comment": "Malware payload (Formbook)", "value": "f568cb41349455badfebe8a791fd166e0baafeb5d8c626048739ee41b87ca60cb3c29b48e23b5535a1df8509e27d9669", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409186, "uuid": "f53870ea-7b4a-45d8-9445-4d23c5bc47ce", "value": "T19305E11AB686DD11C2695737C5D311145B70DB92A327DB4F39CA23A51E033AFAC4A3CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409186, "uuid": "626f2a10-7ab9-43c7-b677-34e6cbb51293", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409186, "uuid": "ab9c789d-f00e-4425-8aa3-e71c6ac92dc6", "value": "24576:8mSXHBpFp5iX4eGftBIwEtydrZbiOFtLn2ePO1tb:SrFvlRzEmbiwL2ePOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698409186, "uuid": "65840a95-bb2c-45e7-8bb3-ab1aa67dcbeb", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698409186, "uuid": "828da492-2f25-4fec-adb8-1fc0d521c9bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409186, "uuid": "f6dbb4a0-e2fd-448e-b41f-48e7caf2b51f", "value": "bank account pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d820eb-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1698422426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422426, "uuid": "c55d1800-ac01-40a4-b677-89bf8cba4fea", "comment": "Malware payload (DCRat)", "value": "7d87aa618a3e5aafddb21f57e9be3706", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422426, "uuid": "b062a32c-2925-4506-bc48-9a41d1f55ccf", "comment": "Malware payload (DCRat)", "value": "d47dc12a7fade9a187bdd2c2dbff87980eaba846bd12421ddb1fd12c10799655", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422426, "uuid": "24769028-3e07-4cda-ba1e-9536258a1e43", "comment": "Malware payload (DCRat)", "value": "55cfe5d7e3ec6a668eb08d5f5631fa642e2fd8d2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422426, "uuid": "539f1963-a689-4660-8839-17c9f3deb939", "comment": "Malware payload (DCRat)", "value": "6e3bccb4a0b4ef54a2ec34f7cd81628435bb9d7b15f057edfc4ebe8f58660a4144eb497811fcf8797e5ae4090871a24d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422426, "uuid": "ca6a1016-2ff9-4a0b-8e18-5385266c36f5", "value": "T109C6234614CEC0F9E7C01E34E6076AFB17F15DB6C8A14C29FEC97C4EB472E61A066A91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422426, "uuid": "650ef6f3-0e7b-4286-a3b6-9636756d81d1", "value": "6c117346b0d0bffeaa7c20cbc489c68a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422426, "uuid": "118fa3c4-90ee-4796-98d7-e6f527b4112a", "value": "196608:r95un8yx7e4f2Pq7Cif84ky8D/ux9EW5chDcnBjRBYpw4HupHVjojpZ5c:WL79f2gBLK/udGhKFzYpJupHtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422426, "uuid": "409df301-ffeb-4112-8468-8c8c821f5c95", "value": 11589120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422426, "uuid": "912fab10-afd9-4131-bf3b-33d5e105901b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422426, "uuid": "83b9fbde-0fc4-4c1e-b49d-00d7c0068ce9", "value": "7D87AA618A3E5AAFDDB21F57E9BE3706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06125f7c-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698422031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422031, "uuid": "ae82b6ef-5491-410e-a344-90973fa2ed41", "comment": "Malware payload", "value": "16fbd9da2cb2cdeebdc03833971011ab", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422031, "uuid": "f497cf40-2b1f-43b9-bb9e-75e2b9daed69", "comment": "Malware payload", "value": "d61addac062baa5eff7ba3d8590b529e3851a957c2854a66a725c1018595b61b", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422031, "uuid": "05201a74-f450-4e2b-9603-80f80263e777", "comment": "Malware payload", "value": "57ff993ceda86e99c1e53df21748e29d064b103d", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422031, "uuid": "717b2922-d42f-4dd2-8a0e-672642e44ac4", "comment": "Malware payload", "value": "36b58125b8c8ab59369549ee8768cf3b3725c67bfd6a6b38194bd9db4d2c91d96c66629120cb8c91b27a25e71af0f080", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422031, "uuid": "a601cbc9-69a2-4ca2-840f-b23cdb608c92", "value": "T145723A2EBF97577CC459917882E38B39FAF8F01012524B7D86F4E7355E60B149B2AB08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422031, "uuid": "1fe116f1-9691-41e7-be31-702c75566208", "value": "8b7d6f218f07082b5df448bc58285040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422031, "uuid": "6ef53ac9-b4fb-4eed-a3bf-aeee0d7f4ae8", "value": "384:EWT9nH4klfxV1v10JOk+Z0rbhwhuFr7C:E29nnx/10JoZMEuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422031, "uuid": "a593e71f-1654-4978-8f61-74f9415751cc", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422031, "uuid": "c18333af-b8a3-47de-9a64-975a8031fd04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422031, "uuid": "e159a218-ff53-4a60-854e-d5ea70c5bbbf", "value": "Missed Voicemail_OCT27.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c038d1-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421707, "uuid": "5b3f3eb6-6b4b-4036-b2b0-986fd60d34bb", "comment": "Malware payload", "value": "5d617e4a59dd03f0901d64b9ec1676ca", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421707, "uuid": "8f3fdc66-b956-4666-97fe-693d030dec5e", "comment": "Malware payload", "value": "d6631f47d610e3ae511980d3e00093adfd4596680e81de6e9384cbb112d35dad", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421707, "uuid": "9544f47a-10a3-4d22-8d67-1e2302c1c802", "comment": "Malware payload", "value": "0f489488d6413198edeb658c7f5b54cb594e9c75", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421707, "uuid": "0b3c2cd6-4677-4cad-8837-3810915b1cab", "comment": "Malware payload", "value": "8360043a7de8f513ccd7647c5997ebf77475ed7c240542ac4abb394e343e1db1668f207d1cf6ded6b8174040e10298df", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421707, "uuid": "abe0dd26-b2d4-4752-8bb1-801e9175e9ef", "value": "T19CE433A9423B041DF3EF4331B7E4D803A758A989F3B51502FA5B78CC29F1B99CB69521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421707, "uuid": "6df2fa37-cc52-4c7e-9edf-ebd95ab643bd", "value": "12288:Q9ynAH8h8cAYw8VGbGzOCqpHXqPlvGeBOZhG67Xn5MEB6kozEm4FrvsMDdv:qynU8h8jYXGbJ+GIO/Gc5hhozf4Fr00F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421707, "uuid": "427df330-0935-4c43-b27b-90b01af6cdcf", "value": 722179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421707, "uuid": "7ec608ba-aad5-4da0-b495-a534336bba28", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421707, "uuid": "633d88ca-c0c8-4e7c-8795-a49d697f435d", "value": "SWIFT26794306.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "155e2853-7521-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698449544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449544, "uuid": "07fb82a0-0f02-4adf-8b78-6927794d21bf", "comment": "Malware payload", "value": "aa1ff61882b7bc45dd658d4bed319126", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449544, "uuid": "8ff3d1dc-593c-4253-b977-900478a7b50b", "comment": "Malware payload", "value": "d67b6f9759fb23bdbe5035121414a1763fb9cea261378dce201072427a91c329", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449544, "uuid": "0a68b56d-9d6e-4bab-a489-56a18b28a760", "comment": "Malware payload", "value": "2ebff224aa309a0a71696bf140c2bf23d9590181", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698449544, "uuid": "c18ab4c7-e0e8-4eff-baa1-e8d1c2dc89f5", "comment": "Malware payload", "value": "c8add20a486b3bc9f744666e9bcfa2c891661176435443c81a0be2ed2dc13f45472390939e33539b177161780a6368c9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449544, "uuid": "7ba4fce5-9e01-474f-a783-a8b0e740531d", "value": "T1E303D651F8825A27C6E1127AB6BE4A8E372073E982CFB617D9214B103BD551F0D63F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449544, "uuid": "097ee4cc-7218-494c-9b36-99595bd81cb0", "value": "768:RqILBdhxPh9NeftcG5dm80LyFBWEu/tOr4MkKvlw9QSo8qMyfE1JomcI2/NkwKkE:k0z+f2G5dmSBWjV8kZbJqK1x2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698449544, "uuid": "abcb436e-d597-42e8-93ce-70439f68ce1a", "value": 38116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698449544, "uuid": "52696c21-9f06-4fa9-8b26-47fd15749e23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698449544, "uuid": "d77ecfdb-34bc-49a3-9e04-b0e64c810ef9", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0a69d0-74d9-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698419013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419013, "uuid": "1698fcc6-34de-47ba-8bac-24e3b498f28a", "comment": "Malware payload (RemcosRAT)", "value": "a018f5bf49a0dc782dcce82600f98cd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419013, "uuid": "7eab3040-faf7-454b-9aa1-dce31d008acb", "comment": "Malware payload (RemcosRAT)", "value": "d6fbf2f15cfb25c5d7b256955aec6d940799d33f008a76919b0592caa677ba48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419013, "uuid": "4aac23f5-c92c-45c3-9ae1-bf0cf7607404", "comment": "Malware payload (RemcosRAT)", "value": "ed9a2566be92661e006ab55d27a6548138ed38ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419013, "uuid": "d94b74e1-d1b6-4048-8ab1-4141aa700330", "comment": "Malware payload (RemcosRAT)", "value": "2bf1f497f8f063d34e5edeb9b960c30d0960f7894345b94ec70f2c6204005f4ce64f8343ebe84851baed4dc304fd8d56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419013, "uuid": "978f9649-c3fc-478a-8f7a-2d2ab71c33c3", "value": "T10265128AF5001991CD689374193BDD395B26ADBEBC34844E20E97E6B3F77A93207E017", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419013, "uuid": "a07212bb-5d58-4738-8dbe-db9f4869dc07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419013, "uuid": "be539741-1500-40cb-84bd-72150e70993b", "value": "24576:y5xFJFU89hkKuJUxUXogrOdJmn8rUgxc8ZZZus/uROSi8N/YXymr9T+eJDsMMQh+:yPHF3IKaUxULSdJmn8wHuJuRxF49hQMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698419013, "uuid": "c81ad342-3415-4ae0-b9ee-405ff129bd87", "value": 1518080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698419013, "uuid": "3b909e03-1a41-4716-8ff2-fa79c537f3c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419013, "uuid": "26fc86fe-1b80-4ec5-9c67-90ea5c6ebd78", "value": "IMG-0253-WAA6647734849932885477638Onwloaevka.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957fa97f-74bd-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1698406810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406810, "uuid": "00a11c4d-69ff-4475-83dd-bc1cbb7a7246", "comment": "Malware payload (Pikabot)", "value": "f892d9371b459567585af9b11c88190c", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406810, "uuid": "f5be2ab7-d60a-4ddb-8989-2f4c5fe7ce61", "comment": "Malware payload (Pikabot)", "value": "d8a23460c27dc87c59745e83f154eea5ca41781c2eb6a3fa19a8f007e9cacf36", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406810, "uuid": "2ecc9a25-815c-4d8e-b473-aa8811d6fa78", "comment": "Malware payload (Pikabot)", "value": "d4886a7247d2a4808ff9ae4deee5db3411ed36ac", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406810, "uuid": "ba1a8039-39cc-4f7c-b92a-78dc2568bf38", "comment": "Malware payload (Pikabot)", "value": "f63847ad5a8e10e633f8d63689c316f9b1fd4d98d7d19f013ceea0a01e69506727ad5f39b2cb51515b0d88905089e4aa", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406810, "uuid": "999299ca-7a36-4732-9127-8531dabdbb24", "value": "T10EF3237B45965B8392CE4889C8664BE195241ACED0DAADFE7873458D7F8CB0B4280B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406810, "uuid": "1fe99e02-1ef9-4a89-a846-e5d6b25ec6c6", "value": "3072:wJ2yJQ+DAXTyH48vP5NNeY4G7vKONBnk/1hPms5/iddAYRsByS2d:wp9885NNeYFbKO7kbPmsWGYzS2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698406810, "uuid": "c8ab4a82-4958-4619-8149-a0ddc1f84bca", "value": 163330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698406810, "uuid": "2ebe11de-e097-4c3a-946e-95ea37f14283", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406810, "uuid": "c64b91ef-1338-4574-91e8-c57bf1f55fac", "value": "Quou.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c587de40-74d9-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1698418916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418916, "uuid": "14300514-3051-471b-9118-9e4df83cec1f", "comment": "Malware payload (RemcosRAT)", "value": "40e08fd798be4285fdb2f2d61d60e6b7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418916, "uuid": "0e48f7d5-2537-453b-947d-3fa37aa61da8", "comment": "Malware payload (RemcosRAT)", "value": "d8be08a8a17bb34b0cea5dfdd8f99ff1ab22b63ab5b5e3c23ef70567e0dd85f6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418916, "uuid": "65e9873b-57ab-47b3-9d2f-5ee3aa3ea143", "comment": "Malware payload (RemcosRAT)", "value": "2070864b7fefc1c1f233e25f564b6e40d8b16921", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418916, "uuid": "7d3d2722-1643-40c6-9e52-1f17adbc0197", "comment": "Malware payload (RemcosRAT)", "value": "dfbf86730d6ac192f8d8df7d1c0cafb9f770547ddaba2c24e26f62949791f5550fe4086a2e818cf90fb5ec078a0fcd1c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418916, "uuid": "4d957804-c0f1-4215-9cc6-82e96a424e73", "value": "T1D834446DC74B01A98F666336975B0E0442FCBA3EF34451B1306C837533EAD39A6266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418916, "uuid": "7a60d2d1-8740-4280-b8d7-ee644017d278", "value": "768:SwAbZSibMX9gRWjLz0qgRkzSREuOc0sLaoIBCcVv00:SwAlR6whnREtsL+wcV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698418916, "uuid": "786dd498-501f-455e-8f6f-f823a8542f4a", "value": 240461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698418916, "uuid": "d8d37a5b-16e6-4f2e-bae0-1f226ba72d5c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418916, "uuid": "b5b3eab3-5a0f-4f26-9490-11d3fa72cddb", "value": "EUR-32608-Swift.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34afcc0e-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698422109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422109, "uuid": "fe6f0bdc-2242-4042-b738-9cebe2e135c0", "comment": "Malware payload", "value": "f592f24ca7130459948b80cbaf131b4c", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422109, "uuid": "6f9bf52c-a4be-4570-b6d5-e06f8a57a2ab", "comment": "Malware payload", "value": "d9e5ffd49e7d5d5fb48bec3843c78187bb940592a01247d536281991602a23b2", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422109, "uuid": "85344573-2086-424b-9b23-f06b8761dc77", "comment": "Malware payload", "value": "bc7f44cd0b8c615272a2030fcd13f0f67acf87ee", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422109, "uuid": "c565a0be-87d2-4461-a9e1-0bdd48a7e53f", "comment": "Malware payload", "value": "bf7ffa6f9c3302a3c8131e4765350075134983d8923ce7f0211af56660eac981b74074ef465f363e7f2f99a9a51346a9", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422109, "uuid": "2a524385-da7d-46b5-bfdb-1a3cdbfcb123", "value": "T1D472282EBF971778C855917482E3CB39FAB9B42012514B6D86F4D3366E64F24933A908", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422109, "uuid": "391e32fb-40fc-4996-8b5b-3679ccf5b199", "value": "8b7d6f218f07082b5df448bc58285040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422109, "uuid": "78dc963a-8638-461c-8355-6d22089cd98f", "value": "192:h3uNpN9GvNDeI5lfWqV1vSMteJOv27JJ+3VZhHPU4Xixgv4e/0HuYKfho7oYr7Ah:lWT9kNXlfxV1v10JO8+Z0RKfhuFr7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422109, "uuid": "9d355023-5f65-4e54-907b-cedeb188ac6f", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422109, "uuid": "77251bed-13ee-4f74-95a1-1aac822b3df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422109, "uuid": "7849a49b-ccc6-4d6b-9348-df5043c91cb2", "value": "Billing_Statement_NOV-23_18.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cc2205-74db-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698419500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419500, "uuid": "686171b1-bab6-4f63-bb13-97df9f987aed", "comment": "Malware payload (Amadey)", "value": "ceffd8c6661b875b67ca5e4540950d8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419500, "uuid": "80bf848d-9b1c-42f9-a214-68e9048ac90d", "comment": "Malware payload (Amadey)", "value": "da0bf5520986c2fb92fa9658ee2fcbb07ee531e09f901f299722c0d14e994ed2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419500, "uuid": "01800557-ca7e-4b90-916f-c6a454c6d185", "comment": "Malware payload (Amadey)", "value": "91b53b79c98f22d0b8e204e11671d78efca48682", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419500, "uuid": "f7149278-3243-43dc-94ee-4cce180e3f75", "comment": "Malware payload (Amadey)", "value": "2ac6b0b480a608973eb0d564f135dcda9a115f2d33d197e09b9b49a8c44084bbb425b826414556edc25c9140f85d387d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419500, "uuid": "f7bb50a2-7c2a-4b9a-aedd-fbb929ed439e", "value": "T1D6A35C057295C071E66E1A3A1874AFB5877EAC14DFB04DEB27400E7AAE243D1BD35C3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419500, "uuid": "cebfaf6e-5df3-4e53-95a4-05b60cf2a584", "value": "91452bf3259a3ff5928a3bb7f6be301a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419500, "uuid": "f1ab1d63-71f2-4336-9286-ed4e5ed6d0b1", "value": "3072:bHEjxEfCk+EeY22JosmvWuQRRIQrT7xUD0YNS60Z:DsqqdLsOWuQRbaHNS60Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698419500, "uuid": "7a4d9918-4a2b-4e6a-944d-ff8a9dd14c82", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698419500, "uuid": "5ca8f091-7f99-4de2-a741-557e3803fd54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419500, "uuid": "d6fb67ba-d206-41c8-bb8b-7ff76c96f914", "value": "ceffd8c6661b875b67ca5e4540950d8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5024cb16-74d5-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1698417001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698417001, "uuid": "3794dd44-4cc8-42dc-aa1c-ae310f2ce7ef", "comment": "Malware payload (Smoke Loader)", "value": "d865fa56421e49ea4a7033ee0cf96600", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698417001, "uuid": "f352969a-d7f8-47ae-bb1b-5d8133b51e7d", "comment": "Malware payload (Smoke Loader)", "value": "dba3ca5e71159adfc7063dec816dcf339a9db5c92bb3df6ba08e431574bdf94a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698417001, "uuid": "c044bf67-2aea-4106-8e8e-8370dab03b87", "comment": "Malware payload (Smoke Loader)", "value": "a4dd5f11ad53cdfa5764552642d55c2ca860e6e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698417001, "uuid": "e95c349b-d043-4514-9c49-bf3afb8212cd", "comment": "Malware payload (Smoke Loader)", "value": "7f1c01d5da50bbdcacd9daf2ab825536c6b9898780ef6c926c22d4a8e998eed6c133d257c8b17bf2052f4fddc327c8cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698417001, "uuid": "bee07c1a-1523-48d6-9eb3-345faeca97d4", "value": "T11075334BFAE50222D972577465FB07831B367CB2DA30973F7A12A4B90871666383533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698417001, "uuid": "31e720d9-b8a4-4a82-b8ef-ea44326690f6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698417001, "uuid": "fc2055f8-5c60-4dd5-8930-f403734f683e", "value": "24576:9yUpqPS+Z7Uw60kkeEaDv42FDTCcI29NSZEoGOFGHZV:YUQPS+Z7m0EDvfDGcI2mZ6OFYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698417001, "uuid": "0696a24a-8db5-4eb4-8a6f-5805a7232955", "value": 1623552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698417001, "uuid": "f213922f-fd3b-4478-9c26-bbcfe515e3a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698417001, "uuid": "9951aa74-b24f-45de-80cf-76301192ba92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb772ab-74d9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698418926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418926, "uuid": "24975602-08aa-4061-bc81-b627c7a3ac13", "comment": "Malware payload", "value": "5f6bace90a96b8075063ec763f9a1195", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418926, "uuid": "8eac01e9-9a8f-465d-aec3-d4c6e64a4637", "comment": "Malware payload", "value": "dc0da35f1fa0f39ab6fc14b854b8d13f863dccb4362a38d621f7d6ebb6dc6f5c", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418926, "uuid": "44eac4b5-6793-45d1-a623-6d20935c0c10", "comment": "Malware payload", "value": "2cc314bd4413f2727fe0c9b85744b0301d59fc98", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418926, "uuid": "518dd9ea-4f7c-4ff1-972b-a2e19ccdd0ad", "comment": "Malware payload", "value": "87524e4b1dbf7b49f1fc9bd9d01f714787ddb995d19e65557a7d14b8d935e9242f4a60e88ffcbda1405603e5b921a9cb", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418926, "uuid": "793d9b21-2af1-4d8d-a533-452b37756a9b", "value": "T143145205FE668AABC648E7304CE69368B337DC414F6B074735C4B22D3DF3DA1A64A685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418926, "uuid": "f60abc4d-fc0c-4858-b4e4-68389f1f95cc", "value": "3072:5NXq/NdUrA6jRtguK7QLP5mvrF0oQYn4tEK9XdeAN5+Y2mqmst9PG/Q+oMOL91xn:PXq/NdUrA6jRtguK7QLP5mDF0oQYn4tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698418926, "uuid": "abe3b891-9208-4ca0-b62e-f92cbb5f204a", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698418926, "uuid": "c68c431c-5bd6-4065-a848-26d37b469e1a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418926, "uuid": "5a04a8eb-48bc-41b2-b524-e701b7527a2a", "value": "R5_\u9999\u5ddd\u5927\u4f1a\u7d50\u679c\uff08AB\u7d1a\uff09_\u6700\u7d42\u7d50\u679c.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715311c4-74d0-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1698414909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698414909, "uuid": "56d221a4-0429-43b3-a33d-6b0034a5c78d", "comment": "Malware payload (RecordBreaker)", "value": "4bbd362e49a343eb07dc6219d13690ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698414909, "uuid": "fc31dbc3-6491-44d5-8fae-30ec13b53b35", "comment": "Malware payload (RecordBreaker)", "value": "dcddb99058b08d352f96a6d45b70498657e44da4bd530cc12233f72484312a32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698414909, "uuid": "84f8d119-2fd8-4db9-9917-469bc173b706", "comment": "Malware payload (RecordBreaker)", "value": "2199c9e08891a2906091e70aff762cfae6f557cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698414909, "uuid": "3c63fe07-3e74-48aa-bbaa-e7a4b112f039", "comment": "Malware payload (RecordBreaker)", "value": "6b8835e7d01d4d53861e7b60a8d8ac847200dd73a11967ac3270708beaa152f8f58c8803bcafec4f03655a8566e3dabf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698414909, "uuid": "caac34cf-5cbc-40ab-930a-80774826be41", "value": "T1ED44AE00B4D1C472D873253209E0EBB65A3EB9214BA55AEFE7D41FBE4E313C096F1A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698414909, "uuid": "d11adad6-d129-4f6b-920b-e2de4fdd11cf", "value": "e6c8a6ac2c39bf589d2a9a54b0ca583e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698414909, "uuid": "ea653ead-2b69-42bc-af67-6b55f76944db", "value": "6144:V6Ewkt3ONRthXVcKF2/5mQqPDWqAOocuPyBl:VCkteNRthXeElyQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698414909, "uuid": "47d5e1c9-9dfc-4135-a133-ab79212a2843", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698414909, "uuid": "454c194f-4d88-40e4-8759-ad4c540fd8d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698414909, "uuid": "63024b78-afa5-43d0-ba28-80662d434c71", "value": "4BBD362E49A343EB07DC6219D13690EC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4115d42b-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421700, "uuid": "7ef59246-aea3-42c8-95bd-51f9a6708147", "comment": "Malware payload", "value": "039eba4bafb381fe347a7435849b5d9a", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421700, "uuid": "7d4b48b2-8a30-412b-8dde-3d68fedaf89d", "comment": "Malware payload", "value": "def3931c1660d5754aef40141ab3b266de1c4ef1cf77a14fc7e07247dee20121", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421700, "uuid": "983775db-1bf2-4488-bc73-ca4b98e37186", "comment": "Malware payload", "value": "5185a52c5c36addaf829a9c6ee71beab6ddf4df1", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421700, "uuid": "47ebde61-915a-4883-afb6-6754c1d683be", "comment": "Malware payload", "value": "748a32c0e7f31c30357bed3bf9f19622316b36ae0a1344c6389feffeecfcc8196d89c9625e91840ac8c141dfc8c5329a", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421700, "uuid": "11c75ca9-8f7f-4175-8fe0-b15d1eb5c354", "value": "T13EE423A8E033726BE6520634EDC2250BDDF075ADF8B6C3E436B4B32465051AE5439FB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421700, "uuid": "e983d736-700e-41b4-9989-d6a5cc6e88c9", "value": "12288:N441JZ67nym0GpNbYcnAtmBFZNyjicw8yUCDrbGuoe/EaejBIVsMXfCVOvr2lBHD:N445OnSGpNbYcAcJNyuNjDr6uoRlIVtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421700, "uuid": "2073b40b-aff7-4e89-927a-e4f7ff896d1f", "value": 704366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421700, "uuid": "af91849e-b7d1-4db3-af3d-914b374e1a57", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421700, "uuid": "7189df79-173f-4b79-9855-b8d93525a777", "value": "WAYBILL XTREME REF STA335E .xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54bef04-74c7-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1698411185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698411185, "uuid": "60e2a08c-be13-4561-8ca7-7304bc504d28", "comment": "Malware payload (Healer)", "value": "3b58f52654cf24ceac5a682fedf56ea6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698411185, "uuid": "dbbb5f48-8977-4bf1-a58c-981c108f0baf", "comment": "Malware payload (Healer)", "value": "df0002f4e0d0740f433a7bb2fbdf8f9c4e2af603b307cd8554d7b139708e3e7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698411185, "uuid": "8008c488-013f-4bb6-96ec-711100d1dd7f", "comment": "Malware payload (Healer)", "value": "4e012ff7eed34f394136e4490f7bc281613f84fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698411185, "uuid": "0dfbe6f6-9070-4d94-9abb-8e87ff2869c1", "comment": "Malware payload (Healer)", "value": "6b22ec1eaeb118bf3ea4cc818ecbc0f1f248a850decee06b7886c4765a5adfbfab073c2072d13801097c0757e1c8dbdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698411185, "uuid": "ca9ed409-6b3e-4cb7-8c4b-616e2543c959", "value": "T1DD75235B76D89033DE7213B414F692E3173A3C22582083F75B42D99F0DB26D8A5B2B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698411185, "uuid": "d63156f1-d7f8-458b-8ac7-466ce44e51f5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698411185, "uuid": "07dd70d0-975f-4d3e-914a-92404fa531e7", "value": "49152:CdCs0UvZJ3HkXkf+/1ZvY1qaKidaHjskUWQP7RQ:Vs0UvZJtf6qdaH5SP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698411185, "uuid": "2e6cebcf-c7f1-4466-b7db-d7bcf67cb167", "value": 1615872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698411185, "uuid": "ffd56687-48d2-4d0b-85f8-4901ccfae2f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698411185, "uuid": "7139d8fd-1d39-4339-a142-14a19760593e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f3944f-7504-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1698437122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698437122, "uuid": "42ec575c-2f44-47b4-8a84-831b4fba6328", "comment": "Malware payload (njrat)", "value": "a72ddd0f47a665c08aba89432b4ae9ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698437122, "uuid": "86ebdff8-8299-4daa-a726-fb744958ffc2", "comment": "Malware payload (njrat)", "value": "df000e309b7f6e6645a8f6e5b63604d5b81e4ec4a63002f00e4b20eb79ccd79b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698437122, "uuid": "bdc6171c-e666-4fe3-9ed6-321b78095c9f", "comment": "Malware payload (njrat)", "value": "863f68f1f5299fb040cdcf112cf69ccfd8826b4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698437122, "uuid": "7306d4c2-e1f6-4d88-a051-35955c6c69ff", "comment": "Malware payload (njrat)", "value": "f2b1247a4d84e2a0645dd20866a15462928e1878954b0de9d711bbeaefbb43bc88e92baa7911e445008c788a0a78f5e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698437122, "uuid": "9ed0fd1b-278f-4ce8-aa75-0e8794b68193", "value": "T199534B4877958A54D2BD2E7814F2A7518730F50B6D07F72E08D160FAABB3EC44A42BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698437122, "uuid": "ea95dbd3-7c6a-4c0b-8950-93bad4257108", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698437122, "uuid": "496dfddd-4f6a-4c1d-928f-e7773f251dcf", "value": "1536:S71Mwk7oN36taQviFw1gGWiz96BnvbTfLteF3nLrB9z3nOaF9bnS9vM:S71Mwk7oN36taQviFC5WizMBnffWl9zD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698437122, "uuid": "68e11912-2b41-432d-9d44-42559d547e5d", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698437122, "uuid": "cacf0e07-88ee-400d-8e04-3da1fa6c4fbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698437122, "uuid": "cac09c66-164f-4723-a5dd-858e652a50e1", "value": "a72ddd0f47a665c08aba89432b4ae9ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3840729c-749a-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698391621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391621, "uuid": "84a7e4f1-db05-443a-a154-efe8cb9406f8", "comment": "Malware payload (IRATA)", "value": "a3cd6bdebf212c3c3dc89f0ca9097b74", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391621, "uuid": "456ba0df-b139-48c1-abb4-1883a2875241", "comment": "Malware payload (IRATA)", "value": "df4f1783b5d6ba479970e7776fc40ea2d881504a648caee138186502df74af36", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391621, "uuid": "06794646-2f30-4160-89bd-42533f0cb5b5", "comment": "Malware payload (IRATA)", "value": "01bff858f70e6ec6ae6f127db9a9d0bae83905a3", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391621, "uuid": "e845420d-9980-4982-a3a3-050d92951132", "comment": "Malware payload (IRATA)", "value": "34409be7ebba9450b51175db2b91b0b9caea8f3ab8e87875f4f93f7ab0bd8952fb5f601ed7e5e72b47bf7b66ee4cb4d7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391621, "uuid": "f8d9bc54-1e08-4140-98b2-07deb10d26de", "value": "T1C1D52353F237B967C836D1722144273A601A4D6ECA46B78A394C77B974BBCEC8BC52C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391621, "uuid": "c673911c-f2f3-451f-b635-6bc8f74de489", "value": "49152:eBJ6JtBjp0t60A2GYItRZoZzp/lsTOOPMTstbwd7dWhAcxGsgdN8w269Qn22GY0X:en61d0bY1mzDkLMwwRdWhAfZt9S2tyda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698391621, "uuid": "c26b5f0b-2062-4ac6-b7cb-63cd72ecf831", "value": 2748546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698391621, "uuid": "9df70ace-232e-4bb6-9889-b3fa05bae473", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391621, "uuid": "b5847319-c97f-4373-8c0c-76b8828fd699", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e4a9fb2-750f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698441828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698441828, "uuid": "03ae65e0-125c-4633-876b-eb52622726a4", "comment": "Malware payload (RedLineStealer)", "value": "5956828a30988a1087cd9643c5e94f3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698441828, "uuid": "73f2321d-85ba-4536-8fff-6e6167b0365f", "comment": "Malware payload (RedLineStealer)", "value": "e599cdf301bdca7ac814280a10471f47efe703173d844052838e3b9f85caafb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698441828, "uuid": "b7ab14e8-a751-4b8c-af05-6d304219452b", "comment": "Malware payload (RedLineStealer)", "value": "493a77a1be6e0021552f35f71f646ba2e9ad7531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698441828, "uuid": "a7310dee-ba70-4fad-a337-f53f052cecfa", "comment": "Malware payload (RedLineStealer)", "value": "e8462584c5db5cd5cbfb8d3bbd08db9f9ccf6f37be77f701e1be8777a5407ddb26ce722b1f8b2a4aaff76b4f2e888d12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698441828, "uuid": "12c0d834-e7b1-449b-bf42-e00463f3c1bc", "value": "T1F2752357F3D98472D5F11B3888FA02D75A31B8528E78036B764AA47B0CB29D9983173F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698441828, "uuid": "eeccbb17-00aa-43c7-9274-4092dcd7eff6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698441828, "uuid": "f564ead0-098a-4fd7-99af-6c88c22f3095", "value": "24576:HyuRNexXl5qep0tatglC9dLsz0C71sQkD87iO6mB7/xw9VqIemN/6u/:S9TdKXlMVs4CZzoN6BFCgIj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698441828, "uuid": "1baab76a-8669-4d6a-897e-a58a74487d2e", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698441828, "uuid": "e3a30c53-f914-4e51-a1c9-86ae2f56822c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698441828, "uuid": "f8c00f45-4a29-47c4-bb62-b268c27bec68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1900514f-74c3-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698409178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409178, "uuid": "a41c713a-d001-4cff-9460-45d35e66cd4c", "comment": "Malware payload (Formbook)", "value": "6a148a073cde8f3cfc851ea153201f7f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409178, "uuid": "bac48278-2bd0-48a8-954c-4cc99cee4ab8", "comment": "Malware payload (Formbook)", "value": "e5ce044ff0a61572bb52a2d37b4fcf6094528e598a466192d5afb9099116d591", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409178, "uuid": "e061a882-2f97-45f3-8b37-32d0a4ca7d71", "comment": "Malware payload (Formbook)", "value": "061f6632e5ba434103a7d334d2f9a1f84677cd62", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409178, "uuid": "7e47ae82-5bcb-4431-ae5a-62d6d215d372", "comment": "Malware payload (Formbook)", "value": "d4a65d601b698fa5a8fe14addb445a62789a0f9c1247f10743cfd5b81ae79efcbdf0dac45e72d76df77ca74fdfdb8aa7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409178, "uuid": "e3d1f073-6e1c-4921-b842-e3cf4a48d1c1", "value": "T1C3E433C7D1CDC8AAB9A98B6F50919DD7EAF328512076FCFE601650F288B74C305D48DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409178, "uuid": "67870b34-f71d-473f-8801-92f4a463bc2f", "value": "12288:/1bx6fQny0hfnD0yCq0iPN33a6KdkSKfqpIHuOuYTyuO0GVdgbWQldQr:lx6syegS3q3dkSpIwYGujGriWHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698409178, "uuid": "4a8e06ce-0c1c-42cf-a59d-0e7e23aaa18b", "value": 686065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698409178, "uuid": "8013b956-89f4-48c7-9ecb-29101a2a80a7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409178, "uuid": "568074ab-63b6-460a-a568-64794231aceb", "value": "bank account pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07b5f1f-74df-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698421511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421511, "uuid": "9df64723-2480-4e99-a11c-a2e0eff09b3c", "comment": "Malware payload (AgentTesla)", "value": "798f2512990dde2ac89b0054d5861dc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421511, "uuid": "a5ebd107-79f3-45ab-a9ba-bc7b535549c8", "comment": "Malware payload (AgentTesla)", "value": "e600c0403e5f3c3416684354c5c3a9a44c2b6942439377f9fbc81980a44d2615", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421511, "uuid": "ff51bba1-d01d-40be-955d-b5149817e468", "comment": "Malware payload (AgentTesla)", "value": "2b2df6c470621741c78d174733208ec8fc97d271", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421511, "uuid": "20edf5ca-7975-4dd2-9930-091d5b2fe7e2", "comment": "Malware payload (AgentTesla)", "value": "9a753f266bb068854d7a1a829e19564df01117b96f028e7d16791f117bd6f7f5df43294c94da8ca56d6bb59e6d6b23c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421511, "uuid": "19c76378-c413-4717-ae9b-9c60b1afa6de", "value": "T1CDA412DE8F6DBE2EE12322F58635C8A00B6D65B26405DB1FA90770471F75782F882EC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421511, "uuid": "0fb4d557-23e3-49c0-ad2f-a74c4b01c862", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421511, "uuid": "4c4277e8-8eba-45d5-a8a1-c9b248affa29", "value": "6144:6CKjEasJm3yyXsuZxBvcAVo5JRwBZGEKosN7+Iby6dwC4WEa1SqpYE2Odtyqd72Y:6fjEyvsuZxlO58GEKDjwxOSsYrOiqoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421511, "uuid": "c8406d55-7b5f-45d3-96d1-ff47ede7fa38", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421511, "uuid": "24ec15a6-d1af-4087-9d24-b405544a554b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421511, "uuid": "eb7d481b-45d4-4bc0-b776-2bc8e892b96f", "value": "DHL Express _Kon\u015fimento Takip Numaras\u0131 - \u0130thalat G\u00f6nderisi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ddab971-74ba-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1698405508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698405508, "uuid": "18fe04b4-e7f8-4a95-82a8-e138bc8a5c54", "comment": "Malware payload (RecordBreaker)", "value": "ba18532590a6ad556fb84e5cf78ac801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698405508, "uuid": "1a2ecbd6-1819-428a-af17-5cf1a7e1a02f", "comment": "Malware payload (RecordBreaker)", "value": "e7abd2759610e70543aa0ad745c99b23e9b090ef383bbd88bd8ed7e0a80b7695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698405508, "uuid": "d6d01ef9-98fa-4290-bfc3-2f663bc8fa02", "comment": "Malware payload (RecordBreaker)", "value": "4d778fe0e3f275948102ee6ced9b93dace588971", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698405508, "uuid": "7976682d-3741-48d5-85cd-65a4a5ae9ee1", "comment": "Malware payload (RecordBreaker)", "value": "1e770eb13b7096ab8e1d533b2d65abeb92e3b49965cd261514d56ffd6f848167fac35f42df59c0e319631112e9953be9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698405508, "uuid": "12d787e9-329c-4ed9-a3f3-adc504726114", "value": "T16775231392E98473EAF253B464F717C716397CE06CB9562B1309EA2B1CB21C066367B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698405508, "uuid": "7869a365-2a8e-42e1-a33f-6bd3007bbd53", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698405508, "uuid": "aad81607-82a6-4a59-9f92-59810d383e2a", "value": "24576:kyD7jxMusnYeCIECzjiyiSZcNcWR2soH/ixzFX1TzcOKKNbik4wN4Dp3n1Qug+XB:zXjxqECvxi3NcxHOzfTgOK+i5ZvX2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698405508, "uuid": "7838306e-081a-4f54-96f5-bd455cc1f478", "value": 1621504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698405508, "uuid": "d6024e0b-7fe4-4dd5-99be-e448bb166d7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698405508, "uuid": "81d8aedf-8626-4c48-8961-346afdddb078", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8dd90a4-7501-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698436102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436102, "uuid": "784a119e-4e07-47e5-bf0d-e1caec5b3c9a", "comment": "Malware payload (Mirai)", "value": "7c30124e5bedc149bf960da8045654e7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436102, "uuid": "8ca529c3-f430-4fb8-a8af-72c5fca9e476", "comment": "Malware payload (Mirai)", "value": "e7b119085da952fb2c13e697023042d9c5359633a520781b771b8aa435ed9b96", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436102, "uuid": "f60a2001-b0e3-4386-afe8-44675cd7100c", "comment": "Malware payload (Mirai)", "value": "433e16b1506d71b1ea7a51b8ec1f9f999780b85d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698436102, "uuid": "952d5fb3-ff26-4cab-8f2c-86c352e3cbd4", "comment": "Malware payload (Mirai)", "value": "dd0b0d93f74abfe0abff793cc77b3798e54c862f6e55f6d0d13a2d474fef7c6163a133b4f8b41b3c414f28ede8110416", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436102, "uuid": "bfe0e8ce-d0ec-47ab-b156-553636c5464d", "value": "T13E33F1B682ABAD61C27052FB162E649D64152378E3F5F10366250470EACB1F35AFE7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436102, "uuid": "26d86c49-dc19-450f-94aa-ae382f80a7e0", "value": "1536:3CoqsGR4eB3g0Vmh1IxIpC8J6hL9VE8amFZP7R32:Soqs2Twh6P8JeLJ9ZP7R32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698436102, "uuid": "d0aa6738-712b-464e-9954-bb88955475ac", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698436102, "uuid": "607b7085-8340-4c77-a42d-fae7d4c89f2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698436102, "uuid": "5b0f2ee7-b5bf-4592-b27b-81eb3094d0af", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3756993d-74ca-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698412235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698412235, "uuid": "ce3d1149-42a3-4783-b996-5dcc4c3b4917", "comment": "Malware payload (Formbook)", "value": "15c3d4c5d902c6713220c7369178c772", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698412235, "uuid": "1b5fdb65-2ab2-4fe2-8757-28e7c4880f58", "comment": "Malware payload (Formbook)", "value": "e8348b77a5b22815d739b1063b46490386ac3fd40d6c7fe3ac70933170270cda", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698412235, "uuid": "e91b839f-5c5d-463b-a497-f8f164dcc83c", "comment": "Malware payload (Formbook)", "value": "88aaf8b33a7bf90a2d4384e272ef247abbbee695", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698412235, "uuid": "2fc3611f-729d-42c6-8254-dd41956df28c", "comment": "Malware payload (Formbook)", "value": "9b1550c5f25e701eb2c6c7475a6c03f13fa90fb3382b3e30b6d0e0c7f1182a522eb6414443d228ad07a9313eda223f4a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698412235, "uuid": "8e8a7a45-d062-4bcc-bba5-766a902e2567", "value": "T14AE433C7D1CDC8AAB9A98B6F50919DD7EAF328522076FCFD601650F288B74C305D48DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698412235, "uuid": "828cff10-5d20-4a6c-a7a4-93573709fd5d", "value": "12288:C1bx6fQny0hfnD0yCq0iPN33a6KdkSKfqpIHuOuYTyuO0GVdgbWQldQn:qx6syegS3q3dkSpIwYGujGriWHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698412235, "uuid": "3c91cdb9-accf-4501-a44e-a41b71c4cb21", "value": 686079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698412235, "uuid": "4d8719b5-c106-4b5a-81bb-8fa81914125a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698412235, "uuid": "c85034f2-65ab-4525-99e2-a828aab4e0e6", "value": "Outstanding Payment PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1619e0d-74df-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698421459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421459, "uuid": "c589081c-5ec1-464d-bff2-c4f3bff8f1c0", "comment": "Malware payload (Formbook)", "value": "03c6c5902081f3b4609be90063951033", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421459, "uuid": "91326637-f482-4a30-99fc-ea8d7cb156a3", "comment": "Malware payload (Formbook)", "value": "e8a820b07074384be7c1ffd4f07a230ebce48a21f24a67ed1c0572a6570b2410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421459, "uuid": "5661d4c4-a9f4-498d-8fce-f3653aeb9e71", "comment": "Malware payload (Formbook)", "value": "213905aca52ff56a59f0b2e659ecb4b57a65f639", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421459, "uuid": "666fb611-a733-455c-9202-b5c4810fdf82", "comment": "Malware payload (Formbook)", "value": "ce21b77ce12a5b70414e3dc8013f6a0348bfde5040e87f6f28ab6af8332c4dff0824b0bbc04f29acf9bcde152c9235fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421459, "uuid": "c502ecf4-5f75-4ab6-a3ab-4fb77ac05a2e", "value": "T1BFD4125473F46760E2BE9BF9E8B1601153BAB6562CB4D39D0EAA10DE09B3F148710F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421459, "uuid": "721a779e-52c8-4530-bd09-401c3c50e86a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421459, "uuid": "23446834-cbb7-4bbc-b4e8-a815cf22a12a", "value": "12288:pGTMjCT4/igOanWe78fSWO+cpharzn5FDpCZpzK512xETTWqar1t:cAviAgpChannIrzK/2x8bar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421459, "uuid": "528aa8fa-d04a-4e68-9f92-4c0b57c98cdd", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421459, "uuid": "66a3e404-16db-424b-81b8-01e371efac13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421459, "uuid": "eaf9a2f1-dacd-48fc-bfd0-2c201d1de2a0", "value": "FedEx_817434848264.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344ec5d8-74dc-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698419961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419961, "uuid": "51e06671-a929-4e65-8707-cf30ce4842f2", "comment": "Malware payload", "value": "b8f79ee6fb45720c3a56481fb3048143", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419961, "uuid": "ceba39fb-e281-4b9f-9b63-7b6e9311da31", "comment": "Malware payload", "value": "e91d449da4d19cc1ea2ed4d467986014a9ffed14a82a99ed7e8c5ab771ff8396", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419961, "uuid": "b47c166d-1ca6-4869-8f19-e3fe23e4d472", "comment": "Malware payload", "value": "4a299cad2e621a32f87307d0d8075fba8d2d7577", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698419961, "uuid": "2aee2f51-6c1a-4662-bb61-b66d749fbc93", "comment": "Malware payload", "value": "d23452aa4e30621ba83e30d28f303ecbb8b893d6579624ec19d39788646e73eabadb52e35d15776ed44e9fe7dc3721fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419961, "uuid": "e0336136-c67c-4690-86ff-3068a09b83b1", "value": "T10A37339BAC1000B3D3ADE13101BBFBBC496DE47A2F634D1FDB6A1D21A5714EE4979806", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419961, "uuid": "871e1b99-3832-44f9-a917-a3b9ac5364f3", "value": "bdaa4f11fa75ae7944b223ba584c1f57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419961, "uuid": "a95326b2-da1e-4984-8a2c-1a819d06e293", "value": "393216:hxtvfaAs25wsK8uvFpVlSSgmMrmNpPQyZMKi2VkhoXWy4Gg:71fHsDYeUoMrmP2d2Rid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698419961, "uuid": "da7de124-31c6-41dc-b46c-d789d765428a", "value": 23848910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698419961, "uuid": "a67d6064-8883-4b9a-8be2-7d7995e444e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698419961, "uuid": "7f3241b3-b0bc-427a-b57c-8ac85b992179", "value": "fud.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55326b61-7496-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698389951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698389951, "uuid": "d47dbbd5-ecb5-4a4f-b413-aecad642d55d", "comment": "Malware payload (AgentTesla)", "value": "ada13e987698b7b3a0c9ee0263129e2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698389951, "uuid": "448661b3-b921-4c61-9631-7350ea3a79c1", "comment": "Malware payload (AgentTesla)", "value": "eb5af2126a5addd6623f2e9d8cca8c74f6f6871ad04206aa17b3e832209a45a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698389951, "uuid": "60280db6-d31f-410e-9696-d09d4ea4b8ed", "comment": "Malware payload (AgentTesla)", "value": "2758ab11b8f99721227c5748cb461de6caf74e2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698389951, "uuid": "75af41c7-5a8d-4b6b-b63e-7b80f7afe172", "comment": "Malware payload (AgentTesla)", "value": "be0b5e8c8504e6c6550396658b7be60f8e9ef462b89bf571356465bf93519b4ff173991159038f8d43e1a02ec93a87f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698389951, "uuid": "f37d2ea4-b301-47fd-ae6b-580c73133e8f", "value": "T1018423FD1DA3EA42FB216A730AF88A134D29F75C19D48A11E8557FF4CDB580A54EF00A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698389951, "uuid": "6e1ee598-0a50-4f27-b1ed-28ddae08b0af", "value": "6144:oXXSRQn7FgWVn+vIrbUO3Q66DaMyr6wX3qQGMDE0VCrWqmY0FW9/ulG1hRi1UZ:SSRQhgWV+vIXAaxP3XE+dY0FW9/J1hRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698389951, "uuid": "246249db-26b9-4cab-9005-86d5ff2eab2c", "value": 384351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698389951, "uuid": "d96ffb55-7003-4462-bc87-6f01d635f425", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698389951, "uuid": "a0c11991-6ec2-4732-9eaa-681179356f7b", "value": "QUOTATION_OCTQTRFA00541.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285dc790-74ac-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698399325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399325, "uuid": "7852e970-5639-4a8a-8a91-b6bfdc7e7b14", "comment": "Malware payload (AgentTesla)", "value": "f9ac7ceee8afa9410d5627d05ab2dfc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399325, "uuid": "812401b2-9730-46da-a87a-48ad48952d05", "comment": "Malware payload (AgentTesla)", "value": "ec2271f3c4ca253b780325c5b0486672f7f4eb8dd9c355501103aa87f0c5f9f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399325, "uuid": "90a8d44e-6a97-45d0-83eb-9e5a08d9b4ff", "comment": "Malware payload (AgentTesla)", "value": "a8df7b260aa4a22376acbc33d209ad7cc940c308", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399325, "uuid": "68a2e707-c5ee-4257-b3b1-1965998fe434", "comment": "Malware payload (AgentTesla)", "value": "f4b321a5971846cfbbb232dc32ce8de6b5c7ff9d2afc09e63d23101c7c6bf2f2ad535dbffba8ea7eb0b6ac3b3dddf695", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399325, "uuid": "d902e469-e086-4cf3-abd4-703d868a563e", "value": "T1A805E1097A46DD51C2685A37C4D791184B719A92A317DB0F3ACA37990E033AFAC4B7CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399325, "uuid": "8ec6a680-d4f9-47e8-aa10-2a2d505569d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399325, "uuid": "7d422b82-2deb-40f0-a11a-81a622361475", "value": "12288:TdV4Mbj7Cy6f8UgFFpvx4V0oQjMeEXogpu28fi89xKu2YCmIIIhBfQ6fhq:TdKM3ef8pFp5/X0p8a8987YCmIIQ3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698399325, "uuid": "4738814a-cb4d-4bf3-bab5-af54cc2304ef", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698399325, "uuid": "fbbbefb9-84f6-4fcb-9939-b0252c91c7a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399325, "uuid": "edb87307-2c75-441e-b4f5-cc3717805e04", "value": "RFQ MT-764439977,xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8412f51-74d9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698418921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418921, "uuid": "09e6403d-934a-4ab1-a47c-8310690581c3", "comment": "Malware payload", "value": "ecb84d1d776f5a503e077956ab37195d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418921, "uuid": "8cea8341-c0f9-4873-ab22-b2f9a0146e16", "comment": "Malware payload", "value": "ed19994d2593c4d27c2b9258a7fc4c29e92b0a4a57553abfac115764f620745c", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418921, "uuid": "0daf894a-2dac-4e7c-9555-dfa608597edc", "comment": "Malware payload", "value": "00ea39e7e8ceea59f6124e814d1712ccf53882be", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418921, "uuid": "8567ddb8-9052-454d-bc2a-5eb4ed4dae7e", "comment": "Malware payload", "value": "4a870710461d9ed645d2f276fa6d39ec019db7e643a6972e171e035a2f4871d2eba94457a97cfc7d0817ae2b3293b09b", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418921, "uuid": "c6166c80-4e4a-47ff-9242-e1f488266708", "value": "T1E4345209BE26CAA7C648E7314CE693B4B336EC414FA7070735C4736D3DF2E91A649689", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418921, "uuid": "0e9f9c3b-9984-4810-8b8e-151cfc1411cc", "value": "6144:sXq/NdUrA6jRtguK7QLP5mDF0oQYn4eE8vJhrsUp6:BNA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698418921, "uuid": "490b989a-38c2-4945-bc08-b6fc767ba0ce", "value": 242688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698418921, "uuid": "9edc1355-0e97-4c69-ade2-815f1f021a4f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418921, "uuid": "378e1498-bd28-40f1-a434-2df5bb0d02c7", "value": "R5_\u9999\u5ddd\u5927\u4f1a\u7d50\u679c\uff08CD\u7d1a\uff09_\u6700\u7d42\u7d50\u679c.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfba451a-74ba-11ee-8907-42010a9c0042", "comment": "Malware payload (Vjw0rm)", "timestamp": 1698405619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698405619, "uuid": "3ec391cd-9c49-4e83-b647-f7954c2659ed", "comment": "Malware payload (Vjw0rm)", "value": "6e554787e0c33f72d3b40fc0a9efb825", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698405619, "uuid": "eb8e7c86-a7e6-47c6-85ff-62f9358dcddc", "comment": "Malware payload (Vjw0rm)", "value": "ed3867747c220cc11f5115b4926c74d63cec22cf2d58f5554b832dd2a02718d3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698405619, "uuid": "245f8e7f-1437-4fdf-9dbe-0de3342ec229", "comment": "Malware payload (Vjw0rm)", "value": "127105cd35967eac8a7299fccd7532c56de70a0c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698405619, "uuid": "acbd7971-a26c-44d1-9bb5-848a13c4ecb7", "comment": "Malware payload (Vjw0rm)", "value": "3be850d8fb75d4023b3368a4175d9bcc9131b0014a7f45d5631318fa00a92b2702e56fa4d8997890c8c4375dc8c31a3f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698405619, "uuid": "ce16ecc4-dd30-426a-8bb4-9a9116982df3", "value": "T141150BD525343A1FD3F3E624C311D622AC35FC232D9B11D2BE543A4AAE76C585DBEA20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698405619, "uuid": "ecaf80b5-c278-474f-983b-81b91849e9e4", "value": "6144:MQDZ29oDbwBXoS+idRXVY1205EBnBCHUMvXzdgfe44jSY77rLQwfu4dr4fgbQZer:XN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698405619, "uuid": "764579de-342e-48d1-9c88-bcfbf8792a1e", "value": 922568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698405619, "uuid": "bd0555a7-1241-48a3-a6bd-7c3975037305", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698405619, "uuid": "f1ac435c-2540-4de4-85e9-a30c5f3e6f61", "value": "proof of payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a962cc-74c3-11ee-8907-42010a9c0042", "comment": "Malware payload (RustyStealer)", "timestamp": 1698409300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409300, "uuid": "dc2553bb-2d2a-403e-b51e-d608bf1a9e14", "comment": "Malware payload (RustyStealer)", "value": "b372cfb08f7b57b6a8d70ce02239a6e6", "object_relation": "md5", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409300, "uuid": "6d9fffc4-44f7-48a9-b809-4c3906d5015f", "comment": "Malware payload (RustyStealer)", "value": "eea5e774e35521270b16aeb78c0049da0606764edef5aa9ac2c92bdc977b4cdb", "object_relation": "sha256", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409300, "uuid": "b18f3c63-351f-462c-a13d-0cfffe6a494b", "comment": "Malware payload (RustyStealer)", "value": "b58cca238bd41ef717a10b6524fba9a1db9997a1", "object_relation": "sha1", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698409300, "uuid": "ceeff2a5-8566-4ce0-af41-93e2282fd302", "comment": "Malware payload (RustyStealer)", "value": "b8f878e8d5fcb40d2ea3b544c5f194ad7f361cabf4d40a1b0e15ca681d1bdee79bf385441195c370d4726550242f32ec", "object_relation": "sha3-384", "Tag": [ { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409300, "uuid": "a294a669-3b9f-4dd7-bc55-a72fa10a1e1c", "value": "T15B34124694EEF781B59DA7B2D0AE9B108A75D33A660DE511A0F485D13CE33C81EDAF03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409300, "uuid": "c39c33af-a68d-4712-b83a-724f763a5aa9", "value": "6144:E53soI5SFa+30pC0jstcCm1eRef0zdWFPl57qHXxCGu:EdsRSM7kwknxIFPloHXxCGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698409300, "uuid": "edd2e1fb-3ec1-4e63-8a34-7063a9d1d06e", "value": 239783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698409300, "uuid": "f2a87a7a-cb4a-4b4e-8e0e-54c169457095", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698409300, "uuid": "026f6542-1a2b-4c84-8ca5-6750dab51a70", "value": "FakeAPP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc048def-74ac-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698399680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399680, "uuid": "8f57d843-daf5-4989-8d93-2644d719f689", "comment": "Malware payload (Mirai)", "value": "efa248289c8182cf051ab71f35032c7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399680, "uuid": "eb208243-5c1f-4dc9-a247-0ab271b08b50", "comment": "Malware payload (Mirai)", "value": "ef57cf99520bfc0192aef232c8c99b5485d460b31dd080ca68f57f7766715b30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399680, "uuid": "18185235-5691-4dcb-b856-6baa5566f9f3", "comment": "Malware payload (Mirai)", "value": "0cb970170522336c63dc255d5773a2b2a0fb2c7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399680, "uuid": "328f8ef5-f642-4aef-9397-6316da1fc6e2", "comment": "Malware payload (Mirai)", "value": "128f91c4716423f2468b3da31c1edb59b0a5022554f6c1272310b37211cd7315c5c972971fac2b61c12fb8152266a84a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399680, "uuid": "3eed75a0-dcef-4f9a-84bb-a8377b0f6313", "value": "T111A2D01825CDED72D170943BE13CC217AFDB83B612FF317A1E0806ADA48581AE77EA45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399680, "uuid": "6aae00d9-cc69-4a79-9695-11172df8f255", "value": "384:YAmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSb4hymdGUop5hXs:Ypoh/DxCvhdR4IjWVFbSUs3UozJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698399680, "uuid": "284b6dca-7bcf-421b-9ff5-a002d86b1ade", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698399680, "uuid": "efbc18d7-ad82-45e4-99b8-e6d99bfe3d0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399680, "uuid": "fd3834cd-7dfe-4040-b5e9-cbb462b4bba3", "value": "efa248289c8182cf051ab71f35032c7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542950d4-74ea-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698426027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426027, "uuid": "e1ebaf0f-699d-4677-8d58-e1cf72979a3b", "comment": "Malware payload (RedLineStealer)", "value": "9184952bb6db07a808e043b2b321bbdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426027, "uuid": "da473916-12f7-4267-b9d3-a6608179f294", "comment": "Malware payload (RedLineStealer)", "value": "efd8311e76a028155ef996e650b487a287dec94890c0863b1ffe3be4504d8984", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426027, "uuid": "e0a04f7b-e2e1-4a57-b5ee-08b20e64bf7a", "comment": "Malware payload (RedLineStealer)", "value": "8e4868252591682c06d217ed5051d1aeae4a1e59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698426027, "uuid": "1e4cd81b-d9df-41e8-bff5-69d07c48c56f", "comment": "Malware payload (RedLineStealer)", "value": "bcf8d3f29d10ec25858617c1b1de581dc9b6df5111f12b0f9618074b24a852338369f215d49d6e915d1412ccb478551e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426027, "uuid": "85fab51b-f3f9-4d4d-a8b6-3ad837220d40", "value": "T17B85012275E159F2E4920C332D25D650BDFB6C209E1148AFD39836E56A337D0E2259FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426027, "uuid": "aa08fdb2-c6b9-427b-9373-ab7333dfc637", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426027, "uuid": "3a9ab9d8-1f1b-4695-a8f8-6116be6384e3", "value": "24576:jubsnafAPyjNdUX6hpoob/pTWIOeYAp/NBdASo2jo+GBsQsH889eR8IuggBvT2SZ:LILjpTQmNBdSsXFeR8IGBvTkiXRW2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698426027, "uuid": "c62e940b-1de6-4ec3-a4b2-9c2456e93b57", "value": 1771901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698426027, "uuid": "5c45b2a2-9880-492d-b2aa-0239ec409624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698426027, "uuid": "f8d7a802-58bc-4213-90ec-18aecbfeb0c8", "value": "9184952BB6DB07A808E043B2B321BBDC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf1f4b5-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698422415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422415, "uuid": "83c1a65e-1ebe-49cd-8d32-8516fdcfb153", "comment": "Malware payload (AgentTesla)", "value": "910000304ded0b7d71f772a41e697d72", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422415, "uuid": "06392f0e-bd29-4ef9-b5ae-271b3e5b05ba", "comment": "Malware payload (AgentTesla)", "value": "f03427705f8aeb1b5f9ef7f9f5382a6c666bc20cb811304421e1a3242a2f4ae3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422415, "uuid": "297e75d9-5a76-452b-b311-73e4b266b193", "comment": "Malware payload (AgentTesla)", "value": "2d5da1fe2f1874ff8974d7b8a66953659d4a68a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422415, "uuid": "0fe00aa4-6b41-4704-8a65-a0b7213902b5", "comment": "Malware payload (AgentTesla)", "value": "eaa72ebbc5d6640474d345079943030971b5eaafbe00514b135df9f7a706f71d421fe236bc23a3bfec53fa5acb605584", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422415, "uuid": "c590e222-3a75-48f3-8c8b-d317721a4d36", "value": "T19D340F037E88EB15E5A83E3B92EF6C2413B2B0C70633D60B6F49AB5614517825D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422415, "uuid": "51baaf15-b378-4125-835e-f897ec9c47ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422415, "uuid": "bffcbf74-c29b-4c9c-8521-ea03a9717eb9", "value": "3072:NTziQgYPuQ7zXefL5ZxJyXNI5QIqbI4NkEkF:NTziQgYPuQ7zXed5yXNUqDi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422415, "uuid": "b92c9b6d-2fb4-412a-8b41-2e4037bb125d", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422415, "uuid": "80e849da-e82a-426d-a135-d9ee1b40e3ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422415, "uuid": "8a8cf4ce-fac8-4175-85f6-01c8e230bbf4", "value": "1698422413e77abbf01ff3c9cbd74ad9715b49e2de35e388feff56dc6001193ae530b3a7a3949.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2318ec49-74ac-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698399316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399316, "uuid": "860a60e0-d926-4c91-914a-5b60bdfaf158", "comment": "Malware payload (AgentTesla)", "value": "bf7f45f59c26fd94ee7c49de6157fb9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399316, "uuid": "19ac263e-50de-4506-8866-ab456404a907", "comment": "Malware payload (AgentTesla)", "value": "f09d78e29ac0dee8047a47f4570c41b9701e54cb8cbeaa48f49848ebcf8d6b8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399316, "uuid": "57723df8-05b8-4581-82f4-ccc4a3a6988e", "comment": "Malware payload (AgentTesla)", "value": "d0eedcc9c089df9594fa7d1691c82e8c582e701e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698399316, "uuid": "14311306-193e-4263-95ac-f0321c5b44aa", "comment": "Malware payload (AgentTesla)", "value": "e76eb5f22fe0264ee23d4cf693dbadacd787d7eba62bc3c7a21f6d62ff0582ea0140638decd761990bb4dbac608f16b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399316, "uuid": "2a412f0c-2f28-4433-b3f0-0093f9e349b3", "value": "T11AE4239B118E7AE3FE0184C76094AFF4BD219ACAFA508D85D63760AE8F43C7F9151748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399316, "uuid": "68d797ca-0376-4a5b-a04b-b53e0edd1b4f", "value": "12288:2WMcqX7b0oQI/SsXfVFsPERoY0nRPxKE2cCmiIIh9fQ+PBfoq7aks9:2pcqrAsauYPEs8NcCmiIyZPBfoq29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698399316, "uuid": "07631527-3078-4aeb-8cc6-7278f1280c0b", "value": 710198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698399316, "uuid": "bafdaee6-912e-4da4-a832-62bca1edf1fc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698399316, "uuid": "50662c8e-b91e-4338-8e7b-1795e842667a", "value": "RFQ MT-764439977,xlsx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4682ffa6-74b9-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698404959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698404959, "uuid": "22f86da6-97b4-4e26-8d7c-71f92ee5aa1e", "comment": "Malware payload (IRATA)", "value": "660d7791f1053786885b355380e0db89", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698404959, "uuid": "c5824da2-9a19-4f34-ad2d-1d1347ea3504", "comment": "Malware payload (IRATA)", "value": "f0b6107612d670bbac7154fae766e862e79a9b6791a7aff2ac6d9d60b3d2e8ef", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698404959, "uuid": "1b6e8885-04e1-4b3c-8107-8329f2e35a04", "comment": "Malware payload (IRATA)", "value": "c400e666a5cf65e05122a69b266e817eac12d33a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698404959, "uuid": "7d8dc035-f902-4fb6-bf6b-4561ba5227c8", "comment": "Malware payload (IRATA)", "value": "ed05cd6356e906f494f4f6df109e4dc56b35843f314c5e468cb2520742519a1480fb27d1d08203d3899d989c3d40c53d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698404959, "uuid": "202e3cae-a18e-469b-bf16-a8e80dcc1b8c", "value": "T111E52253F362A46BC9F2C3312275563201778D689F43E7862958B3FA78B7CE80B846D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698404959, "uuid": "6ece7485-1ab6-4ad5-a223-e43a0c924bb0", "value": "98304:ikHSCc+lqo15oCGOD/pidkiW5UoQJF2d/:irCc+lqgG4/pidkiW5Uo+u/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698404959, "uuid": "028c09b6-54b7-43ec-a1cf-582816ec6c7e", "value": 3162352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698404959, "uuid": "8c9ee5c0-2512-43a8-8d42-73f0fac9d65a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698404959, "uuid": "79a24f08-8d98-40a9-8c98-344bfd50d6c7", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b01b9f4-74aa-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698398470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398470, "uuid": "4aeabc6c-e907-4fcd-b0e8-1b1d99b54d3c", "comment": "Malware payload (AgentTesla)", "value": "cacfe28c3aa6dc7266316e6af9283cff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398470, "uuid": "c3232405-989d-4227-bd13-45f33c93ad28", "comment": "Malware payload (AgentTesla)", "value": "f1263328fa7a1adf4d4ed4eb986acd54f294b6b0da5dd829d84209db57e6eab8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398470, "uuid": "9e86ef49-01c4-4de0-9a5a-02a94c6fbfde", "comment": "Malware payload (AgentTesla)", "value": "4cc2ef8ed26014084c9c3e3b836b7c967280529c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698398470, "uuid": "e0d4698e-f7ec-4a1d-baeb-0e016a52f3ee", "comment": "Malware payload (AgentTesla)", "value": "f6e216c22a4b611a5c879bab44dcbdcae8e3e9a1d16bc8c54c21ae9c1309d3a77b2b6625bce8079f3240e74bc48009f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398470, "uuid": "3452dac8-fcfd-4e22-aaa3-86d83405e528", "value": "T1F8856B457E7AD922CD00C23094E6CAF62647DE4E96C292231ADDBD7732723BC4B4B2D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398470, "uuid": "d68c23e9-3964-438f-9b0f-2f17020acbe9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398470, "uuid": "e231906e-030b-444e-a022-1f262ac8eb6b", "value": "24576:4bbcql6CeN6rf7RDVbWzakRz+BdaPY8ReeG4:40ql6CeN6rftDFWzpATSY8ReeG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698398470, "uuid": "1b2d6574-6d72-4a73-8cd7-24144127d6c7", "value": 1760768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698398470, "uuid": "281276bc-559a-42d1-a37a-4876d8de5997", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698398470, "uuid": "73934b27-adf9-4499-9ecc-2748dc93d874", "value": "Payment Slip (SWIFT)\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e077835-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421749, "uuid": "e2678e8e-deca-4d77-bf4e-0d735fe97f8a", "comment": "Malware payload", "value": "3c640d8ca9db6507e42d3cae28a14701", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421749, "uuid": "6a84faae-709c-4429-9370-37f931a9f75c", "comment": "Malware payload", "value": "f2396b241cfbb46f03c6fc32479a37e7bed4170b0e873572001047e98ad138b9", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421749, "uuid": "edec8649-d221-4fa1-bf42-d9060d648a47", "comment": "Malware payload", "value": "eab5c3aaa07eee745555ffd344f74b45b5f8b4ef", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421749, "uuid": "5efa5b65-e6cf-4890-a072-020b87556e4f", "comment": "Malware payload", "value": "ded64c57f470873bd553e4402d7f79674c6cda15cdc3a925e5397d9a350f8714aed6fba04bfdc668e3477c2ad56c3c1e", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421749, "uuid": "470f3cd0-f143-49b8-91c4-0732129e4910", "value": "T1C7724B2FBF97477DCD6A917082E38B35FAF9F02002514B6E86F4D7355E64B24A32A508", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421749, "uuid": "76767014-40c2-4fc2-bbe4-fce86fa3d79d", "value": "8b7d6f218f07082b5df448bc58285040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421749, "uuid": "5185609d-d57b-4d4f-9005-6eaf0733c898", "value": "192:a+t/9mSisEU2aZc7KYJsY+JOLS7JJ+3VZhHPU4Xixgv4e/0HQcqwFho7oYr7Ah:N/9hisE8cGYqpJO8+Z0uwFhuFr7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421749, "uuid": "b3e162d1-af46-4169-aa56-ada32157dff2", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421749, "uuid": "89e7f751-b2a0-4528-9f51-e62771b99478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421749, "uuid": "9ba5f064-3f74-4a99-aa6d-44b58e8c9604", "value": "Billing_Statement_NOV-23_XI.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9c42a7-7498-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698391039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391039, "uuid": "e83b23e0-466e-48d1-ac45-0a759a79c692", "comment": "Malware payload (Mirai)", "value": "d868d04942c93b59ecc4d23c0ec9dc8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391039, "uuid": "a65e2fc0-f0ed-45b6-b65f-f1c5c6ff1a26", "comment": "Malware payload (Mirai)", "value": "f27e32e92579f52b5021a0cfbb4c70cb8f440c83314d2410870557cd42ee7a96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391039, "uuid": "f9277894-fa8a-4b24-af4c-9c84f4bcf1aa", "comment": "Malware payload (Mirai)", "value": "89c9a49fbf066ecb8dfec6358b6d58bfedefa7ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391039, "uuid": "685d0611-0b63-4c8e-9c4f-28e68abe8d5f", "comment": "Malware payload (Mirai)", "value": "766a3ca7c15b068e06fcc5e9175a330ec6df8dd1ff3e97c02b35750ee66fa7d86a453d47d1f530359a38ff0f1d7094b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391039, "uuid": "1acb40ab-6d71-4dfb-9b76-5a56777e5fd1", "value": "T1A2E2F131E2857C76E35008B5F85201428B01157BE6C553669FA5B6FCED824E8EFB38EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391039, "uuid": "36bc6727-e389-424b-8ea2-b4a23f9040ba", "value": "768:QTj5wMtlGiVLVJviBItmIPrKMZIw5OTD3GR3UNZ:yl1VTiio9MPeG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698391039, "uuid": "df76cb15-e443-474d-b5d6-2c3cffb79b7f", "value": 34060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698391039, "uuid": "57d694bd-6bec-4f93-9e3e-c43c7946045b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391039, "uuid": "094ae407-472b-46b4-866e-de5faea6fe34", "value": "d868d04942c93b59ecc4d23c0ec9dc8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b407e83-750a-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698439729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439729, "uuid": "6856dee9-4e9a-444d-9ede-303f3cedf0c6", "comment": "Malware payload (Mirai)", "value": "9a8e2893b4b8539018ef71bdee9a3acb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439729, "uuid": "8880f060-600f-4917-9157-034a34da7f74", "comment": "Malware payload (Mirai)", "value": "f34d7ade97c60f60568bef20b987b531beb469a7301e522b050c028209d0d2ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439729, "uuid": "669e6aa4-79d0-466b-a457-27b3c5b2467e", "comment": "Malware payload (Mirai)", "value": "aa0cbdefbb219204006353b9881dbf50831d8022", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698439729, "uuid": "6689cc13-2115-4451-8496-2ebcbbafdedb", "comment": "Malware payload (Mirai)", "value": "3a993bf1b9d3c386e0527b190f081ea5959a727a94226718bc3bc6fe889adebd65894388f637a59da0e99ce622f88a25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439729, "uuid": "57007e8f-964b-466b-82ce-704b29fdf080", "value": "T1D4533B99F4028E3DF88FE9B984160E05B93123D212931B276BAEFDE37D331659D12D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439729, "uuid": "a12b9bec-95b1-418d-b2d8-e209b43d1536", "value": "768:Ge4gpsM204GEkRbjveXHVnQiiQthUv3gFHu1eu48B8vB6J7EzNfXuuJpozkq7Pq:Go3EkRbDoSiPMIFu1X48B2SEzNfeuJcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698439729, "uuid": "7086f41b-d5b8-4a3c-b0eb-910e503c2f84", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698439729, "uuid": "1cef05a5-13d9-4dd4-aa76-cc210856b02a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698439729, "uuid": "67fa6e9b-5ead-4f51-9048-f29d5a9b7ada", "value": "9a8e2893b4b8539018ef71bdee9a3acb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d580b08-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421721, "uuid": "3af7ddb7-9242-403f-96e7-d4e02ba66efc", "comment": "Malware payload", "value": "dcd72b0cbd686f30ac486675e397b41a", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421721, "uuid": "4f90c748-91e9-43e1-90b2-162d07081d1f", "comment": "Malware payload", "value": "f4d15a9373f5849ed9759bbfeeb49d4febf6c882c13c816ee0c4a0be4aef1c97", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421721, "uuid": "38d84950-e3fa-4571-b23f-cbffca8b3884", "comment": "Malware payload", "value": "f4711bdda90303662ae6886366ad19cda189f3b2", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421721, "uuid": "446639d9-ae43-4b33-9cbf-416b6601aebf", "comment": "Malware payload", "value": "e0009330e10008908cb17b9199ef5950a8f75b12da9fe2c4b269adafa8c0b59c4ecf0edd84fe6cd8d280d97a3613c48d", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421721, "uuid": "29a39215-46f1-497e-bde7-1855add6d491", "value": "T19FD4230EAF31D05DB0B1A322BE247E4AA6764F4642ED97C887E768D671D9EC1037E407", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421721, "uuid": "3980bfea-f632-43f2-a7bd-df3471a947a9", "value": "12288:DzmfcRV/8pW4Fm1ACtNgb/2GIX8FkWEP3M09Zl6qB0ub5eu7:nmfoR8qCki/2f8FkWEE092+0n4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421721, "uuid": "596a427d-3e66-4fbb-9af9-a819c41ab31c", "value": 617330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421721, "uuid": "4a99e9fe-8f70-4f58-bf70-7680d9870c66", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421721, "uuid": "ba666035-832d-441e-9917-8932e556a35b", "value": "AW 12.08.2023 tarihli sipari\u015fimiz.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1e83d9-751d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698447834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698447834, "uuid": "4545283f-55ea-4bc7-af30-106fc3a79c63", "comment": "Malware payload", "value": "778f99c457b76806d6c372b14a544019", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698447834, "uuid": "e794c40b-00a8-48a5-af3f-7b4efc220ec6", "comment": "Malware payload", "value": "f543f0537d8f9484ab6ec918d88e0a7a4fde9cf4caeda7aafc44ce7672df434b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698447834, "uuid": "762e1836-b2fa-43e1-ad8d-0b7dd0611b23", "comment": "Malware payload", "value": "5617db62531392de706d8ac009467af272f11496", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698447834, "uuid": "63643f9d-7f92-41b9-9d39-2b631d48e7fd", "comment": "Malware payload", "value": "b8c1fc6078e1416bb5c8b9884c7d829acf6f362766710714e0881ea3dcb2916eaad83a64e43a0c695e65ffd6b282db8d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698447834, "uuid": "25f1ce39-a923-407e-a7ce-7958bb6cbb5c", "value": "T17BA7D021B282C037F47A36B4852AA9D9C9A8BE15073148D777D53EDE8B739C22F35607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698447834, "uuid": "8838ec47-77c6-4f9c-926e-7e82892e4a45", "value": "196608:lVnWML32lc/0B93CEt99+BNmduIBbRhFogSN4WRAvx7XfCR:7WMLe33CEt99+BNmduIBbRhFogWV8pk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698447834, "uuid": "b6cdfb5e-2ef5-4d9f-989f-58dd1c5e4409", "value": 43759104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698447834, "uuid": "495dc2bb-8ca6-41c5-91ae-d872e1324cea", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698447834, "uuid": "c17634af-1094-489e-9642-a7b8b66559ac", "value": "UMKA-WCD-.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d7a9b0a-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698422097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422097, "uuid": "47e92599-c95b-4bb3-9fd7-98dfbf7c2010", "comment": "Malware payload (AgentTesla)", "value": "1c5b2d8fd9fea5b084be7bb2359611e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422097, "uuid": "95dd2934-0b4a-4eef-93e1-2cc4eaaa326e", "comment": "Malware payload (AgentTesla)", "value": "f5560a45d790e0223f262efbf1c974f78a848c0b97c796fbb80d2c6676253458", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422097, "uuid": "b5eb2b64-79fb-4809-896c-937828bfaed0", "comment": "Malware payload (AgentTesla)", "value": "4bba57a7de23bbce916b7b41e3048f0007c46c96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422097, "uuid": "92b6d80f-6cdd-4f18-b0e1-258046a17711", "comment": "Malware payload (AgentTesla)", "value": "1fb01a6d207e0f550b1d59b2b57f2613e600fc99c12beef50ca0e5a71e358f2c3ddea089f8a07e995b0219628733b457", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422097, "uuid": "95cbf45b-c11b-449d-a2a7-0587917da4cc", "value": "T129557C488F4ADA13CE5042719497C6F72A49DE9FD706D3335BEDBDB3308738856882A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422097, "uuid": "ce58e703-7b07-43c6-9a8f-ef9c2203004a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422097, "uuid": "6d07ead8-1ceb-4acc-affb-0838a970a5e5", "value": "24576:4KIMNUF0ZUvbKeqquJlPvtjbaoQIqVxFXMDM:M2ZUvbKeqFlPvtjbaoQIqzFXMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422097, "uuid": "937ba1ef-1b7b-4382-b1fe-546f80e61062", "value": 1377792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422097, "uuid": "13e4feea-26c1-4ca6-abd1-07ea3f325acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422097, "uuid": "beb969af-9290-4556-bca7-8c75a0e0b662", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430fc38e-74ce-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698413973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413973, "uuid": "6575736b-1e0e-4f93-84fd-a0408b18548a", "comment": "Malware payload (Mirai)", "value": "07611477770f08472746171560143e7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413973, "uuid": "8ae80147-03e1-4ded-b8a9-ac0addde60e2", "comment": "Malware payload (Mirai)", "value": "f68594326e6e216eb48a8eb31cb6fa12a4976f1705427cd70f54e052440a5c3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413973, "uuid": "71d2635a-785a-43ca-bbb1-992115fb78ca", "comment": "Malware payload (Mirai)", "value": "c05c81042ef9c59e069e70c67b76520cd323edd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698413973, "uuid": "c5aa0979-6a77-486e-98b6-49a6d3f45e34", "comment": "Malware payload (Mirai)", "value": "35d91b9cc6f8852328dae828d1a6edc3530e0b68405b967fa1a6ef64ee4ed572a7c7802024a53c3a2be7d4078804f068", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413973, "uuid": "3260971e-6d6a-4703-91a9-3441d5e91466", "value": "T17CE2F1D393B1A052DEFC2BF2F43EC0CA667D4A9CD1B630971A059A243A970535B3D893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413973, "uuid": "b38ebf3f-c183-465d-8f27-485536e1cf8e", "value": "768:voiWiO031vpAPbrVWZK3XVGxm9X+Y3UQwpIi:vorm1vpALgUJDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698413973, "uuid": "18e85ed2-21b5-4dbd-9e35-3b7bc5456bf2", "value": 33164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698413973, "uuid": "589bd12c-980a-47df-9ccb-886c0e15b7a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698413973, "uuid": "989b319c-1105-4f9a-ae07-ce6cd668a6b7", "value": "07611477770f08472746171560143e7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c534d4a-7461-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698367119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367119, "uuid": "6adb334b-2a9d-4f62-9cfa-95e12401ae88", "comment": "Malware payload", "value": "3ecbc13565e12ba3e411ece282b617de", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367119, "uuid": "ad32ba6c-506b-4f48-8304-75b43e801329", "comment": "Malware payload", "value": "f693e4685028a4432c8d38b07569ddd1cf06981b0012c1e3262c5c605fb6242e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367119, "uuid": "133e8bb2-c4e2-45c4-a1c9-5236947d1134", "comment": "Malware payload", "value": "3b62ba0267008597d69468a69fe55f8923fdc94c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367119, "uuid": "e3345002-2e84-4999-80a2-7bec515b668b", "comment": "Malware payload", "value": "925e8da6e9173f0adf52440d913bd82f0c54281183b21025d6e76e6d735b95d242922383305d753d73b76aa26e6858a8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367119, "uuid": "aeaa2dfa-b6dc-4506-90c4-5a41f5079e34", "value": "T1E346C00CB71389A9D3C6EAF5DE55A56D37EB7EC3C9C4900BE2583EA70DB0714A1884E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367119, "uuid": "ca0394fc-3e96-4f70-aae9-242f70ef5560", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367119, "uuid": "024ba7da-06d1-4231-98de-0dd14546071b", "value": "49152:VsGUmKMDbWwEEceEKZI3EaFjIJtZXX9VYKasd4607nL/sn8oUw+s8KuqGaX0ToIC:yN8RF/+Y0LYUTJBAUZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698367119, "uuid": "c9d72248-ae17-49bb-98be-161a5d595ff7", "value": 5775610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698367119, "uuid": "f340d2fd-fb06-4d24-8b75-37d97bce7b67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367119, "uuid": "43c2eb6b-5924-45e0-8975-feeae489d079", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.29021.13422", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b569c1-7498-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698391019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391019, "uuid": "bf2d151d-1910-4bfa-bd36-a6b75f41b842", "comment": "Malware payload (Mirai)", "value": "b0ba10a02e6de44d773b25bab9911b09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391019, "uuid": "832c2c68-e6a5-4e2d-aa51-63d605da4732", "comment": "Malware payload (Mirai)", "value": "f705c14d6674d4f56dc04f6ee2ae4cfa67505d5164cb03b8fd11f29b5b994491", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391019, "uuid": "4b4aa05f-99bc-4476-92a4-8e2f7a679bd1", "comment": "Malware payload (Mirai)", "value": "453100c8eda1d970d741e2199d4bf9cf1a8ff087", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698391019, "uuid": "42f42cec-1ac4-4d9b-95aa-c3c23ea969ae", "comment": "Malware payload (Mirai)", "value": "f45cbc995a44cbbe9d53b7659a8bf4009a858a8e90d134d01b820008d7814b340265c3ae239953d94e0e9c08a6e7715d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391019, "uuid": "100e5f31-8b9d-4661-8504-e12b61b0188d", "value": "T1C1B34A25AD792E12C1D4B13B11F78315F1E2234E35B48A1DBEB10E4EEF196A039276B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391019, "uuid": "f9874007-bfcf-4d47-ace9-cd586c73c0f3", "value": "1536:Vwltw7g7Sz0M4i0ZDpppu1Ql4ZSz957JPnad/B88UuurAAW6pW:SOTNapQP057had/a+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698391019, "uuid": "027f1dfd-6fb3-489d-a077-43411d8e0d51", "value": 108160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698391019, "uuid": "a2465991-b500-4a57-ac63-c55190fc3d19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698391019, "uuid": "03e6589a-8f58-4b74-891d-67f72cd415b9", "value": "b0ba10a02e6de44d773b25bab9911b09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fa3bfb-74ae-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698400252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698400252, "uuid": "e374bbd3-b93d-4c64-a988-3dbaa323ea57", "comment": "Malware payload (IRATA)", "value": "96becbe413fd2be7ad701909e5bea7ba", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698400252, "uuid": "4ff4ae8a-322a-4921-87f8-0c143b0141ee", "comment": "Malware payload (IRATA)", "value": "f7afed20da56ee1539c679e7585e0a4ddc6a55e5c6ef70e910a2e62c0f937018", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698400252, "uuid": "182ba77f-d5c6-4e16-ba99-4f7361271c49", "comment": "Malware payload (IRATA)", "value": "3ac182452c560115c3ecbfd582539bf63699c3b2", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698400252, "uuid": "83cf9d2c-d091-48bf-b033-e199da8359d1", "comment": "Malware payload (IRATA)", "value": "871deaffd1db9031aa16d82ee720f052193b6ba90652e5f9fa60c89a7ab7805e59a2e9949296d67ef8fa165439b30a90", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698400252, "uuid": "16ad444d-2410-4a69-9291-e1f742dec526", "value": "T1E636CFD7F399686BC4F39332817613A5428B4C268F83AF876D14767C28BB5C41E59BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698400252, "uuid": "3e54143a-3f42-4e3b-ae40-30689caff76e", "value": "98304:nPFPU0r+OmNECeuEgLCrgnca0a4+MNSR1:nPdSE83ca14+YSR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698400252, "uuid": "c7596f6a-59e1-484c-8fdc-4776100ad5fb", "value": 4918329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698400252, "uuid": "1fd815a0-3baa-4531-9efe-80468ea7b274", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698400252, "uuid": "fcef1f72-1d76-4d95-b971-28ace80937e4", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef413ed-74e1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698422099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422099, "uuid": "75effc1c-e61e-491c-a088-698af2ceb96d", "comment": "Malware payload (AgentTesla)", "value": "6d14d6c44e9b8ded1bb6ac2c057ba046", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422099, "uuid": "ca9521e8-8931-46eb-a18b-478325c78168", "comment": "Malware payload (AgentTesla)", "value": "f7c1bded8b82126980b2149af9960a2c4986188be76d74e2d3d53cba07d31bd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422099, "uuid": "da9759a7-8637-41ef-9b30-049e2a0611d0", "comment": "Malware payload (AgentTesla)", "value": "920b1b2ea439ec771106e3f4509e4e5da3f58d56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698422099, "uuid": "093753d8-2f9b-4721-bc3c-6e2151bdac9e", "comment": "Malware payload (AgentTesla)", "value": "1b86c0dd2adf8677ef8836a1deb40cd8eb3258a133cf894fc1867202618b6487b06770b40202b6d35682bba8489d503c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422099, "uuid": "3ff29dce-c392-4b04-897d-9508f55b9b5d", "value": "T165557B499F5ADA13CE500270D467C6F72A49DE8F960693335BEDFDB3308738856882E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422099, "uuid": "0de9f43f-7c83-49a6-98dd-072942315c50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422099, "uuid": "22bc4751-c521-4681-afb0-a3ba532fcbca", "value": "24576:v59XnzomDzHWX2CWiY7vCCHloSRG8SE8UwrX+ONG2PB7Y:vnzPDz2X2CWiY7KiRDwrOONhPBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698422099, "uuid": "fed92ac2-0506-4cde-afb0-d71718176ee7", "value": 1375744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698422099, "uuid": "6dbf9f9f-2a6e-4248-8918-e1bcf97e1788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698422099, "uuid": "e7254948-6999-486a-958a-2a99fe76a898", "value": "dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a5dc2a-747a-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1698377948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698377948, "uuid": "5d2a40cb-643b-45cd-9b04-e683b2d50de6", "comment": "Malware payload (AveMariaRAT)", "value": "c5d4b1ce4f19be642e239a84ede5d2b1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698377948, "uuid": "61f86a54-a7b9-442a-ba1b-d221de596fab", "comment": "Malware payload (AveMariaRAT)", "value": "f7c3ccd74f374109e7204f847af4c768e7c04d95062c66e5a4326923d654c1eb", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698377948, "uuid": "9a691714-c3a0-48e1-ad82-8d4c0a450776", "comment": "Malware payload (AveMariaRAT)", "value": "7dd8f4c5b9d64f4745a106fbfb6f6bcf62101a0d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698377948, "uuid": "95fef8d5-70fe-4d83-9369-3f400fcbc6a1", "comment": "Malware payload (AveMariaRAT)", "value": "d09bc102389a2adfa738508b056b39876951366e2f1d2de5ea26aaa2e5301f6f0f10389f5e4d9d5d0b59ce9fdcb90900", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698377948, "uuid": "b9848a64-f8c8-4b65-ba88-862994810d58", "value": "T166557C489F4ADA13CE500271D457C6F72A49DE8F9613A3335BEDBDB3708738856882E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698377948, "uuid": "473b3474-be53-4b63-a7ed-105e1c784eac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698377948, "uuid": "0b4466a2-35f4-4c5c-b06b-7cd533cdf61f", "value": "24576:UCNhgTWLQOlYv8ExVgitsbkPbJgAsIroBEjUFER1ebDe:yWLQj8Engits4PbJPsIroBEjUFEPebDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698377948, "uuid": "6755816e-00c1-47a1-aa92-12a244ac8870", "value": 1360896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698377948, "uuid": "39c64ae8-8689-40e6-8799-5e6df5d8ac77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698377948, "uuid": "76a2d10e-12d6-480b-8d74-2e06055374dc", "value": "SecuriteInfo.com.Win32.MalwareX-gen.460.856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93097f55-74d9-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1698418831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418831, "uuid": "03be946d-8b05-4de9-81aa-513602b35593", "comment": "Malware payload (SnakeKeylogger)", "value": "3add120023b59ee143e4385644fb120f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418831, "uuid": "424f1f03-ebce-48a3-851c-4284746b7b44", "comment": "Malware payload (SnakeKeylogger)", "value": "f7d51906ee99dd4f0b4f213c716c071e6d3f66be799b77128e8567c7749a1a05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418831, "uuid": "48138333-2469-4941-b18b-5cb62fa7c1a2", "comment": "Malware payload (SnakeKeylogger)", "value": "71f7a289477836ce8789bbb2749e9be4acfaf57f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418831, "uuid": "2c64ddd3-17f3-4134-af8c-e2d1916681d8", "comment": "Malware payload (SnakeKeylogger)", "value": "59a2ae360f0165a42f139d62183f6c81399f283a1b508510ea1496dafa28f840bd7e46b906d6a17910f1a2d9c3088ee1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418831, "uuid": "a9897ae9-7693-435b-abd9-9eaf9bc23328", "value": "T16AE37B4C37E88801F5FF4937057262218739FE525927DF0E59C0F81A2A7AB858E16FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418831, "uuid": "bb08ab7a-1652-4906-b70e-35088a145939", "value": "3072:FhryR6+DP/CUqrEu9fygubH579wBPpxe1guO2z6t2ebY:G+NubZ0pcgY6rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698418831, "uuid": "e085d31b-aad7-4484-ae8c-9f8c754e8227", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698418831, "uuid": "454d600f-4e8d-4b96-adde-e314fec7a5f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418831, "uuid": "0e5c1fb0-178f-4b62-a94d-c15379ad9250", "value": "PROOF OF PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754133c6-7469-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1698370678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698370678, "uuid": "9fad48e1-4887-4371-8992-baa5ae7f0278", "comment": "Malware payload (Vidar)", "value": "14771ea3ee101e3f63af272f23696ebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698370678, "uuid": "b42ad30c-fda9-4f09-8b3f-240e900bde56", "comment": "Malware payload (Vidar)", "value": "fb46f514e4855f599b2ec64c446379333f40be5d2181a7397acd67223bd1bc4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698370678, "uuid": "8676a58a-380c-4322-b075-dbcca7b346ec", "comment": "Malware payload (Vidar)", "value": "e407a9f8667c79c51657bcb06b14d079a40cfbc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698370678, "uuid": "c3e9d58c-5eec-49c5-9c79-ce8e5b3782ef", "comment": "Malware payload (Vidar)", "value": "7d2968741e23b44b7036377afc5e2d4e2d2f4a3069da0d86b68d7966969d7adecf2cf6a721e98a21a65ed2b9b1c0a122", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698370678, "uuid": "4a0818e4-dcd6-47f2-8ab7-fbc9fff68244", "value": "T1304533AE2E8D7208CF5A7B30CB7B017444A11F85C2E0CB57A75DDAC79D0321D6A76E4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698370678, "uuid": "1f8d7e30-2bc0-4618-bcfb-9c720ec1f45d", "value": "71cf2569222413220257b218ceff6838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698370678, "uuid": "5db94f64-1445-480e-97fb-06938073d28e", "value": "24576:tpmgXV3hrOtexdgk/KSgbH6RmtNzeu8PndVhVTOF/KIdSUD94M:Lmc5hrOtevYjbH60tNAPd30/KId79d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698370678, "uuid": "2c6be902-488c-4488-a444-1a286aafbb1c", "value": 1178848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698370678, "uuid": "299ea0dc-5bb3-4347-ae13-d734ba1bbe4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698370678, "uuid": "e6cc5d72-807d-420a-9329-3f34cc0b2673", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77a360fe-749d-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1698393016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698393016, "uuid": "5d26d8d3-d885-4036-b4d1-480c1483e4c9", "comment": "Malware payload (RecordBreaker)", "value": "6968dbcf7a7645824b736360cf8c8cbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698393016, "uuid": "a9e70f50-bb7a-40fc-b765-d9315dd0f402", "comment": "Malware payload (RecordBreaker)", "value": "fbde6714d6f641111b39a5eab8975f2586e53bb93573eff3fe7c09c2a19dc873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698393016, "uuid": "7af072c8-403a-44ec-b2b1-420494a6bf42", "comment": "Malware payload (RecordBreaker)", "value": "65c642ec72271111f56a6e3223715e6b22bd00d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698393016, "uuid": "49a40821-1631-4313-afd5-2e4154fcf7c4", "comment": "Malware payload (RecordBreaker)", "value": "14478852cbd1c81c05412ef6f58094d5c4b3aa919ec4b2178cc5fe1087f805bb92d4f849aacc94ecd929fb25581d4891", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698393016, "uuid": "ba806f37-8fb8-44b2-929d-847364f3d3d8", "value": "T1DA752312D9FC4011CCB20772ACF627871635FC52AEA9964757A2E90F1C32652F6B1B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698393016, "uuid": "93b29950-76dd-414b-948d-261005449d3e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698393016, "uuid": "f1e89e30-6f1a-4673-ae32-efd7dfdfbdce", "value": "49152:wUqXgLN2c9vWZH1cshorOT1Q9ZEVi2SqI2n:hqXW2c96HSsKz9ZAfpIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698393016, "uuid": "b2452fec-41e1-4080-a008-47170ca1a4e9", "value": 1627648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698393016, "uuid": "f5f59298-cc12-4ab4-8fce-bc0e2f3081bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698393016, "uuid": "3e6f82a4-bc39-4f06-ae05-2e750f05e3ac", "value": "6968dbcf7a7645824b736360cf8c8cbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a642dd9f-746a-11ee-8907-42010a9c0042", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1698371189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698371189, "uuid": "8b623b35-3adb-474a-8d0e-643ed339497b", "comment": "Malware payload (RaccoonStealer)", "value": "3b0d87523f0e03cb21ced6eda71e5d16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698371189, "uuid": "3bb81ccd-feec-4342-8093-cda0fa2db160", "comment": "Malware payload (RaccoonStealer)", "value": "fc18e9694fcf915859000d8fde0a06b5034ce3e5730fc731d2ed74f4235ad4cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698371189, "uuid": "ef11e8b5-bc11-4215-be5a-c2cddbb11edb", "comment": "Malware payload (RaccoonStealer)", "value": "d107cdffc28246b50c187b38b74578bed06f3b9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698371189, "uuid": "c217aff5-4b28-49d7-a90b-fd41f9470c53", "comment": "Malware payload (RaccoonStealer)", "value": "13cea47ba92203cd0792778e495e1f6ac09009a844d6b10be3a29a9b7c3ae08548a84149895b6690a11cfc3d5206c4ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698371189, "uuid": "3f3873f8-5fce-4bb3-ad9c-9e8f6dab52cb", "value": "T1EC5723823DCB80F6D9C115748A1B26DB03B39F668DC5C87D7AC0794AE5A1FB2707D862", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698371189, "uuid": "b56fb1bf-41cb-4a24-8d53-4bcb1d2bc505", "value": "f588e38e2442fe6d3b90289c37b2aae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698371189, "uuid": "c8348f69-7657-4103-8261-4b3cc56a63f7", "value": "786432:f4xL0VpKKu8SVoCJeyexwVzcIoVA4Px/T:AxL0jHS2CDzcIoy4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698371189, "uuid": "0e66b999-a6d3-43f6-a76e-75fe5348f062", "value": 27537408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698371189, "uuid": "87d052dc-928f-461e-ba57-783c21403c1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698371189, "uuid": "7c3049b8-91b5-43e6-a00c-c9b5e4a21bf2", "value": "windirstat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db31c17-7461-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698367122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367122, "uuid": "30df36c1-f383-4c29-8201-d00d1701b14b", "comment": "Malware payload", "value": "95d53900771740821b5c1efb2b3cd466", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367122, "uuid": "4f357f2a-10be-4e78-847e-a9ba2883672d", "comment": "Malware payload", "value": "fc1d536b86d0ae1b322d66959308c868ade8a5a64746a17c6d8a1c785c95081c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367122, "uuid": "602fc46b-ac61-4964-90d2-6386b0ff86ec", "comment": "Malware payload", "value": "6fe58ed0447a35697640a59b66cdcb4bf8e07ff1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367122, "uuid": "62b26bb1-558d-43ef-9b43-6c065d066d3c", "comment": "Malware payload", "value": "d05bd10d6e0ad2fdfc3a8d98dfb368ad35499d6b6ab3cd466ee007db1cf1d08ac4db39eedd12cc305ef3ade26a6f61e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367122, "uuid": "54b013f3-8401-4c14-8e9b-1762fd9b884a", "value": "T1BD058E12B6E340BDC77155738A77677ACABB95060B12AECB9144DBFC49221B0BE3E131", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367122, "uuid": "458a9ae3-9046-4408-9865-0840473037bb", "value": "6144:+25MTcKn/oawLUdxFbQ68KUEus0LgPwdOoONhhboq/vKr:tMT/oawwIu70LgPwd+Nhhbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698367122, "uuid": "057dae91-b8cb-4241-919c-a93ea2c3d5bc", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698367122, "uuid": "2b1df484-0fee-4c62-8252-6cf88fa2f0e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367122, "uuid": "392c3fc8-eb9c-4342-80bd-a0462a9d1c5a", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.8641.32721", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a09d3bb-74a8-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698397637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698397637, "uuid": "cbaa2d05-d611-4ad7-81e0-319350a81dc1", "comment": "Malware payload (IRATA)", "value": "2af84cfb1bd83132dbf46bc180514344", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698397637, "uuid": "0f48678e-798f-48f6-9a47-e9bae5bf0abe", "comment": "Malware payload (IRATA)", "value": "fc47990c3f41426b3f30b39cff4e69d7a2eba8897182545f0c7092ee366adcf9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698397637, "uuid": "7fa02eb7-40a4-487e-8030-dbc6ed674842", "comment": "Malware payload (IRATA)", "value": "ffe6e7699af6047b7c3afee4b0711a49945f10a2", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698397637, "uuid": "20645fe2-fcd3-4c8e-885f-fb4e3f68ecb0", "comment": "Malware payload (IRATA)", "value": "b77217094c0dedebfa090216dd15fb09dd888b52192ab03312bc9f3e0d0c0184ad735008dbb90f5800b2cd8faaf3a9d3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698397637, "uuid": "b1403801-4954-45a3-a141-52a0944c8c04", "value": "T131C52283F266681BC9F6C33115B52634613B4E58CB43BB473989B7BD28B7EE407906E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698397637, "uuid": "695590f0-e96a-4929-b1af-7e6a8b01f970", "value": "49152:r/xITiZrOEO8vk2bcxC07OvB0Gw2oIu5Cy5vCCurKppVO81c2uJ23DX0lZ:zS8v5bc00i5rKIOCy5hurKpxc2U23j03", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698397637, "uuid": "0b2c02f4-40ad-4324-abf1-b325863a4485", "value": 2699781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698397637, "uuid": "f08dff63-0aa4-4bd6-b6af-168c4b360f45", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698397637, "uuid": "dec5a1d4-f920-4d7e-97d2-8ee76ef51f23", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f16d8e5-7461-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698367124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367124, "uuid": "da393d76-9887-4113-82ad-c693285f2763", "comment": "Malware payload", "value": "668e6960bd1a9df56fe81bb7e2cbe540", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367124, "uuid": "0b121198-ad7d-4f5c-9883-45fc4a9cd0bd", "comment": "Malware payload", "value": "fd49d2f4ab29dce03aa19b39efc96c42beba15135ca4f5faaf99d2be2391d7bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367124, "uuid": "bc4a1eff-d671-456c-8037-b67602ef2ac7", "comment": "Malware payload", "value": "1b452d2f25a394ccac86c37cbd1afd2e6f0267f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698367124, "uuid": "53377a88-16a8-4b9a-94a5-dcb2a4f147d4", "comment": "Malware payload", "value": "a443845ecb592c84061e8bfab600bcbd8043a6e2e882f038bf8096002c9ee5fee83fa4bbf2ea32be8c305bc9368adc2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367124, "uuid": "c8a08f0d-d52a-4431-b4b5-8d8a1a87a5ce", "value": "T1C0852351BCCC7C86E43C4E30979693FA85A77EB5FECC1E55A091B63666300A8DC0DAA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367124, "uuid": "00888b92-4a0a-4af1-a143-21445c267c4d", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367124, "uuid": "2d56e778-78d9-40e9-bb87-0fd9050fbee8", "value": "49152:gON3cX2ni5Wap3ky9C7ZLz3bLuxhzrjgNcQY:gCOj3E7NuX/jgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698367124, "uuid": "2ed481ae-67a7-4a6b-afb0-9e0297e7a240", "value": 1744896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698367124, "uuid": "c7d8cae8-fe0c-4c09-b33b-a46a2b476e39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698367124, "uuid": "46f0589b-cdc8-41c5-be1c-7ec2ac223b1b", "value": "SecuriteInfo.com.FileRepMalware.639.15215", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2982e0-74b0-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698401341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698401341, "uuid": "1e83e169-9832-4c19-8fa1-bad554e8a462", "comment": "Malware payload (IRATA)", "value": "c1d8aa284d047be47d1cb325cab97a29", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698401341, "uuid": "60fbe1ae-d58d-4db6-9240-05646e74aa46", "comment": "Malware payload (IRATA)", "value": "fda2c9cb91fca7d3cb1a9f2940ab3ecf0bf9049e7053c271a3c02f0c4704f7d6", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698401341, "uuid": "85f6b4d4-c88d-4f24-8353-6dea7f4a674e", "comment": "Malware payload (IRATA)", "value": "f96f12524765970f8f81e0a055f9f67a35492a99", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698401341, "uuid": "9b6bab1d-3f69-4e66-a875-7aa0adddd719", "comment": "Malware payload (IRATA)", "value": "204938c25c129ee0f0a13f1d423eeb184710de4f3be19ffdc6227da3eb2d1cae51bae1a9f48046fa36a7d53d92541f53", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698401341, "uuid": "f2a94003-5947-4c6e-b044-8986f089a1b1", "value": "T1F206BFD7F399986BC4F79372817623A5424B4C228F839BC76D14767C28BB5C42E49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698401341, "uuid": "3c30a1e3-ab22-4ccf-92dd-c826ed4ae336", "value": "49152:pdOTvGyBjxnF4VhE2qOgLCr88z/hXcCxiwcUq4DcXt2v4mu7mq:pdOTv5Bjn2gLCr88L5ZixD4Wtwu7mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698401341, "uuid": "82e89b5a-b9b2-4b17-b9dc-3cb79e09c971", "value": 3766308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698401341, "uuid": "db29c6d4-5036-4da0-96c6-f44db76eefcc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698401341, "uuid": "53e23b59-13e9-492d-a34a-c72a84aad2b0", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e90362c-74e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698421723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421723, "uuid": "7cc2d367-4c28-44dd-ac6a-c78ba3a77979", "comment": "Malware payload", "value": "b7af01d293527f0a1b9eba0e90df18fd", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421723, "uuid": "3f8bb456-0805-4129-a07b-9bdb981d632d", "comment": "Malware payload", "value": "fe25d001c3a3a9ac98bf24ebb372ed0867ea0e50c831e7e2e2ff04bb01280e8c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421723, "uuid": "8cc34ebe-8edf-4e71-aac3-447b295c241c", "comment": "Malware payload", "value": "dbe35ea1ef52f8e195964c99a3b6e878326defac", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698421723, "uuid": "c39ad066-8daf-4908-982e-aadea25104ec", "comment": "Malware payload", "value": "553bab5438962d28883f6e65aad684f513ce1c5cd59a45a641f5887453e9965608f372b3b6577ea615d84431f0447fd7", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421723, "uuid": "ba7938b0-c3ac-4d1a-a5ca-db6965997ffa", "value": "T1C0D423A87DC519969A5C7C7F8CA48233D5F58249C7E83B9AF88305E04BE0BE7124B75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421723, "uuid": "ba8a9dc8-d514-41ca-9cf1-6d49320ef48d", "value": "12288:+8r+CwE1bj+wbepN+R+bxYO98N7MjgSvc3aUKI3lRk1PucrhCHy3t9qkqs:+86CwE1bippoR+KOIIjgSKaUKIVRmPuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698421723, "uuid": "56af0434-8049-4cef-a0c5-3af848ebfa09", "value": 625625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698421723, "uuid": "02777b20-6466-4112-9e74-19246e232726", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698421723, "uuid": "a861a8a4-81dc-42b9-a422-994e43cf1194", "value": "\u05d4\u05d6\u05de\u05e0\u05d4 \u05d7\u05d3\u05e9\u05d420232610.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd87ca0-74bd-11ee-8907-42010a9c0042", "comment": "Malware payload (Pikabot)", "timestamp": 1698406827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406827, "uuid": "fb8f2428-0e2b-4a23-b8f1-33d742d6aefb", "comment": "Malware payload (Pikabot)", "value": "51967a61a0b543123e281a654aec3879", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406827, "uuid": "9fc687c0-61b2-4649-9ab9-18b76fd514cc", "comment": "Malware payload (Pikabot)", "value": "fe3221dba8fc8959279f6cc2aa4b8ad695f69176f81094a4562ac271d4810f31", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406827, "uuid": "94e72176-8736-4e29-9521-a8458189650c", "comment": "Malware payload (Pikabot)", "value": "d1c306c401976b57c41c2a6ae205fdad114a30bc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698406827, "uuid": "26b1df28-acaf-45d1-bc54-0e53ade0b4bb", "comment": "Malware payload (Pikabot)", "value": "46fcdbb9794b65fc7abe4f50f4da96e07d16ecab426a4e10f6bd3967b899384577088577549dfd097507979b70f9d033", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406827, "uuid": "816e0d8b-7528-421b-bf54-19deb26b248b", "value": "T18C06BF85EFDA81E1DC8B04FC216A323F61653B32131DCDD7B2418E0766716E1EA3AA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406827, "uuid": "d1816d44-b221-4100-b812-11a356ba541c", "value": "6a2cd18f07fb15a4057fca12708038eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406827, "uuid": "7c9c5266-d25c-4c88-ae95-c14d22e97eed", "value": "98304:ROpUerIHzl1QEfGMFWF9A2t0PQ3PrcS/5n44:Rve0fQEfrjPa/44", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698406827, "uuid": "8132b778-f417-4c56-b187-162976104016", "value": 3989027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698406827, "uuid": "e436c5ad-259a-4fb1-9f91-22b463714ae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698406827, "uuid": "4ad094ad-2f03-4b40-8871-0d4d0096150e", "value": "Y98.dlld", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5248047-74d9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1698418889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418889, "uuid": "a9287ded-85ce-49c5-a603-8c61e59d310a", "comment": "Malware payload (AgentTesla)", "value": "2bab71690fe952b08e3a82205d22d43e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418889, "uuid": "289c0b5c-c9c4-406b-b63b-4d6f0a8a8907", "comment": "Malware payload (AgentTesla)", "value": "fed051ccb236ba040f8c07f5e95c8e834e687bf6d5e6ff27d10b8a4dbf5917f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418889, "uuid": "5e7e7260-671a-406b-8fc6-cd4b11eb112b", "comment": "Malware payload (AgentTesla)", "value": "415389878f2c8915676ab04a8988233049a9040f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698418889, "uuid": "ba7ab42b-bca5-40e9-bd1f-4a211cbb1329", "comment": "Malware payload (AgentTesla)", "value": "30c35b4aa7258c68dc4d23f035ce9750a5f40b46938e61f3ddace662e029c02fce11e38cef53c8b82724245da126db00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418889, "uuid": "4edf6816-a96c-42dc-99f7-93d5346324a5", "value": "T13E14011AB1A5C806C153983E4ECEC0F7132CFCA08E56DA8F36107B5E0A7A583879F759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418889, "uuid": "8737d7c2-dfcf-4595-8591-d97ee8e35df9", "value": "3072:UTPfRzcgBbq3MesT7I8rluKD5ONwU/gzLDhvW07+wyy8x:aPfRzcOU6f75OvyhvW07+nyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698418889, "uuid": "436c4e37-5216-4e1c-89ed-8057416b80b3", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698418889, "uuid": "1b22ae58-885f-4558-8bde-a69ffffa21c4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698418889, "uuid": "3f8e1acf-757d-4d63-9c76-308188300b57", "value": "ADTZ rfq_List 20231027-4729.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }