{ "Event": { "published": true, "date": "2023-12-13", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-12-13", "timestamp": 1702512181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "014febc4-b865-4a60-b4cc-ddc1ff9f8b68", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0e43c25-99b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702472445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472445, "uuid": "66b2949b-0bba-4dc5-ae2d-079f0c5c6c70", "comment": "Malware payload", "value": "19a05a559b0c478f3049cd414300a340", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HazyLoad", "colour": "#4150DD", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472445, "uuid": "d54137dc-f24c-4e4a-a64a-3d1fcaf22b90", "comment": "Malware payload", "value": "000752074544950ae9020a35ccd77de277f1cd5026b4b9559279dc3b86965eee", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HazyLoad", "colour": "#4150DD", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472445, "uuid": "7152e848-d184-45fe-bebd-218ede94cd91", "comment": "Malware payload", "value": "fadbbb63e948b5b3bbbaeedc77e69472143a3b86", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HazyLoad", "colour": "#4150DD", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472445, "uuid": "8f33f9fb-8175-41aa-963d-62cccbd3b480", "comment": "Malware payload", "value": "da19ad29a0178db6172b7156c38cff265c30496ad45888655dc2ae32acf201ecf055095e6d6bbbbce57b3774719d11ea", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HazyLoad", "colour": "#4150DD", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472445, "uuid": "1ebed5e1-511b-46ed-9e6c-66b920283896", "value": "T18B66D41BEB7A00C0D5BAD0358666992EF8713858977457D387018A7BDF227E4EEBE700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472445, "uuid": "d85ef2fd-36df-465e-afd8-0e33edd900a9", "value": "a442b50304e52c8731dc2713959c2444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472445, "uuid": "b4016cc7-8707-4b6b-a407-273f0b1ce108", "value": "49152:GkzIAFeiibxQU6vdYqTzEuZf6Q9iBUqL5cQf3S9+uCQHSvT9A+aoNDqcKqQx759B:Nnu7S/QN+on", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702472445, "uuid": "071bf339-0a68-4b75-bce3-8e61b57bbb53", "value": 6676992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702472445, "uuid": "2d1d5140-e32d-48aa-a954-13ae0d679203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472445, "uuid": "369c0183-ac1f-4791-91a8-b3144d9e92c0", "value": "HWMonitor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7e378c-9987-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1702451712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702451712, "uuid": "4a6cfa25-5ce9-41fb-930c-bf2310c58415", "comment": "Malware payload (zgRAT)", "value": "a5eddc33490e51585c44f6a440d0e8f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702451712, "uuid": "fda631d2-5e74-41f2-aa52-094e43776139", "comment": "Malware payload (zgRAT)", "value": "00875bfb6feb1281357d738b5989e4ce000db6521eafb1edd29e7d3cf6117ad3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702451712, "uuid": "8b2fc998-5b33-4606-8dbb-85265d243bb7", "comment": "Malware payload (zgRAT)", "value": "5c1888f0f19252b06db194ec77bbadb920a0b7be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702451712, "uuid": "fbe67bb0-7cee-4c89-8b32-2a5f441c2de1", "comment": "Malware payload (zgRAT)", "value": "682d8b1dda7976ec2affc2dd7fcf562d604a05e40d62e1641a43b0b8d8c3fe76ee14bda65a7e0f73acfdcc3f9c749c1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702451712, "uuid": "3b865019-a64a-44b1-8cab-e2aa61104166", "value": "T14C35EB2A14BC91D2F07CEEB19AD087136170ADD67072D816D89B7BD5C237A07E9821FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702451712, "uuid": "7453d28f-106f-41cb-9bf1-e46401135f58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702451712, "uuid": "a6b27a61-9399-4445-ab0b-9a8c48ccdc03", "value": "12288:eHc8hZCKJ+f4rqAT86UFaSM2MCX+97mk5ikMp48P8S/kVpbX643:e88hV+aTpirpXS2N48zQpbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702451712, "uuid": "c9ccfebe-0091-4a93-a673-c71a0fef3087", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702451712, "uuid": "a1f8343a-e83d-402c-8fb2-56fa8004e514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702451712, "uuid": "e187db00-058e-48f7-85b1-7e4e558f38e2", "value": "SecuriteInfo.com.Trojan.Inject4.59820.18305.9535", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e062721d-99cc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1702481571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481571, "uuid": "bf8a3d39-9167-4d58-a304-d3648fcbb1d9", "comment": "Malware payload (GuLoader)", "value": "cbf9ebb5a93f6a0698e6d6fea9a72888", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "ZD 595", "colour": "#044718", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481571, "uuid": "bbcb4190-9c06-4098-81f8-745f787873ef", "comment": "Malware payload (GuLoader)", "value": "02d39f6e5d175e7b5c527bcce4bed1e3a544e7e660a4b4fd8226d6da56aa45cf", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "ZD 595", "colour": "#044718", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481571, "uuid": "6c795c62-81d4-45dd-b735-939ec2065807", "comment": "Malware payload (GuLoader)", "value": "6ffdf4895591638645d0d469511341d3a385bac2", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "ZD 595", "colour": "#044718", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481571, "uuid": "0e23cfce-7749-4315-ace3-912bcba66618", "comment": "Malware payload (GuLoader)", "value": "048c57f543790a37e19dd8d104f528325b6acb64334c5863b531470a10b55f312c91bb81c2350c91dcd848e5eb80d4fa", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "ZD 595", "colour": "#044718", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481571, "uuid": "c4de4e2b-3cb5-49c4-b72d-d02294c6d751", "value": "T1174522C13BA1C95AD9E31B710AB953739EF7952915F0428F3B9C8B097F26382EC0E615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481571, "uuid": "f95f0763-ac18-4f52-bd5c-75253283186f", "value": "6144:jNeZOlc6w6iRpZiXYRRSGAy/zK7OcPeEysikNPhjlEERYAbYh3WzZ1am3g/cDoXq:jNN9iRpMLFy7uhbikNZHZR3ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702481571, "uuid": "31ae0cf8-5ab3-4913-82e4-5c10c206b7c6", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702481571, "uuid": "b5dfefa5-bf98-4648-9818-1084d409b536", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481571, "uuid": "fadb0fd4-5fda-49ea-b343-4c9a82ca3a57", "value": "Ordine ZD 595.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79eb52d4-99a4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1702464219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464219, "uuid": "acc79f15-d162-4590-8f86-6b11d004a32a", "comment": "Malware payload (Pikabot)", "value": "b5c857145eabdd24e001369d10a08837", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464219, "uuid": "7f755e92-4b4c-4ada-80e7-155aa1d16cc4", "comment": "Malware payload (Pikabot)", "value": "03fca54f1a81d0a5cbe33946b70b34c5f7fdc2bcc9ff9cd1f41b0c6ed773ceca", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464219, "uuid": "2a32af1c-d97e-40bb-b11f-a332e8f1b1b4", "comment": "Malware payload (Pikabot)", "value": "109bbf37a183ca9350f35ebb496fd05b4849cf04", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464219, "uuid": "8dd88e25-129a-4809-98ad-0b1da9043e96", "comment": "Malware payload (Pikabot)", "value": "3d0bb61cb231270242efc7f28a8da8b29a1e056ef4b91725c90bf664dbffcc6853a83f89c671dbd455cc00127c26f1ce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464219, "uuid": "b5b37815-7ef0-4b32-9ec2-600e39e23656", "value": "T10345C023A2F04437D1731A3C9C6BA354A936BF802936D9666BF51F4C7F3A2513B25287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464219, "uuid": "21ea2836-1bad-4957-bf73-1ed6d3e7e097", "value": "f5bc4ec0da51e649a1c0c02fdc5c7f44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464219, "uuid": "27453244-2f93-48af-bdc4-2efcb663ea58", "value": "24576:kIaMIOzjvVDdJSOLyBMMRB6q9ZeZzZy0M1i:bTnHzWBP/zeZsFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464219, "uuid": "106dd7db-5fdc-402f-86d3-c10f239fe3a3", "value": 1174088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464219, "uuid": "647414a7-0a60-4e81-a768-404e7f094366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464219, "uuid": "3b5dd571-2d35-49d4-b9cf-c3d65c23bcdc", "value": "Urhyhdhthfse.OOOOOCCCCCXXXXX", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7d2e2f-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480843, "uuid": "dc653550-b01b-4274-bc92-06060406f310", "comment": "Malware payload", "value": "681da99a28ec341f81f37db44e8cddf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480843, "uuid": "c053d8ff-0694-41c8-afd7-da1e466a74e7", "comment": "Malware payload", "value": "043173f57e9557b76db645e20b50a28420341abd3458ca65329bd058305750ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480843, "uuid": "3f52d17f-74fa-4d76-8de2-02c07ffc12de", "comment": "Malware payload", "value": "a083d34e42cbb2345684ed75ace319255d7d03c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480843, "uuid": "a6290857-3cd5-4fac-b678-f076e5693316", "comment": "Malware payload", "value": "c47af4a26d07b143829dd11df682bddc2cd5f4601663e35937fc408f2b0e224b4aee033292202cdbcb35bf77cd682f4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480843, "uuid": "dc8df9ba-97f6-4b17-ad9e-94687deff14f", "value": "T172469D378E1D5C89E90174719C168FDA2954EC24B4086B9B76C1B96DCCB0BC3BCF279A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480843, "uuid": "b0c14b9c-b0da-4491-847d-03d6b1f27737", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480843, "uuid": "ad76c8ad-7019-405f-9b61-9aaf96ab4d06", "value": "98304:gmqXor+axf+SG7fpwxgZ9lhoqT4FO97lW9+oV17iDBvLcAYIAUd:gHorP1+dtwyZ9noFa7lW9+oV17iDBvLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480843, "uuid": "c792fddd-1b96-4a19-a607-c2914274a267", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480843, "uuid": "4e921705-1095-4c66-9443-928f45c25c2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480843, "uuid": "0f472c37-9396-464d-bbf8-40d0459f1a14", "value": "SecuriteInfo.com.Trojan.Crypt.17464.20475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5b4c9d-99ec-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702495063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495063, "uuid": "6a97b655-665f-46fa-aa83-8e4e57d0209a", "comment": "Malware payload (Mirai)", "value": "b46ff31ec1fd4cb4526e43fb40f01b7a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495063, "uuid": "c6d07e5c-83f9-40a9-91a9-5bd037f98da8", "comment": "Malware payload (Mirai)", "value": "047e33c45de05b4cd4e20809c5777e64a62c07a1ea87a6d94f2d7c6093e41fad", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495063, "uuid": "fb77d976-810a-4280-8fde-ec758e2bb99d", "comment": "Malware payload (Mirai)", "value": "db6d4b1d24c61874b848c8652904071703d3f6d9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495063, "uuid": "38c4ab75-7fbc-480f-8112-f0325edcfd19", "comment": "Malware payload (Mirai)", "value": "db0f751c92099d6837e309b82a4d391306dac6081f0ecc515cd243d20b9b069feed59c1d6bf3312fc6b36c30eb497bcd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495063, "uuid": "24865a57-a49c-41e3-af99-173c5294fa67", "value": "T18E730996BC818B11C5C512BAFA2E118E3313177CE3DF73129D216F24778A96B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495063, "uuid": "941c5603-49c2-4385-8ff9-33d279d4f16e", "value": "1536:bQnn3dUUKIFSaiZLhar/QnpMLikUPbJuOZCi5bGYTaA:GWUvSaixhapUPbJuOZCiVGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702495063, "uuid": "ddf320e4-046c-4918-a1fd-9c70cd63750a", "value": 79340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702495063, "uuid": "f31687b6-63e8-4d87-9241-dc850bc020f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495063, "uuid": "17c6f2f0-ba4c-4a40-8f30-a93f9a91ef64", "value": "arm6-20231213-1917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e4ccc74-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480869, "uuid": "9eb12d3a-3ad8-4d3e-b78d-6ca519a5cf4b", "comment": "Malware payload", "value": "772bab36a8d72dfb7940329b138b3f20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480869, "uuid": "2707e336-59bc-4884-9984-425af97267fa", "comment": "Malware payload", "value": "04bbbaf0d059bb09a2e44a3dbadb391a2f5aab5bfef5718fa3e8198502d0eb25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480869, "uuid": "cead97a0-4b9b-4d19-9b8d-eecc6cd94053", "comment": "Malware payload", "value": "119297c7c4604b2326e66ece78dfb4a9c7326c2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480869, "uuid": "bd5102db-b092-4d22-8949-0938d06f7d91", "comment": "Malware payload", "value": "fecefe0af5cc7aa9e00aa31276d4119ba121fd45d87c7399bd3f10ea50ba3ed7b92893cfbcc7dcfb2ceadbc7546bd207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480869, "uuid": "cea46f4b-fad4-4adb-9ff5-4a4041128507", "value": "T1E603E773E51DE316D68E83325742D4F803276DA1B842AE6B35CC350DDAB63E719A0B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480869, "uuid": "08742f7c-65e1-48cd-ae33-e147db57d83a", "value": "35fb401f4099c6267d52a8b5044e3796", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480869, "uuid": "f49fa115-52f2-4618-910f-05e61d0a4ab5", "value": "384:EDQwIkDfOM12vDMvkx8HzTmg52SEoRyDrQUhDMvksFDfOM1Q9DQw:eTI+fOM1iMsY1USEoirXpMsOfOM1QtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480869, "uuid": "84fef083-1cc9-4dd8-9406-967b1e907941", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480869, "uuid": "a25182e4-1ea8-4fa5-b4d1-7fe4a4b7dbdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480869, "uuid": "29529f13-d2c0-4485-baed-104baa32c404", "value": "SecuriteInfo.com.Trojan.Siggen8.15420.23815.21916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b44be60-99f5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702499064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702499064, "uuid": "42767650-883c-4f2f-980a-3d0919547638", "comment": "Malware payload", "value": "39a4dc224bb1539723a69d8c83e0cc5e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702499064, "uuid": "ad1f1fd2-2c59-4136-9b2b-662ec649d08d", "comment": "Malware payload", "value": "0665987816f01c5c3ae0a94431170a7671613b2ed1dbb1ca0abd52c71e2c9702", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702499064, "uuid": "552e1818-d676-4729-a740-0053300ea2b7", "comment": "Malware payload", "value": "dc5a211009a64f95e5a8cd47881b73020a296cdb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702499064, "uuid": "8eb07296-b0ac-4bf0-920b-5c7f295aefc2", "comment": "Malware payload", "value": "ee6747d240b179cce1734c49e6fe2a785d4d90d52b42d782ee373841ea06ea132eda8e5ed799b5897ef0445dfae59cc4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702499064, "uuid": "b681a6ad-de6f-4df3-8c17-e7c17585d75f", "value": "T1849533146F396DECCB284134706F8F0B55794A92B848F0CBEBE219C1657EF8119EBD49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702499064, "uuid": "c2d8216b-d500-4225-b87e-d08490fb94d6", "value": "24576:bdju8WOYwou91WdHu206k5D8HlK+QDkzppsFKaLYiCuATpBE0BWhm41bavsOXSYo:NjYAUNWDQ0FZAbWw4pBOCw0k96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702499064, "uuid": "662a2f75-5809-479d-b2de-60155f0cbb78", "value": 1912865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702499064, "uuid": "e6e08683-5be2-4205-ba2a-1d141a453ad6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702499064, "uuid": "844826b8-492a-4d96-a9a7-bb8204834469", "value": "rMSC-AQP-Newquotationrequest-ES0083ESP23.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7758eeaa-99d5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1702485260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702485260, "uuid": "b328706b-dc5f-48c4-a2b7-d29dc16243a4", "comment": "Malware payload (Pikabot)", "value": "71a2a56b3dc6f3e1570691716bbb5010", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702485260, "uuid": "9df2e9f5-2cda-452a-8605-ef9f2bbd5481", "comment": "Malware payload (Pikabot)", "value": "06d85625fb7eaec0d7538eaecdadc70e4cbe443929618dbf6353331036542465", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702485260, "uuid": "caf64fb5-5e6e-48cb-9b7b-271a5badde5c", "comment": "Malware payload (Pikabot)", "value": "497c43b0b05c5f6ddf752c3ee301448c4ba3641b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702485260, "uuid": "4c8d5d0c-88e8-479f-9408-12a2012c69f1", "comment": "Malware payload (Pikabot)", "value": "a7bf22ca659cbb3caed4a24cf2eb59f7e02c038fae0a8c4dbce910d7663984f8e113278999d2f0a307520facc4b3a9ad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702485260, "uuid": "c3631180-3f31-4a65-a4ec-6aa41b0f4367", "value": "T1F005E010B2D0C436D5AA21344A2DE63577ED3A31A7D189C7B7C87A790E31AC96B3436F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702485260, "uuid": "57d21ecf-731e-4861-96ce-508b98681c44", "value": "a9bf709088a4c7328010af786485a2e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702485260, "uuid": "b24f63da-cd34-425b-ae2f-f99130f9e681", "value": "24576:dllB0eKPeXMgkfADWrqPvckOfpV7l+oGysEs:dlf0eN8g8CWCvc3xVAoGJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702485260, "uuid": "1cd59208-e24b-407a-9963-7e1b975038be", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702485260, "uuid": "0cca59dc-11fd-49cf-a54e-2cada2c7ef88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702485260, "uuid": "265f680d-07bc-453e-8d7a-82439ed9aed6", "value": "1337.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02430226-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1702470890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470890, "uuid": "6c4a3f29-773a-40dd-951b-b900cd5103cf", "comment": "Malware payload (XWorm)", "value": "f82554875b9324292d7d0f6f953ef80d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470890, "uuid": "3a8978fc-63af-4b83-9e92-771d49491c73", "comment": "Malware payload (XWorm)", "value": "070314055ba25d408f14548bff51643db4e4dd86fcbddd4524abf13fb8d70af7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470890, "uuid": "9224b1a1-262d-40da-b263-f56d92deca47", "comment": "Malware payload (XWorm)", "value": "07f07bb1fea71556c6a393000466856aeedfd361", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470890, "uuid": "db709a1b-9594-4577-9e80-f11df2061344", "comment": "Malware payload (XWorm)", "value": "d93a6449b3d7d1442eb0b3b596c0b366be9ad10a73ef554a95150ed02cdb7c791e3e3d6ca2c52b28892f9f5ae95aa748", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470890, "uuid": "8f2c0b45-d74d-43d9-be6a-10141a3854ca", "value": "T165F3906472FF500C7C37FBD327E53AA9CE19E9A1261F91EA210813AB4713B058E65D35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470890, "uuid": "0872455f-f707-431e-99f4-bae75ca657d6", "value": "1536:3mru94tQGlgSQkCGJZcCAsJ4DVBNwUOA4MaJQA4eEGGr2SGJBMvOpN3JSGJPhl0Z:3mNo0oDoKoxoJSooDQLozodKoAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470890, "uuid": "f90fb376-cd33-4735-a515-42bcd6bf6a51", "value": 160714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470890, "uuid": "b554ed31-6fad-488d-99d5-5c4750c4c1b7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470890, "uuid": "1d650319-504c-45da-b478-9e978db0a04b", "value": "102 Items.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63146918-99c2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1702477066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702477066, "uuid": "5cc8a6ab-3ef6-44c5-a877-10630e9581be", "comment": "Malware payload (CoinMiner)", "value": "133b9614878f6deecccb5d590cd23052", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702477066, "uuid": "839e4fdb-90fd-4a35-9839-80a5abf5400a", "comment": "Malware payload (CoinMiner)", "value": "078ea4e8b747ab8e2019a1c87081836c267585fa06616472e3acbb0b83634b1d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702477066, "uuid": "15476c8d-1727-4c08-9b72-a22c66cdecff", "comment": "Malware payload (CoinMiner)", "value": "b1b466b3d3f3f75436f9b686c7f67c9859db856b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702477066, "uuid": "ceb90f31-a7e6-43cb-9643-b450e560ce89", "comment": "Malware payload (CoinMiner)", "value": "a5f23836831a9bf9704ebcadb216dabbf6e700ecfc5013ef8b670a29d80f5c9e94a7d3fc09067c8610df7305fdd375d0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702477066, "uuid": "c1c3fd84-2afa-4372-aaee-11f28ab3eae1", "value": "T14AB62331E552B02BE2F0ADB3A95281303D6E963C1B4C89D9C6D0B81C3BB65D56EB7347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702477066, "uuid": "38da7a87-6a1e-43ee-8cad-d390e364a085", "value": "657e40fb09b2c5e277b865a7cf2b8089", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702477066, "uuid": "83638354-b83e-42af-a8fd-1c0d2384d89c", "value": "196608:ZL0/Hz+e5RxusE0qn3AuScpxld7X8pMQzfOIE/wvf4sMjHIdtogtlcwI2qBPgkZg:ZgvqRsE0qnPefvE/w7OIdtjJILtrpry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702477066, "uuid": "85142825-4b36-44ca-b454-0a2d190d4a80", "value": 11105751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702477066, "uuid": "b8042550-47b2-41c5-9e1d-389d51937228", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702477066, "uuid": "de3a7493-cb99-4477-9b0b-632cf6d74e03", "value": "SecuriteInfo.com.Program.Unwanted.5384.5946.6420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1962ff0e-99a6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702464916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464916, "uuid": "1d5c6a79-0729-4c0f-9976-a904e6bc5d80", "comment": "Malware payload (LummaStealer)", "value": "a4679f83cc6803f359c0b2a234f4c528", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464916, "uuid": "9628f472-ed2e-409b-9505-5f25c7cefed2", "comment": "Malware payload (LummaStealer)", "value": "07f3e959b4120e8a26ecbcd0662b8bc88a93c8b0f59ae20e31d2a157ff86bf0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464916, "uuid": "d8ab75f0-0f63-4167-858b-e1764bbd6774", "comment": "Malware payload (LummaStealer)", "value": "62a4aec5648f6bb758d4ebbda861bed98eb8cb14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464916, "uuid": "c2669986-cd7f-4b8a-9bff-d3caa59ab98f", "comment": "Malware payload (LummaStealer)", "value": "cb231c1c103963b13abf942de289baaf568764b42a05497fb6836cd846dc839321efe564edaff2a2f121a32d4c9bf1c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464916, "uuid": "623814f8-0a79-4857-b07e-1181a353b9e2", "value": "T1C0D48DF8E4BDD4F3FF8EC0FB55E8712AAA152EA1450A0D4B06A40BF141C58E539F16E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464916, "uuid": "3799c28e-4023-4707-bea8-9da7e87a063a", "value": "6adabf5929912c81c518ab88933ce307", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464916, "uuid": "1239e446-537a-4d8a-a629-9c9e0cd04c2b", "value": "12288:CvDhvuXd/gywytSYfnpo+FN184HlS2n4yeBs1WvrszAPP2wK6GsZWV8euMzbz82:M9H+FNjSls1mO/82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464916, "uuid": "748cc757-f86b-41b0-8b0c-38c62ec61151", "value": 612168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464916, "uuid": "930b33d5-6726-422f-83b9-4584589d7af6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464916, "uuid": "12c1bb6e-eec4-4888-aa2c-8023f5d03939", "value": "a4679f83cc6803f359c0b2a234f4c528.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d8a3b6-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480830, "uuid": "d8ecfe40-2d8b-4c47-9685-90940e5f2e13", "comment": "Malware payload", "value": "338bcd586577b134d250f1a4472d4ceb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480830, "uuid": "53e44857-27fb-4f75-bed6-2a19dfe86122", "comment": "Malware payload", "value": "090d4a15d6e25ffe64ebaf3084a08759d5227bb2642b3195e98190c3632ba01f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480830, "uuid": "d96d5a24-9c11-434f-8cb0-a98b738c0dc6", "comment": "Malware payload", "value": "4479680bf19a4140e3ab4d9c5ee0ede66b007094", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480830, "uuid": "ea52200b-846e-4a67-b428-0ae7f22dafb7", "comment": "Malware payload", "value": "45545780ff51b697445b5da9a7dcc98ac1574e36c9765ab71e3e9f99b156f5f017d30cfb3d3d3dc4d0d727f2caeaeb39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480830, "uuid": "45c0a492-b5c9-4f75-b838-6ef003cb4cc5", "value": "T1EB158E01B691A4F2E6C165300967B776E6759A090B138FCB739CEE1E7F322915C3E236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480830, "uuid": "0cdb9a19-50f9-437e-aa73-25111da59e94", "value": "2c13c1458aef02e401e3477dc932f23e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480830, "uuid": "3ddc8fbe-4bfa-4338-b3d6-216edb7828d1", "value": "12288:7G2rQK1Ab6cFai6Nju3KcK87Zc/ST75EDx:SSQK+btFai6mXcKP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480830, "uuid": "357df3d7-e04b-4130-9ab1-fce984dd5857", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480830, "uuid": "f8296b8f-9bb4-43cf-b1bf-70eb8cd95a4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480830, "uuid": "1d6a5016-7148-479d-bf14-ae9777b7eda1", "value": "SecuriteInfo.com.Trojan.PWS.Qqpass.10101.16613.24822", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2203c61-9961-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1702435564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435564, "uuid": "48696da3-9b1d-421a-9125-bfe0215b71b3", "comment": "Malware payload (Gafgyt)", "value": "a7ab9b866a1936fe4cc7387024b1953f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435564, "uuid": "b2cfff18-e5b5-41b5-b0f9-8281766f2fec", "comment": "Malware payload (Gafgyt)", "value": "0ada9f4aaae2d3342db1ed04bc61cb04f890553e774be757753882037aa33f02", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435564, "uuid": "ebd242da-3c13-470b-8b81-77411038a803", "comment": "Malware payload (Gafgyt)", "value": "72037478e5933ca3753ea350e8e3d868e532dd18", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435564, "uuid": "45ad81d0-42a5-45c8-a2d1-19657761aeeb", "comment": "Malware payload (Gafgyt)", "value": "dff81ebffe27e89d6c8bc00051e98ef4b72eaabd80a1f1efff663e7809d24cf7948a19c76ba629ad2afd07a4ce46aedb", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435564, "uuid": "f602e2bc-eaa3-4a33-8e34-086e8a085c3e", "value": "T18133280BA58181FCC559C17443FBB53AC876787E0639B1DA7BC8FF276D85E601E28889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435564, "uuid": "8e9a2c42-0b77-48bd-b3f5-37527f8c096f", "value": "768:Dbs093tGOHn2PAe6nCAQiGWexrecbwPg4ubt7EMHAE1rjWb571H7hOngg:M0937QAe6CAQ/WexKq1jl1rs71H7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702435564, "uuid": "cbddfd1b-fdd7-4143-83bc-d714b65eb4a1", "value": 54528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702435564, "uuid": "03ff8d06-9395-4fc8-b952-ccaa0a9e7c62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435564, "uuid": "53726faa-17c6-4fc1-a8b4-dbb4e4002b28", "value": "a7ab9b866a1936fe4cc7387024b1953f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b14d7b6-99a6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702464919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464919, "uuid": "22dfec6d-ac52-4677-880f-ed2a1ee2f1e2", "comment": "Malware payload (RedLineStealer)", "value": "1ea04786054d6dbe5133f702d31e6295", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464919, "uuid": "24674553-3c61-4137-8640-642dbccc8592", "comment": "Malware payload (RedLineStealer)", "value": "0bd9975f8dece47eb473584543d767cb97a556bbe91dbdcc4fed87d3c79aa588", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464919, "uuid": "a6e99f41-838b-48e5-97ab-9dba8e61bf63", "comment": "Malware payload (RedLineStealer)", "value": "0f96b70c762004a52b824e5d0bf31344b1f3f8ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464919, "uuid": "6e6d18a1-89f8-4918-8984-044d333b0b18", "comment": "Malware payload (RedLineStealer)", "value": "9379213ab87b0417f608bd5235839cdf9ef2fe9d3cceaf590086c82f38a301a50832aebf487cb599b405b4b6779188f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464919, "uuid": "bba67573-9a5d-4942-897a-337f0881465b", "value": "T1BC448D125A7C48F6F295C07FE1D193A42D66ED31E3B023E7729A116A8FF40A98737E14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464919, "uuid": "fa208d8c-92c0-4427-a99c-d88958ea4e27", "value": "6adabf5929912c81c518ab88933ce307", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464919, "uuid": "0738e8ed-2d33-4d16-8e42-23fc1ae6d40f", "value": "3072:sTwrrWvy9P0phy4Lugz1rggcu5sgywJZ3mcpVpo3kjJZ89pwnmmwhD7c:sc/WvAP9gz1rggcu5sgyUZ3mcpzPuQyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464919, "uuid": "6ff51d6f-6f93-4499-a7f3-e077923fb4ae", "value": 276296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464919, "uuid": "a789e321-836d-4bb1-ba79-8a1cf70c365c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464919, "uuid": "677297cb-ed58-4ef0-ab13-e3bc146cb9b8", "value": "1ea04786054d6dbe5133f702d31e6295.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9e6e4d-9987-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702451711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702451711, "uuid": "9a6707e3-d864-4c4f-a780-3e4435697ac6", "comment": "Malware payload (Formbook)", "value": "da6a304eb53ecfa80b28e4da89fdd65f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702451711, "uuid": "d7a1dcd5-473a-4b4f-a45f-a6f28b6c970d", "comment": "Malware payload (Formbook)", "value": "0da2ffbac9ea874c9844d5caf8a6413bdad2eb0a104839aa9c8b0025e8bf6284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702451711, "uuid": "89a76459-bb73-4bef-ac46-3fde9351a0c9", "comment": "Malware payload (Formbook)", "value": "8cf925afaf24186e9f086e962ed9f28d50bcb0aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702451711, "uuid": "bc2a3b03-d513-4ef4-8e70-bf851f4800c4", "comment": "Malware payload (Formbook)", "value": "4729b25b661c277e7b598ea573c038ba5d5ea9cb4c602759878d1f9d4f2c05a188d22dd410a0f569eda6d0a043ec21ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702451711, "uuid": "35a4348f-b80a-4f07-9443-a77e120e0a6c", "value": "T1C215B13D19F82267F175C2A6DFD0D523B260A5EBB1629D24DCD203964307A0BB9D327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702451711, "uuid": "cbf611c4-a587-40df-a178-f6086493d933", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702451711, "uuid": "4484424e-aeac-47f5-b315-f4796fef8c1e", "value": "12288:lfumSJyNOKZzGMgs7Tn+sJbo4tohbqjQ6G1JlMoiZKxwq1/J:9WMoKZ5bTnbJbo4zc1JlUZKRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702451711, "uuid": "5afbaf7c-18ed-4e8d-903d-be221f0b07fd", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702451711, "uuid": "8a37accd-28f8-4875-8aeb-58643cae8782", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702451711, "uuid": "ae44077b-248c-4c9e-804e-73196997a35c", "value": "SecuriteInfo.com.Win32.PWSX-gen.30922.12995", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79ce28e-99b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BottomLoader)", "timestamp": 1702472590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472590, "uuid": "33a7ad0d-d72b-4f08-8157-671fe328fbe5", "comment": "Malware payload (BottomLoader)", "value": "f8f7eced1411d76e2a0319151ecf80b7", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BottomLoader", "colour": "#D2849F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472590, "uuid": "abf11721-2abd-4a47-ad51-ca195566258e", "comment": "Malware payload (BottomLoader)", "value": "0e416e3cc1673d8fc3e7b2469e491c005152b9328515ea9bbd7cf96f1d23a99f", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BottomLoader", "colour": "#D2849F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472590, "uuid": "1ba0e11d-f366-4f58-9510-75dd0aa440cc", "comment": "Malware payload (BottomLoader)", "value": "3c5f4caf1a9d08d939a7d31f5ddb232806746b56", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BottomLoader", "colour": "#D2849F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472590, "uuid": "e8adc77b-cde6-4626-a94e-e36c2a3307d8", "comment": "Malware payload (BottomLoader)", "value": "68e232716c105dcfe20a8f1078c1c90d8a91cbbe9a970fb3ae32f57ee31636819205f96995c0f7062797dffd96cbd173", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "BottomLoader", "colour": "#D2849F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472590, "uuid": "0ce6f796-6619-4ff5-86ae-759cbd358cb5", "value": "T15515F92AB100A5E4C46288B9DFD59A95D370BC78033533DB23D5B7261DB6CE1AF7D282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472590, "uuid": "eb8d7f80-ae54-4f7b-8d57-ae8ccc31f442", "value": "24692e6d205126e7320227c07246ca7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472590, "uuid": "25d60f08-4493-48d4-b2d3-11acf2f06111", "value": "12288:lnGOqRToBFZ4oK28WUhiS6sHJpiJ9R19DUVF/7u3Wl:RYoOoTgHq/R19Af/74W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702472590, "uuid": "d3319110-d89d-4fec-b322-8f695d49a215", "value": 945664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702472590, "uuid": "31fda300-920b-47d3-b14d-70f66e82ab94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472590, "uuid": "36224c6b-0323-417a-ada1-daf6bcc107a0", "value": "f8f7eced1411d76e2a0319151ecf80b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b11e0c-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480900, "uuid": "0bad3152-b717-43d9-a1d7-85c14ed7e21d", "comment": "Malware payload", "value": "da1f0b36b6ef06db41acf8b6129f8071", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480900, "uuid": "f64bb009-cff9-4b7a-ade9-7ea30972889e", "comment": "Malware payload", "value": "0efb25b41efef47892a1ed5dfbea4a8374189593217929ef6c46724d0580db23", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480900, "uuid": "dedfffb9-1e37-4a52-9346-a5073f0738a5", "comment": "Malware payload", "value": "808f93ab41b7eb07ccf78b6e6ba2273f8d5680a6", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480900, "uuid": "e3b53604-f44b-4a12-bd7e-817c005cb42f", "comment": "Malware payload", "value": "e80c57e7aaff5827dd0f7dd030915bb716c98d8e915700c91d1f63cd78031e8ac451556fd0348e118e088c15682e9e0a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480900, "uuid": "9d2127ca-4569-426a-bf3e-c2ceb1048c94", "value": "T18E4528466298CFA5E06F5174C49246F5E373BC01CE105BDB13A0BE6A3F733A25E2A653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480900, "uuid": "b166de07-fda8-4cfd-8d2a-94efadce2885", "value": "998c0f3ea33d50d96ef2fa257324ee1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480900, "uuid": "158366dc-3b60-442a-913a-2867e98b72a0", "value": "12288:E2lRWitQqCYdfeJm/tuley1V1hsY/4oMt/mddE06rQAqEyY76mVGAz:E3qjYleyDbsc4LeEVQidZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480900, "uuid": "d6d416fa-f5e0-4a0f-b90b-8a62c57a13b9", "value": 1166336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480900, "uuid": "0a9d60d7-1574-4d48-bba2-6e67e97c5f35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480900, "uuid": "b3ddf58e-5b28-4b6e-81a2-b41a139b0092", "value": "filactery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ca34db-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702471025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471025, "uuid": "69ed167a-52cc-4cc2-a294-1c8c61ee33e5", "comment": "Malware payload (AgentTesla)", "value": "f4a7600113208bbfc229b1ad368f7ca4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471025, "uuid": "e081ade2-cafa-4f13-a417-6c8eeb6cf0b3", "comment": "Malware payload (AgentTesla)", "value": "0f7b450ae017e6535ed72274165bf586277c977bab747a69e75cd54cf2386615", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471025, "uuid": "2139ee68-08ce-4839-be9e-aa50533518f2", "comment": "Malware payload (AgentTesla)", "value": "a7e645f7ce60a6c1e541c4b370326464422603c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471025, "uuid": "73e264b6-09ec-4ff4-ab5d-2c6a10d486b8", "comment": "Malware payload (AgentTesla)", "value": "e233ff35e86fde544bcb391b1029a09fab27f1df98c695c33cb1a584b699cd67f95a98a0117fdbef716fc611ffcf048c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471025, "uuid": "e1bc7914-5723-412c-8b99-b15faef1ee7f", "value": "T1C4256ED1F150889BED6B09F2AD2BA53025E7BE9C54A4810C5A9D7B1736F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471025, "uuid": "bf1d0295-a500-4fa6-a224-8289b97b634c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471025, "uuid": "2ad47159-b56d-42ff-b344-fe26d13cd3f7", "value": "12288:Tus+4WpAEZya3DeLE4Qd2o5l1LXNBdzMMaCkR70zNjqmmyPit+bDHXxe8qHFenH:4pAEZzeQF5xXN/zcWMmmyPE+bDBedH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471025, "uuid": "3da97561-6a62-410a-b581-f0142a5c0d5b", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471025, "uuid": "28871b0b-6f93-40a6-9668-7431eb042eee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471025, "uuid": "d0625b29-3dc4-4518-a010-b850fcb934b2", "value": "Halkbank_Ekstre_20230426_075819_154055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d816f97-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480922, "uuid": "cd08f161-c2bc-48af-8aeb-4d69db6cd7e0", "comment": "Malware payload", "value": "2d3c57899f2112f65121a180242c7205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480922, "uuid": "1a61fe85-1dee-412a-94bc-293ea59c1d6d", "comment": "Malware payload", "value": "0f8131aea04b5d9b0e024e8220e1df62ede4a26a6642658643ce782ea56ac205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480922, "uuid": "4fe9b936-c3a0-4836-8c0b-4c4ead3d38d4", "comment": "Malware payload", "value": "81d999657c265346008b7e3978b1440b620891b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480922, "uuid": "818f5ca2-bdf4-4414-af0b-3fde3d5b8474", "comment": "Malware payload", "value": "23b521316dbf2c9d13864710ba7548727c3bcae008855f9d450f29de891a3f3599ea533c7e23a58cc26818c47e223a6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480922, "uuid": "16459ad8-6886-486b-8570-22a8653cf1b9", "value": "T146357C1732815032E6B279314B1B82ADC826FE261D79696A6BF59C4C7D31643FA31FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480922, "uuid": "f718625f-8f98-48e1-844f-f3aee56d745f", "value": "24576:V9WfTX3VFBy9p8Dxv/uId+kreNsZfruJzG8/h8:V9CTnTBmp85YMxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480922, "uuid": "d3c28d92-f1bc-4ebc-9c03-cf0079b0c1a7", "value": 1074176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480922, "uuid": "22dfd45f-a8f9-4b2f-8d3e-bc0e5ce62ec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480922, "uuid": "6594e4a4-7f1d-4230-8e7c-8792d5513d4c", "value": "SecuriteInfo.com.BackDoor.Pigeon1.16636.7571.429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b63bfd-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702470896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470896, "uuid": "929c9634-eca7-45cc-918b-c6a67dddb712", "comment": "Malware payload (AgentTesla)", "value": "301726939e9c43e3a1cbec7a646c0fee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470896, "uuid": "e67d5b44-6df0-4e1c-a1ec-acb5217fc037", "comment": "Malware payload (AgentTesla)", "value": "0ffbd97575bf2a754610760a6aac08bdcc02a526d9d73438c9c65a86280c6f1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470896, "uuid": "93b4244f-a584-4a62-b314-c51cde19ed27", "comment": "Malware payload (AgentTesla)", "value": "851f01d0a895da842592c1d504a26b5e7e43f883", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470896, "uuid": "022bfd64-ae03-4f2f-a2b6-ecb58075b6dd", "comment": "Malware payload (AgentTesla)", "value": "f1f09aaf6d12287dc6c5d559a389a68435d28ed4156d4a4b9c261546c8f11952402ec6e57591528cacc39f303f63649d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470896, "uuid": "0b968eaf-20e9-4d1a-8b4f-67457fc6b990", "value": "T1EDD4235C605168A223DFBCBC75001D8467FD5A1A5F6F47237018F3AE2294A8B5AE3DCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470896, "uuid": "27fafdba-10b2-4da2-89a9-7561f22eb2be", "value": "12288:8nq0VGximb6Uqi1Dc52cf07GX6AxMl3M18hoI+MFkOVPBmeBq+5HFcd6J:8xGDmiR42p8na1E8hH+MFkbcTZFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470896, "uuid": "8de00735-ce33-40b5-8440-175aa5e8b0fb", "value": 643576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470896, "uuid": "bee0f667-04a7-4259-99f7-5cff064ba99c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470896, "uuid": "a2d5198c-76cc-4827-82f6-34bfec6e9fde", "value": "PI Mia120923.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7c7f83-99ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1702467658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467658, "uuid": "6381de3f-4194-48f8-b838-15b82b2578f3", "comment": "Malware payload (zgRAT)", "value": "5941cebd74da30a7c52da8a7822e2e86", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467658, "uuid": "d31881f9-ce5d-464c-acf0-c6534130d471", "comment": "Malware payload (zgRAT)", "value": "10a13a29502e5aa5757570b897b634c11fb04abe8af2eb6418bce32c5367cb57", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467658, "uuid": "5257df65-d774-4595-97ab-2cddc15c1093", "comment": "Malware payload (zgRAT)", "value": "9fa3f5c523163b808ab64861263aa068fb9115e5", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467658, "uuid": "ff7aaaf1-d26d-42e8-b029-3341cb34c72e", "comment": "Malware payload (zgRAT)", "value": "d358fdb0996b41622c81dc3dbf0951fe3fe00b8d334032174a5e6aaf98988bc142d78867b5862b210e43333c9e2fddd3", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467658, "uuid": "3ed4b23d-9dbe-4956-b8c1-4e67846e9033", "value": "T1FE15DFB532134E16CBA1A7B58A73A7020951FD3B9466D307F3C8717E622B1AF1BA0747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467658, "uuid": "62a8e1e0-76ad-4d86-a2b6-2ffbec9cfe2c", "value": "24576:VgaXSSFOEm4h3Kriv59FhfOmqcY1awr8T0aonMGyS:SaXSSzmy6EvfOmrMawr8Ia0MGyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702467658, "uuid": "1a92177f-d887-4bf1-a60c-8281aa27075c", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702467658, "uuid": "baca6fa0-ac38-45a0-9319-d656e0a09d8a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467658, "uuid": "e9d91d70-6fe6-4a07-b947-8f5c1f4a12f0", "value": "rAttended(2).img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ed24f6-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1702471299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471299, "uuid": "2dadc3e5-fffb-4d72-9711-9b4840b68f3c", "comment": "Malware payload (Loki)", "value": "bc9946bf0c227c2b6f23120a19433d15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471299, "uuid": "70606f2b-8f86-4307-9976-bb94bf6d0ea3", "comment": "Malware payload (Loki)", "value": "11092e58766ceb87d0e3ad41b4b70da1251339c47ee4b478e5f367e794f34606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471299, "uuid": "d8d42234-a1e8-4232-8d23-0d97c86529a7", "comment": "Malware payload (Loki)", "value": "8651e7d630e6c2a3e65941e388383e0000b58717", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471299, "uuid": "8ee18a51-4a06-4809-b2df-61a53aeddb3b", "comment": "Malware payload (Loki)", "value": "82ff92f853902d8af79fad559c19b322f99d06ee7c9dea37f9e844c80de79ba451d62e185660f57e52baf2633ec67ede", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471299, "uuid": "d6620658-cf18-4ae8-ab00-9cb64eef50f1", "value": "T12214F14DAA6B5882CC8665B8D4A7FF250B63FD33596395C6719833275C123A6043FB0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471299, "uuid": "533bc2de-51c2-4165-835d-de15570a9374", "value": "6144:FVq53xMTs2fGNZyH2uTPgzBMkNY/55GG8oQ:Xq53xssrO2uzgzukNkrCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471299, "uuid": "c34d7e0a-8eb7-4a95-b294-68d35ae6220c", "value": 203664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471299, "uuid": "28a70cca-e0b7-4c36-8240-5521acf7ce28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471299, "uuid": "c5da8399-8b10-4f5e-b75d-53eea311fd52", "value": "Order_Purchase_2441240.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c1c4eb-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702480823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480823, "uuid": "4060b59e-e37a-479e-9a41-7fc00a0f9d30", "comment": "Malware payload (LummaStealer)", "value": "42173839ad86422b091e239867e08d61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480823, "uuid": "aa7f3d96-5661-4a20-a0f7-afcbd47c0942", "comment": "Malware payload (LummaStealer)", "value": "110ecfc273dc6dc5760b18a27ef61daed30e7f160ff2ade92bf6c5f5e5476aca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480823, "uuid": "a52106e7-9faf-4e74-a452-dd8917f91843", "comment": "Malware payload (LummaStealer)", "value": "43af81189e5cf860e148a2957f31424528a285b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480823, "uuid": "fcd9773a-74d7-40c0-afac-3219033bd583", "comment": "Malware payload (LummaStealer)", "value": "54be0c1664939d65c2c5529607e6cbe15af7af6a23e24ba117d5d7e0009e7697c3cab87690f2ff0dc8ccc9c28aa636dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480823, "uuid": "18c18a3b-3bb5-4e8e-b6a1-ccb848545757", "value": "T1D0468C06BE609A67F04D013B9A9E820803F4E5167AD2F737B9BC717CD5522533C4ADEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480823, "uuid": "d50a5aa3-fdfd-4b49-8744-caf9e5bcb4bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480823, "uuid": "9a5dfb22-a5bf-41ee-942f-7626aacb9ab4", "value": "98304:/yLvMsKpgUBuOXYbBL7pXlSo3Rg+w7j9FqisexB/tCrDQ:/OvMsKaUBuOXYtL7pV3xWq3en/tus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480823, "uuid": "9b83b428-d19a-4295-ad60-c43f0d680cb4", "value": 5480832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480823, "uuid": "9f92e40b-7449-4fd6-b5f7-d83b15fa5e03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480823, "uuid": "c29c9358-434c-4b8f-9439-99996bd4b506", "value": "42173839AD86422B091E239867E08D61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7325d431-999d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1702461201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461201, "uuid": "2576c4bd-e1d1-4167-86e4-ee0f9b49b472", "comment": "Malware payload (Gafgyt)", "value": "cd16dcca100da3ed3e077ffb94950a4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461201, "uuid": "8b71ffaf-1035-4552-a1b4-451e2509c239", "comment": "Malware payload (Gafgyt)", "value": "112427a56dfe24a1f645c961fcdc39769bf4541862fee99d074d52e30aa85a8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461201, "uuid": "747d66ec-a350-4627-9729-5b07911f4fdd", "comment": "Malware payload (Gafgyt)", "value": "3706f213d0dd48829bed7070115577e6acb6a908", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461201, "uuid": "1d3f5a1c-fba3-48eb-b8a4-cefab2a37a0b", "comment": "Malware payload (Gafgyt)", "value": "6937a438a02b07b9938546bca4ced6b7d8afa4a3312db169980bdaf5fbd70ef2d380c1695a4eecce3ff747f5584e41d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461201, "uuid": "c23d377a-7aa1-4d51-a994-1241be25ec35", "value": "T1BEC3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461201, "uuid": "2857e6a0-8aa7-4318-bf0a-7003d1a449a0", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBe9EdWfRZrmW+IFj:Ted0W0MZQHJd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702461201, "uuid": "ee411472-9e33-4a27-a8fc-6082f1dfefe7", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702461201, "uuid": "b633cef4-c0f8-430e-aced-7d0a6d058b8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461201, "uuid": "1c1615a8-a7b5-4134-ac9d-bf5a23310148", "value": "cd16dcca100da3ed3e077ffb94950a4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d13f9d-9995-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702457818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702457818, "uuid": "a7d86a60-212c-469c-a910-2c89cc519e1c", "comment": "Malware payload", "value": "34ce72f37968e0c1c1602fb64906b710", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702457818, "uuid": "259f724e-26c4-484e-a007-04b1bae5c7fc", "comment": "Malware payload", "value": "1139a9099f0424b533a49c8bc4ac5d569e67db11ff5fd02c8552a3461db7ba64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702457818, "uuid": "da0c39c5-e4d3-4acc-8def-61988d3ab7d4", "comment": "Malware payload", "value": "6e49684c0a01a838cfa726207310deed4d6496ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702457818, "uuid": "0eb33086-8498-404d-b4ca-abf7ac13d96e", "comment": "Malware payload", "value": "2688c7c2927b838d7281206695b1c82cf598cdef7075b843fe26b9b15bf9d5bed97ae1482754b866984db0dd69625899", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702457818, "uuid": "882137bf-6faf-4581-a025-d35112a16e00", "value": "T1D2247C12B780C473C4A3167149E6CBB1667AF931872AD6C7BBA45B7D5F303D09A3930A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702457818, "uuid": "d19ee8c9-b4af-4853-9b9e-bb4072c95dbd", "value": "47e080641e729f3adc432960ca6f05bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702457818, "uuid": "94ba5b25-b760-47da-9852-d143aab87fee", "value": "3072:3NGrAG0BZ+BcvYIEPGlsCV5eu7JAvzW5W0Vuz5KJnB:8rIZ+BcQJOlVmSSzkJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702457818, "uuid": "c232afb2-492c-40b3-a913-6e8ad9e3e550", "value": 223232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702457818, "uuid": "ef43544e-aaae-4ed3-8535-0bb0bc3b13ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702457818, "uuid": "518b89a0-b3a7-402b-a701-9c6197e76f2d", "value": "CMD32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43e11db-99b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702469900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469900, "uuid": "c6d7c3d2-6a02-4fac-9359-39b74c6dea91", "comment": "Malware payload", "value": "ce7cd4efedf806cdf7ce8e105ac4d709", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469900, "uuid": "6c4b878e-a89b-4b90-84c3-ffff2ef3eb01", "comment": "Malware payload", "value": "114a8c03ee9fb30f0094a49e0fcbab0596168697f3dbe0c15545dcaf57928139", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469900, "uuid": "91465faa-861d-48a1-8c36-5d481fe2cf4f", "comment": "Malware payload", "value": "5e51ab412b24ba9340345f355062f10c4082b6d9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469900, "uuid": "96a85f2e-a4fd-4288-ba16-6de5fc5810bd", "comment": "Malware payload", "value": "2c78e4cf60743b3663beea8f14d8f02939d7414f829dcb91f3bf39afcbce3d9c88133df5eed9f5683c9dad446efcd399", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469900, "uuid": "a29e2913-4dee-4c4e-85fc-49d4b584218c", "value": "T1E1B3630BFA758B24E594D13009E683D7056BBF51CFA193CBA1DF7A253478234B702B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469900, "uuid": "12ffc6e7-43b7-432d-b349-668cb5b6174d", "value": "1536:0ELDLXMzefraRIoixfcvxGUZgPassBaWCxXJDD3f:0ELDLXMzeeDwfcvTZVsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469900, "uuid": "eb340bf7-cf76-448a-babb-8e1491015e24", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469900, "uuid": "e2666c76-ff28-47d4-83ea-c6facf3b8b53", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469900, "uuid": "e46d4805-2f5f-4af0-984d-903784466aaa", "value": "\u043b\u0430\u0439\u0444 \u0411\u0430\u0445\u043c\u0443\u0442.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5ac8f8-995a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702432494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702432494, "uuid": "33f2be3d-5d49-4a77-9f53-b3634957fd02", "comment": "Malware payload (Formbook)", "value": "7d0f12a4f6f4b516672c222b75d3b4a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702432494, "uuid": "bb691676-20d8-4455-8c15-d6f5115819d8", "comment": "Malware payload (Formbook)", "value": "123159059996fe70e697717341356dc29963680e2733f7549e964a6679a88fbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702432494, "uuid": "3c6955b7-2c31-4a9a-a587-46b1486cc85a", "comment": "Malware payload (Formbook)", "value": "24d49f1738f848d1b04d75e9e5779c6e51209fb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702432494, "uuid": "fe73395e-b53c-42e6-b335-6d33fa5ae3ec", "comment": "Malware payload (Formbook)", "value": "684b6beaa36cc82c5e5c1f8f8cde3071505264358e86fe812f794cf87afa895d8301d6981d76147e76285ddf0868ee0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702432494, "uuid": "19e5233a-d95c-4b1a-9d13-45d7051ab3fd", "value": "T16615C13C58BD1A37D0B6C2AACFE98967F440943F3A21AD6A84D787554346AD374C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702432494, "uuid": "69360782-f739-4a0a-88ee-41e2da5d1177", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702432494, "uuid": "ec3a9055-ff25-4bbf-b33b-78815d6134c5", "value": "12288:so54MzcXkjOLIGeWukW4V1VlmT972PM+QCgVtoF:Whtet4V1LmcETPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702432494, "uuid": "67c23a88-f353-40a7-9e86-a7590d004111", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702432494, "uuid": "c07877fe-6b8b-4b63-8634-e1eaa5f16c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702432494, "uuid": "4fd38226-9626-4cd9-ad48-309534e5294b", "value": "7d0f12a4f6f4b516672c222b75d3b4a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f57d113-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1702470966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470966, "uuid": "53a021f7-09dc-4ac1-a561-9784f8a04d16", "comment": "Malware payload (GuLoader)", "value": "54ce901d3fbfa6b7d5144f8bd5a363e8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470966, "uuid": "7eb2088c-7719-4c1e-aa8f-f91afec43bff", "comment": "Malware payload (GuLoader)", "value": "126b490908906d951922c48e7598bafd1e69ef6d083b68d86815c6251a554f89", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470966, "uuid": "76bba5c6-51e9-4f5e-9301-85f5daddcdc6", "comment": "Malware payload (GuLoader)", "value": "dfdbefc4c5dacb3a696b9b8e34ca54a7628902c8", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470966, "uuid": "e86e9cfe-e64a-421d-a1df-fb37ab85ce76", "comment": "Malware payload (GuLoader)", "value": "392a2c48ddd13ccdfdb96e501c77713bc391f3c1f5fa3f686bc2dd18fadfcdf7d3a04f403bfd9560a3232202b12577ea", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470966, "uuid": "89ed040d-e035-4166-aa80-8235ba3359b1", "value": "T133936CE1EFA4151A0C4F3BEAED405882C5BDD12A4936116AFEDD47CE510B89C93BEB0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470966, "uuid": "1aef1043-f7e0-4083-b155-98435969a0f2", "value": "1536:D5D6WuMWhWeS0kENNgAxNKQ4DLgP4u60rfQmzUA5U:D5sVhWeS9EngkNKU4u60rffzUA5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470966, "uuid": "6374e546-3a7e-4a93-b561-2184dfb6dfcf", "value": 91187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470966, "uuid": "6a4bb2c9-8eda-486a-80ba-986afcf2287b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470966, "uuid": "60465510-9476-4442-85e4-f54941610d75", "value": "awb_dhl_shipping_documents_PL&BL_13122023_pdf000000000000000000000000000000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591bca5f-99aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702466741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466741, "uuid": "81932dc1-8f29-447f-9fa1-5920567837bf", "comment": "Malware payload (Formbook)", "value": "72919e26542b13acba9cace7d27cad49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466741, "uuid": "0d002de1-ddb1-4114-9acf-8753576eae90", "comment": "Malware payload (Formbook)", "value": "143f092cbd7313e6a03117e8aa077956b15a2c033087f094e0b21475bb6d42fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466741, "uuid": "b1a99f94-0093-4ba7-ab89-f5f0bea783e8", "comment": "Malware payload (Formbook)", "value": "646f32536db41119f491a9c6cdc5c8674b52e822", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466741, "uuid": "06b9f907-a40a-4a31-b16c-6b16af6fcae7", "comment": "Malware payload (Formbook)", "value": "857029699b53828bc089eed032bc47ada353c1a81d988b85054ecbe33636faf2e3389538c865d184de5e09edf1974422", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466741, "uuid": "4773ac40-385c-492f-9ff4-82c81d5fcdf5", "value": "T149E4230037396E1FEABB17B9D5B5412803717F6560B3F6DC7DC421EA35A2BA019A01BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466741, "uuid": "805937db-3573-4124-94c8-c22473cfd3d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466741, "uuid": "41be52e2-e367-422d-9074-a3ecf8af8a0b", "value": "12288:8uua+4WpAEDy7w80KYJyHIai2U2CO9usFEm/vdGbnTte82P0pWtjm6+:SpAEXuHYD2bPEm/+ZaBtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702466741, "uuid": "05b10005-0dfe-4d1b-96bc-1f30d793725f", "value": 690688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702466741, "uuid": "d9de99c8-3979-4fa5-9306-749da793e79c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466741, "uuid": "f23fd030-3716-45ac-a7a4-7d2b7dc962c2", "value": "BOMXsVEMOYKKUa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f0b607-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480885, "uuid": "b5881a36-5985-43f2-9cc5-3e6b78c102cd", "comment": "Malware payload", "value": "6b11839f04a077bc8bb4ce66d6003483", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480885, "uuid": "9911c942-79a5-492b-a15c-665b88dc0f84", "comment": "Malware payload", "value": "155ebe3958cb97d550c9d93f6cae2bfc0741ebb73ac8ea1b0bf461eb86bad5f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480885, "uuid": "c844d289-73e8-400c-9323-53c96473d5ab", "comment": "Malware payload", "value": "69af09b4f409d546b571dcf575aa8348b5e565be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480885, "uuid": "e6d10254-d02b-4c05-b6dd-f99174a1bfc1", "comment": "Malware payload", "value": "2fce541221d879f291decbf80c0e83a8b6e0507b069add10d96e6b4ea3c5ac47657d174b6c083e79a3fd1816ab20f174", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480885, "uuid": "c1a408c5-fc81-4c84-8378-197d6d272c22", "value": "T123659E44FAA280F3D3402B3106A2E735992B4FF5DA318BCF5554EB5E272316E5E36227", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480885, "uuid": "99557bec-edb7-491e-803b-b495d582f94c", "value": "12288:oJj56ap5K6qzwgl2/qXGVnnP4/TWI/mzrpimVbqY0jELTQ:o1Ww+2hVg/VSrplVOjELE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480885, "uuid": "ddd03c79-8519-4ee4-a273-ab9259a9e600", "value": 1470464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480885, "uuid": "9d5d376b-141f-4b09-8db7-9c7f3e02178d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480885, "uuid": "40742f00-f5a5-404f-871f-7dc85d5dd8b6", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15IBL0F.13020.6779", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aef0712-99b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702472193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472193, "uuid": "5c422e05-068e-4a40-93ad-ff9d22757381", "comment": "Malware payload", "value": "2e2061406bca2cd0689fd799c6986184", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472193, "uuid": "64e9258a-f74f-4895-908a-efc34a61ae2b", "comment": "Malware payload", "value": "166639061323898e19898567e7dcab34ae555ea1aa0da530b9621d919dbfcd60", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472193, "uuid": "9150b733-2adc-432f-be78-6e7d90c69997", "comment": "Malware payload", "value": "e6bd7619ad83fb00084ebb1f78f3063f4dc34a01", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472193, "uuid": "67ef10d4-0d84-49cb-a8a1-b1bf28e6eca8", "comment": "Malware payload", "value": "7719ed47a244b9d6be5467e338d093e591dc8fd9ac1130d2db238ccb6a9874925eaae9e5ec6ecc13e416ac18bd5fe6b5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472193, "uuid": "2bc4f1af-ad4f-42c8-8830-1a2e7c5b32d0", "value": "T1F2F1002A08EDDD2312839D4A485C2EFC00565F793B96C49E3104DAAFF46C7E25F45E79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472193, "uuid": "2722dbaf-3681-41b6-b979-78a1edafb8c6", "value": "96:nXi3NeB56BWtX8+6/6wBfT+L01XLT461xXPBtY8TF12wOhXiylAi+LG6AomZMcbx:+46/6Y5X4615Q2F12vAfLGqC70V2eS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702472193, "uuid": "f85f77f7-7eb5-4447-9a0c-f4ad65bb453d", "value": 7653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702472193, "uuid": "aaeba4c0-3c98-4119-a25a-ca79d9cdd323", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472193, "uuid": "0b193ed8-c35c-4275-8959-31f31fd39c76", "value": "inv_INFO#166452004.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0d81b8-99fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702502126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502126, "uuid": "70e98a92-c43e-417d-a744-36661cd0bd93", "comment": "Malware payload", "value": "b1cc96c1533d901d248d65289a127ea2", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "HTTPS", "colour": "#B27793", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502126, "uuid": "37388673-5f2e-4482-b1d6-715a2af03758", "comment": "Malware payload", "value": "18101518eae3eec6ebe453de4c4c380160774d7c3ed5c79e1813013ac1bb0b93", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "HTTPS", "colour": "#B27793", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502126, "uuid": "0fc6929e-7adf-4f3d-9b39-1cc2e766077a", "comment": "Malware payload", "value": "c4124809fc7f82a5184e4fcd81c95384bbd4e01d", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "HTTPS", "colour": "#B27793", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502126, "uuid": "a49ad9c2-8889-43b8-a216-289a145f5145", "comment": "Malware payload", "value": "6aaabf416724ad18377ddfb8f1e8f09245b1fb0ff39b2f7cea0d2414f4d501045d9020c2e786644482f9b83e4cbb3fb8", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "HTTPS", "colour": "#B27793", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502126, "uuid": "8f621e21-40bd-4696-9d71-cbba2376d85b", "value": "T199C39D7739CCC7B8E84D93361891B07AF0B3640779EA5AF3539692052714AC4EBFAE41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502126, "uuid": "76fe0f99-8663-474a-b5cc-0b39c0513f5e", "value": "a71f9a1c4a1445f92b7bbca6fba33a96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502126, "uuid": "8a32460a-be75-4a09-9feb-425d5aded642", "value": "3072:jDlS084+8cNuYIiukjv3HmkzSAgT8sjql+/xzKu2E1:jDlLR+8cvE+3XzStTRWl+/xOuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702502126, "uuid": "3d89cbb1-9d88-4030-9a72-cf2500071d65", "value": 124928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702502126, "uuid": "84d9e4be-b2ec-4e1f-8a9e-65004b84b550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502126, "uuid": "661aa78e-723e-4b68-aaaf-c1464f43e208", "value": "b1cc96c1533d901d248d65289a127ea2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecaa461-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480897, "uuid": "c9215047-02b0-47da-9192-2ddb326e1f86", "comment": "Malware payload", "value": "abae5100614ae4064e192427d67c7bfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480897, "uuid": "d574b29e-b35f-4a93-ba53-3976e7ddda5f", "comment": "Malware payload", "value": "1907009a7bebc63babbca813e18606735fbe8cfe045278cc89fd58570cc3c51a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480897, "uuid": "99351b67-2568-418a-88cf-881046c7e2f8", "comment": "Malware payload", "value": "60c74c2cf2dc3747fa5924a969666d4d2d8c32f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480897, "uuid": "b0c6306c-ba90-4184-bfc1-91be5f957a0c", "comment": "Malware payload", "value": "53ef68c86f80293efcf1b7ca1e106c222379712422718945dac7980a54a7661bdee316cf990b54018cfe5c83ac749777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480897, "uuid": "78eb80a6-e635-490a-9d3c-09d4123ce37b", "value": "T1FB857F71B192C833F6636B38CD679558D825BE201E2C985B7AF81E0C5F3B7C1392D296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480897, "uuid": "ed6a0ba9-f5da-42be-ae99-130f2de9f9f7", "value": "24576:xZ0SzHkWjQF2cavSt5j9BTDUNwqzzeDA2u446V4M96IqE:xLe62FUuATfsv9h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480897, "uuid": "d537615c-80ad-42c7-8362-91b935415978", "value": 1836032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480897, "uuid": "661427b7-eb3d-469c-a50b-8177961a25c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480897, "uuid": "77f06276-d50c-4cd5-9124-9ea545becace", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.11363.18789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e0323b-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480860, "uuid": "1ae6e4ac-42f9-4829-83c8-c1fdaf66eaf8", "comment": "Malware payload", "value": "c164b6ad01501f2d388f4579880378cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480860, "uuid": "49cbc0aa-5955-44a5-a13b-01b0b4a52546", "comment": "Malware payload", "value": "1a0fc0ff8239d41b7940fca6d3abd75db56b4126080f923145f00e7c851d1eb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480860, "uuid": "948a2990-2314-4e78-9e61-169157c60531", "comment": "Malware payload", "value": "cba3601681db5020f0b2d0412d939067dbb17d50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480860, "uuid": "0dade96a-7164-43c4-a866-2db72ea432e8", "comment": "Malware payload", "value": "1daa5fab6b8f710d1b1fa52a486b137b70c6855b23007b06c33161a48b37b15c117b40585bc3264d9b9e81698e158845", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480860, "uuid": "79430c93-830e-47f0-a373-8758de95fb00", "value": "T14A469D378E1D5CC9E90164719C1A8FDA2954EC21B5086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480860, "uuid": "60e84b72-dee4-4b5f-b74d-5a3318ee218f", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480860, "uuid": "3af17dd9-f30f-4949-aa45-cf9a32793099", "value": "98304:wo/tuxWqVybeqHbca8VtogTRUhLqTevOsX0G8uIqlDC75QYcB73bmQFhTRvdcbHZ:D5qVaXHQDtxTRyL3JX0G8uIqlDC75QYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480860, "uuid": "964d0e39-9c02-4f85-bb9e-032b8ecba097", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480860, "uuid": "82d74edf-4228-4106-a932-afe3eb169820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480860, "uuid": "7d54c75f-2e50-464e-b066-5a4ab7e99aa1", "value": "SecuriteInfo.com.Trojan.Crypt.13462.18462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08b58c0-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702471290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471290, "uuid": "d969c561-f913-42aa-8d09-88488042c75b", "comment": "Malware payload (AgentTesla)", "value": "d7de1830b08cf5a25d330fc854bc2dda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471290, "uuid": "1fff2d21-f32b-4f09-a71a-58c7fb308c1c", "comment": "Malware payload (AgentTesla)", "value": "1dbf70ec2819eb50ccbf3c3719cbdece49f52990a3e2b7de4e629b6a83f75f6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471290, "uuid": "ff89baeb-df08-422d-aa9d-1eef8b5e6e6d", "comment": "Malware payload (AgentTesla)", "value": "56d8bfe2f0dec4d4b9ef556a842b4134e6743b9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471290, "uuid": "7c54e997-9029-4417-9247-5d9213f38117", "comment": "Malware payload (AgentTesla)", "value": "34be2c52553437bf04322048d2ec09754e495255d6c5d6a6f141d224854a7555d93705a60172395b052994d9eee5ff4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471290, "uuid": "3cad69f7-e5d3-4099-9be4-1927f40d7492", "value": "T1F344126BD98FA4D2DD8D66BCC8776F2A1B63D903D58344D7A68873224C63346083E64F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471290, "uuid": "b3989bb2-398e-46d7-a3a8-9526ff2d26d7", "value": "3072:uZz00PxcwC0Wngz5mN4poTw0gOZkcC5daisd6rHHnbKkVK+W+bHUYwP+nvvEGWnF:u5J5DWnglS4WTxicC54iXTHBT7x+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471290, "uuid": "82dc8e5e-2f01-419e-8815-8492937f72d9", "value": 276368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471290, "uuid": "b3199ce4-534f-4926-996b-a94311c8e55f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471290, "uuid": "42a26051-9c56-419c-bf08-ec85d25f1060", "value": "MLPO988.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da239ea0-996e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702441188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441188, "uuid": "1a324d2d-cd15-4b10-991d-b384859a43d2", "comment": "Malware payload (AgentTesla)", "value": "ec644db72efc79bf9c561dde43231e48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441188, "uuid": "ff30d0e6-fc45-44e6-8955-57442838333c", "comment": "Malware payload (AgentTesla)", "value": "1e31a722e98cf690609b5e2c2e6a804b1be8d9909574d61834c8ad318cb4016f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441188, "uuid": "2ab36385-dfdb-4777-80df-6812fdcdf430", "comment": "Malware payload (AgentTesla)", "value": "89b38e4f52435a2aebdc390d7b456e51e52f3533", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441188, "uuid": "05cc272c-814f-4227-a091-d9d48ba5ff30", "comment": "Malware payload (AgentTesla)", "value": "7c9edf8e2f5447ff489fedbf14cd5082bc0c020f4a370d88710cb21e6e41074b38beb62b1ada96bd48ceb6ca2b036da6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441188, "uuid": "716d4027-566e-4426-9e62-cef21c6a5af0", "value": "T14815B23D19F92227F174C3A5EFD0C523B260A5EBB1629964DCD643964307A0BB9C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441188, "uuid": "5c7ca647-42d2-4cac-9ee0-7fdf47a9ee46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441188, "uuid": "20b6fb36-f2d9-4e67-a710-4679027af288", "value": "12288:Mfu+e5FyT5X4CoQfdmaHmJLlRBNp+P4RzIEgVEXMnEEMp+a2x0gH8iM5L:ofiFA5oCoQU1LrBNsazIlEXEEE42x8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702441188, "uuid": "2e671063-e806-489d-b726-9d28f3e5ac83", "value": 942080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702441188, "uuid": "0dbe7ec2-c3d9-49d8-a28a-12ae33b21f2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441188, "uuid": "65db0b08-81fa-4566-8712-8ac9efb85acc", "value": "SecuriteInfo.com.Win32.PWSX-gen.8987.8002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0ea299-9961-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702435527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435527, "uuid": "d9eac5bc-20f1-49a2-8882-677e2c0c5aa3", "comment": "Malware payload (Mirai)", "value": "6eeb5673d6ae3f5f69fc6c8600da779c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435527, "uuid": "67ee6d31-1b2a-448b-b0b2-235de1ab5b83", "comment": "Malware payload (Mirai)", "value": "1f272418954f12cdb7f13cd7cfe84482b2bbcf4c7e7ec2c39074c26b1f700a66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435527, "uuid": "a6b7b6e1-c6f5-4c7f-92dc-d3d2194f8f68", "comment": "Malware payload (Mirai)", "value": "71cdec2155ddd465015e338017e341a3da36847a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435527, "uuid": "d9896189-13cf-405b-b35f-6a2149f3514d", "comment": "Malware payload (Mirai)", "value": "c1fcbcd8be96a3d1cc2c74307644408c1d49f0437b6b797f2b31f19c6cd84d7c4b90666ecbaf1640b3af8fab5470bada", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435527, "uuid": "f15483d4-3cca-4c5d-a60b-1a499e818813", "value": "T198C35C46EB408A13C4D51775BAAF42493323E755E3DB33068918AFF43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435527, "uuid": "865614fe-a4cf-40c6-a266-0fcc4d901df6", "value": "3072:ZyxVZcrPR3bTnle1cJwmalEbr+imIxVnaz:ZyxwrJ3bjle1cJwdlu+imIxVaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702435527, "uuid": "12a3a0da-c7e0-4505-9a28-7b5a4a2a09e9", "value": 125738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702435527, "uuid": "f2747726-2a36-463f-8c8a-5e3c4efe316a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435527, "uuid": "a303f398-160c-4acc-9fc0-5bebc0cb7c22", "value": "6eeb5673d6ae3f5f69fc6c8600da779c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63ace47-99cc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1702481581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481581, "uuid": "8622513a-2000-469f-ba4c-2e32023b0658", "comment": "Malware payload (GuLoader)", "value": "1e76d9fcf47e9e20ffa84a920d7e0dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZD 595", "colour": "#044718", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481581, "uuid": "d9dcf91d-29a9-4506-a52b-861d9420e426", "comment": "Malware payload (GuLoader)", "value": "1feda4a8d8115f08b73b044385f3b2b9df8c72a863811549908ae217aa3b8b04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZD 595", "colour": "#044718", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481581, "uuid": "334e0a6e-7556-4d4a-ad95-8a3bf8748784", "comment": "Malware payload (GuLoader)", "value": "07874d7199b6d83ab7c76464fa43f7a168b7f90f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZD 595", "colour": "#044718", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481581, "uuid": "e6251f0f-9df3-4805-8a49-aa669ef153f4", "comment": "Malware payload (GuLoader)", "value": "72ab69b846694d42006d002cdb80741e213368ff7da8897ce161ad5a7573480814a79ac93779629935f7564278a5a97b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZD 595", "colour": "#044718", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481581, "uuid": "7b9fd0d2-3ea7-470e-9058-87710994543f", "value": "T1469423C537E1C94BCCE31FB21AB957738EE7952915F0478F5B508A0A7D26382EC0E616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481581, "uuid": "476482ed-9892-4670-990f-1b8cd3232743", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481581, "uuid": "474b085d-d184-47a9-a754-4f7b125b360e", "value": "6144:8NeZOlc6w6iRpZiXYRRSGAy/zK7OcPeEysikNPhjlEERYAbYh3WzZ1am3g/cDoXp:8NN9iRpMLFy7uhbikNZHZR3NDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702481581, "uuid": "568a53b9-b55e-4543-b6a6-cdba820c9bdc", "value": 428680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702481581, "uuid": "2e2507b1-a07b-4d54-9384-e54cbdcbd1f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481581, "uuid": "4969b596-cddc-427b-99b6-c473a658b3c6", "value": "Ordine ZD 595.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f0e6ba-99a3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702463722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702463722, "uuid": "bcbaa846-8529-48a6-92bb-22107af0d758", "comment": "Malware payload (LummaStealer)", "value": "bb2c8e8cc3eccb86d943cf49033f4b92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702463722, "uuid": "6df2247b-8378-4c86-be85-9bcf194dcea6", "comment": "Malware payload (LummaStealer)", "value": "2039cb387b3b5d921013b7985e15d09c87307bb25113860aec887a50b7b63be0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702463722, "uuid": "7d09c7b7-6040-422c-a3b4-dbce806593ae", "comment": "Malware payload (LummaStealer)", "value": "5150a1ce0cc2ded54df27d8f7c0a202f18c1c560", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702463722, "uuid": "58478156-6d41-441e-bdd0-b43d69e250b7", "comment": "Malware payload (LummaStealer)", "value": "478bb0173de78f1d736d8fde9c331ad9fe20238150fa36ea47e510a1ac6ba1239fd727a47a621eb5dd40a62408e375c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702463722, "uuid": "d1df0030-55f6-4ae0-8e75-eabda3e8194c", "value": "T14BF5238E77852B53C5E43872DF4226C87764E855278BE35738E532B51D3EEB3848228E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702463722, "uuid": "ee52cf00-c99c-4037-8c2f-31ce5618bee9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702463722, "uuid": "8e5ac68f-c5ad-46c2-934c-f814b77a3c7f", "value": "49152:Em23W/18H6XQ2NiFrF2vgHbXLaaFR4k5oISJNmMRbKo8Z50BTc5a5ZbRt80p26zA:V23W/18RhFaICan4e6wM9K50lx7lY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702463722, "uuid": "fe6c382f-7021-4bde-be51-109e880fcc5c", "value": 3475440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702463722, "uuid": "8f988586-d8ce-46ca-830e-05a84a86ba3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702463722, "uuid": "c6a15f4d-17b8-4c06-ae98-3ed5994f3662", "value": "BB2C8E8CC3ECCB86D943CF49033F4B92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c851f3-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480850, "uuid": "7bffa3c8-7fbd-4100-89a3-34dd2b51fbba", "comment": "Malware payload", "value": "b91f97b923022ba636c1431c2faffc0e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480850, "uuid": "0034f4aa-847e-4f05-bf6a-5cc357c8e738", "comment": "Malware payload", "value": "2086c45a79b354e8fe50a03633de56151958959ea5c1a19f1b33d96922a037e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480850, "uuid": "10061266-4a8a-4bf7-9b9a-c809c088d0b0", "comment": "Malware payload", "value": "67832fdb5f3e4e99b979688181311d853d553f1f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480850, "uuid": "b0e2f0d6-47b9-4e3c-aca2-320fdd97d35f", "comment": "Malware payload", "value": "faabbbc6f0f7c1777dfb9fd8010387f032fc1d99f53a964682ddb50177a48a98799257b697b1e793692a27828556f701", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480850, "uuid": "4d198a65-985a-4c52-9a98-01ffa617e6ac", "value": "T16AA5122E77F0F492C01C0D300CB35ED888D1B4B5ADEAC6BBB6941D5D2C661659B3A3B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480850, "uuid": "bc734ed6-62cd-45fd-b1a8-060473eb3b01", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480850, "uuid": "d1bfe992-e10d-4b6f-8aec-fd10513059d4", "value": "49152:V7DaZmown+0c0HVpQzoJ8NyGWaaNYI3DRfv+F:tDawn+LSzIoyYGMNY61v+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480850, "uuid": "ccd6e6b8-9bfa-4d59-ab4b-677d140399d5", "value": 2084149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480850, "uuid": "d94fa89c-345a-469f-99a8-8fd7b37a4895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480850, "uuid": "8b72c70c-8194-4ddf-ac00-c1d21b56d5ed", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.5011.14269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f2b6d0-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480825, "uuid": "dbd08e07-9e9e-47c2-80ab-0e4bb9f482a0", "comment": "Malware payload", "value": "77e79117d1a6a9964f953504ffa6f77f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480825, "uuid": "39bd464e-9ee6-43bc-bdd6-285bb248cb7d", "comment": "Malware payload", "value": "20a3e621945710e5fd011a7ac2d47d5f0004d899ff8dfdf703ee58845c08d25c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480825, "uuid": "72ba4f78-20c9-44b8-8061-e8da0120abf3", "comment": "Malware payload", "value": "b58e0dc44387518c861f8b8cc67fe6b4846affa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480825, "uuid": "5aa4230e-6ff9-4e4f-bc5b-d5dd87a25a67", "comment": "Malware payload", "value": "178a947f909c3572cc7c56a66605f3bf3b924dd5fc5301aa8b1a1eae9122d4b656b58f60a3b153e97c39b20394ac17d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480825, "uuid": "7e432a84-ce46-417d-b445-178680ac71b2", "value": "T1A0C5235973C048ACE64602344AB5ADDC924B1FEB4D5AC22783C65E8B43DCE44AB7DC7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480825, "uuid": "78f5a300-c5cf-4893-8bcb-5f651de22a8d", "value": "54fba2935821c4b8e649329105ecee8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480825, "uuid": "65699b27-9bd9-4721-8c20-ebbc0e3ca96c", "value": "49152:55SmDGTMgvIiB3oqSVbA+DkmOk4ikGyxb8iVQrPtaG1tyEYa5HMkluiyA:3gmZA+Tf2tV8VaG/1T5HfxyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480825, "uuid": "e0c98c65-38d2-48fc-91d3-d13c20b1c5fd", "value": 2519040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480825, "uuid": "7637dd3a-59d5-4fc4-82df-41a7c9499671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480825, "uuid": "8d5bcd54-e3c8-45a1-b856-eb776c9478f6", "value": "SecuriteInfo.com.FileRepMalware.6852.1526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1380263a-99fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702502702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502702, "uuid": "3d704094-52fa-4aa6-b44c-c1f9a0808ee2", "comment": "Malware payload", "value": "5ba4f88f92415a420b61d8fbe5205db2", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "HTTPS", "colour": "#B27793", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502702, "uuid": "6f29f30e-64ff-47ed-a2f4-1938c5c4445d", "comment": "Malware payload", "value": "219fb90d2e88a2197a9e08b0e7811e2e0bd23d59233287587ccc4642c2cf3d67", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "HTTPS", "colour": "#B27793", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502702, "uuid": "df91da16-791b-4f3e-bfb0-ed593950dacd", "comment": "Malware payload", "value": "7288ff36f61f4643e247427eb6abc42d4b4ceb05", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "HTTPS", "colour": "#B27793", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502702, "uuid": "7e6414b6-03ba-4539-bd08-9867476b2da7", "comment": "Malware payload", "value": "1133fa35ad572e223fadb7812edc63f045b4e544cf482ccd19be1f13dcc97bbdaf87792b6bad354398b68df6fbee79cd", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "HTTPS", "colour": "#B27793", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502702, "uuid": "fb1c3603-d3ae-4d2a-bfbb-ea3e8ec083da", "value": "T187C38DB73DCDCAACE84CD33A54917076F0672443B4E696E723C956067A10CD8EBFA902", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502702, "uuid": "5d5de850-898a-49e0-82ca-8af3f3fc2680", "value": "6607680c0885f4938f9ed6bb9cf621f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502702, "uuid": "566e9773-cea5-4c48-a257-5f7342d66b36", "value": "1536:NSckZv6326xXF3T5kzV0OoElwVfK0g3U3EkQVMKYRdbhSx3DVxNM1zwpgYjJL8KR:NoZv6xjw0EKrL3EkQ7YRdbhSFA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702502702, "uuid": "52a3bad9-c939-4998-8bff-26345f1a29eb", "value": 119808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702502702, "uuid": "92bed036-0512-496b-96b3-315312a39aab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502702, "uuid": "3439a80f-51d5-44e7-9100-4e8c23338303", "value": "5ba4f88f92415a420b61d8fbe5205db2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e78ef1-99ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702468487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468487, "uuid": "d11bd707-89e2-454a-87ae-fca7de052c2d", "comment": "Malware payload (AgentTesla)", "value": "9ccd982675ab825de6ad00c86895ff1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468487, "uuid": "2323ffab-40f8-4fb9-b6a0-5540d086d5b6", "comment": "Malware payload (AgentTesla)", "value": "225b4b7d2c3f0a60f336013dc3ebc64d9558bae61effd383769b13152b905ee5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468487, "uuid": "d0891c53-18a4-4264-be5d-d4458e29eb36", "comment": "Malware payload (AgentTesla)", "value": "ff698aa63a82db6a02dd6fe9bfc906f4677021e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468487, "uuid": "d2b37d86-34de-4016-a8c4-eff5f81cba88", "comment": "Malware payload (AgentTesla)", "value": "62c00ca65bc509ffde4881d1addbe104cba1099db0f7213135700b198e09e4306dae25d9c410a5b599ffc2ad2afab9d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468487, "uuid": "e39dcc57-bb0a-4b1f-950d-a406b287fad8", "value": "T1579423262264D8AFF87317362977B3620FB9BE5661A8034F07107E797E317429D1BB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468487, "uuid": "309559f6-ef45-46f8-bf95-908c5016e6b0", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468487, "uuid": "7fc95f1b-8dd0-41a9-8bf8-5c715a02bd4c", "value": "6144:mNeZOjguTKGXr4GrZLlz5MTkuAXDc3JeNTozTpWuNfPNoCt7UG1am3g/cDoX5pZ:mNNjCGXrjTewu1JeNMzcQNf7UQ3NDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702468487, "uuid": "44464032-3243-4596-9bb0-5d213b4be5e0", "value": 427944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702468487, "uuid": "c281e735-056b-4bd0-95ee-b8fa26491813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468487, "uuid": "8ec95261-424c-457a-b71c-dbc41e05c550", "value": "ORDIN FINAL Nr 593434064-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981e1bbd-99e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702491328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702491328, "uuid": "d9e9c2a0-2971-4227-bc1d-25f1b4cd5e4e", "comment": "Malware payload (LummaStealer)", "value": "1e26c4658a438ce29a46f273dcd3554d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702491328, "uuid": "3471a4db-e571-44b0-9310-f93a4e73e4b8", "comment": "Malware payload (LummaStealer)", "value": "227a93c699b007d151173c7e4a37860a10fdec79eb69f912e2026e6866444cba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702491328, "uuid": "bc35aa89-4855-4e44-99c3-487d156f21de", "comment": "Malware payload (LummaStealer)", "value": "7a6e56a196b141ef26d0ee0fa086148dc1905983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702491328, "uuid": "4053a305-313d-4da9-a2d5-ad7ea263aa88", "comment": "Malware payload (LummaStealer)", "value": "8b8699c24d6b6313a601ecbbc215f743ae67d9ce991a2f25731c7df727949fdd8324db44fc298c975bdedf078a965e1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702491328, "uuid": "caed2917-f88a-4e0e-93e1-c3312466407e", "value": "T17965CFB1FD409821DDA3177721EDB16249BFE1700B580ADB0ACC16DF96606C76F38AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702491328, "uuid": "c90be4b6-73c2-4e9e-969d-0a10af286515", "value": "6b37f11fc7c7acdee17d5888878cc6f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702491328, "uuid": "0fde1924-033d-44d2-9b8a-d804508c604c", "value": "24576:afa/+3/GhabdgJOn6fmMSRiLgXSDqNVq8Mt4cRL4cZMS:mGhabdgJOnRM99Jfv6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702491328, "uuid": "2d04e323-8987-4a23-9f11-3522d17f5c57", "value": 1513760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702491328, "uuid": "455d2227-a9ba-4855-a418-16ce88185ecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702491328, "uuid": "5a66a5d2-6731-46ad-8acd-6f1627ed2134", "value": "1e26c4658a438ce29a46f273dcd3554d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2d9dc97-99c4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702478166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478166, "uuid": "578c66ff-fded-4595-81e4-e22517e4fd6b", "comment": "Malware payload (AgentTesla)", "value": "4066fde3c127a29d0f71a79a80fe6d3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478166, "uuid": "83168df2-8825-4b2d-8547-bb8577b1d109", "comment": "Malware payload (AgentTesla)", "value": "230a1efb69163ca1bc9bfbf2343b48eb4dbb0263860fcd48e8ae577c08754c16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478166, "uuid": "c165b97d-d66e-4ada-a415-4926aafe66aa", "comment": "Malware payload (AgentTesla)", "value": "ca4759e21e735802186eb8c904e3a72daa21aba7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478166, "uuid": "1b31354b-81ce-44e7-9cf5-8885832bf9b1", "comment": "Malware payload (AgentTesla)", "value": "5ffdc337985feff4a9429548cebe4e576021ae320562ee07d32a505b3c8d1afce1edf6c6d7fdf23ca15ed71a5e841d40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478166, "uuid": "faedc574-6f66-40c9-8873-a933307a2c2c", "value": "T1F015CF03B7178AA2C7946B75CAA356000361F5A742ABD70B77CE23A916833BF9F51707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478166, "uuid": "be1cf1d1-bb74-488e-843a-be38f6e35f0e", "value": "12288:JWyzRXfVVacmd2nTDxoxOFR5Lp5KjpuSkbdeBPzzQ8xH0g:QyzR9VTmdKTDWxOdYpQpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702478166, "uuid": "1551e54a-5d1a-4c75-a621-c06bac37df30", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702478166, "uuid": "0a1586e3-4f64-42ad-932c-568b615e557d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478166, "uuid": "6c22395a-1e23-4ba7-840c-c371582da909", "value": "payment slip copy.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20554438-9998-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1702458915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702458915, "uuid": "0765b4a3-c1c8-4151-a1b3-36e89eb91c92", "comment": "Malware payload (DCRat)", "value": "aa70ac4dbe54f274a1b34f35902e229f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702458915, "uuid": "a7fbe207-b0be-47ed-8a9b-415ce90dd402", "comment": "Malware payload (DCRat)", "value": "23219cdeabe4f8cfa5f445ac24ed7e7571402f99e6878f68b1bc69ae26ef88a9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702458915, "uuid": "e8aaaf08-4ea4-4be3-8bba-efb2edefaf4f", "comment": "Malware payload (DCRat)", "value": "21062251433ed2ea4fd43e5b01cb5134c791b82b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702458915, "uuid": "11dd9794-9ee8-4358-80fd-4fabe900871d", "comment": "Malware payload (DCRat)", "value": "cc49cf768b37645d4bc237dc1220ec83c2936bd9a53a70a1e36f715fbb36b997abdb1580cdec226b3c849372066d0790", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702458915, "uuid": "73761f7d-bc86-45f8-ac25-a84ca2b3fdd1", "value": "T15405F7027E44CE22F01D1633C2EF454887B49D516AA6E32B7DBA376E55123A73C0D9EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702458915, "uuid": "16cfc6f4-0a64-43d1-8363-c2b098b48a15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702458915, "uuid": "db5b3982-9ae6-40ce-8f97-a42be0c32fce", "value": "12288:wCfLwPswyLLi6GtM/rOkywnjxxsFqDBU2oSsFBqev4TtD:wCDwUwyLL2M/rOkyw5e23sFc2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702458915, "uuid": "bd1794ba-1f10-4c19-a18a-6a08ff28fa56", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702458915, "uuid": "0fb01a0d-ce60-48d3-a4e4-50e78063671c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702458915, "uuid": "73638b4e-553f-4330-ab7f-fa372fed64c2", "value": "aa70ac4dbe54f274a1b34f35902e229f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bbdf23c-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702471013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471013, "uuid": "781036f9-a5bf-47e0-903e-07b38cd211df", "comment": "Malware payload (AgentTesla)", "value": "1b20497308dff8224c9fced74598b52f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471013, "uuid": "b6b2171d-7df7-4602-a5ec-ebb47927be80", "comment": "Malware payload (AgentTesla)", "value": "233250bf7ea9a9e5727b2f597c6e8cbe52fa244030b8cea0e0e0528914fc024c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471013, "uuid": "b51ba26f-9113-46fc-a978-ab9ee6f5219a", "comment": "Malware payload (AgentTesla)", "value": "e6ea2f59a6b41ba0f7093ab8cc0d4a34dd62ec04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471013, "uuid": "c8de7e3f-e551-4f49-bc7b-16b134e100c9", "comment": "Malware payload (AgentTesla)", "value": "4d317695329d9a6c1bade0cfc264a5f0e6f15776c34977d53afe39b1a1f5f2bb1538779bded9c86a0928794ceabb02a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471013, "uuid": "91fd48be-3499-47dc-8e40-41ce445ac05c", "value": "T1CBE42348678E1A81C278587987F34089D7F6E2E37840DB5BEED827B31357F702C49629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471013, "uuid": "21bc92b1-adc9-41c2-8e60-07266d88aef2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471013, "uuid": "040ae043-8388-4e57-8c7a-a8cde7f0c3cc", "value": "12288:+TyLnkJ41ydW0LRYgqRphv0YYVPKKleWZRARVMT1+KNC1F/6WGsiTsaQjozvMRF9:ZLJ1ydWEqfYxKKfkRmTz876W5GsaQjoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471013, "uuid": "4cfc4e62-5610-4648-908c-822ad9f844e9", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471013, "uuid": "38d61750-03ab-4f81-8640-dfc730fa4cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471013, "uuid": "1eac639c-fab8-486f-83d1-18b61c47d360", "value": "Halkbank_Ekstre_20231212_080757_783952.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cdff4ff-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480867, "uuid": "a9b9d976-dbb0-4615-99e5-4f38cce2e583", "comment": "Malware payload", "value": "b082bdea3bdaceda87595e8809a41fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480867, "uuid": "ea914915-16d5-4ad0-b0a7-1c9a1a44d984", "comment": "Malware payload", "value": "2469d723989640af33e4895611c517a0389947c5311ec6505e4bae890b78e039", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480867, "uuid": "444483a8-6265-4bea-8345-537f82b2710e", "comment": "Malware payload", "value": "8f3220e52a922df8f82ade09acab593a3599bf1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480867, "uuid": "393b00da-1725-4e61-af19-6b72c856b95b", "comment": "Malware payload", "value": "5d42eb97ee05daa6b39eed5bab770a723ca2a0ae5075e0da3f7cdd5e1ea446185968355f7e66581c0dfccfd83a845fe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480867, "uuid": "2dfaa82d-5930-45a1-bfd5-cd878e22e663", "value": "T183469D379E1D5CCDE90164719C1A8FDA2964AC20B5086B9B75C1B96DCCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480867, "uuid": "41d3f9b2-9fee-406c-8798-d0555f7c684d", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480867, "uuid": "4ec372b4-1432-447f-9d15-dccca64f7a4e", "value": "98304:twA95nOGjG1DEHeHW9gkqGhMqTIxO7xdp+mgulfa2FMIRavYd96:td5nri1Q4Wmkq8MlIxdp+mgulfa2FMIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480867, "uuid": "7679923a-8800-4388-8b60-804dd28ea010", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480867, "uuid": "5bc2bbf7-c9f1-452a-92e7-adc08fcd8905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480867, "uuid": "9d98e439-7053-4d3e-8c9d-a68015f97d80", "value": "SecuriteInfo.com.Trojan.Crypt.29626.11410", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358bb890-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkTortilla)", "timestamp": 1702470976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470976, "uuid": "d9a799c2-442b-4686-a06d-2aa8af5defa2", "comment": "Malware payload (DarkTortilla)", "value": "f153865ce138690d2f76ee5cbe19ae21", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470976, "uuid": "494e7572-1988-482e-9ec2-7301823b6aa1", "comment": "Malware payload (DarkTortilla)", "value": "24ed4bef9818dab4794cc424c53090bdff4f84c6f0472609d0e7c1f59b5ffcf9", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470976, "uuid": "dba80741-5560-45dd-bfd1-1f6437087284", "comment": "Malware payload (DarkTortilla)", "value": "29653e9d6477db2b515978e7818613317288b865", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470976, "uuid": "1d8bc12c-2dde-4cec-a405-3c86c801e2e6", "comment": "Malware payload (DarkTortilla)", "value": "12462890f8cab9449084217758c313b38b769a4ef4c61f7f27b02d2ea02eb80409aeb3e06f30c1f556400111c8c25349", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470976, "uuid": "334cf271-ff38-4e18-9bcd-3a644fb3cb50", "value": "T1B7854817F3084A58C45A1F70EA33C03542609E57A3628606BAE5BDBF7EF978A06531F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470976, "uuid": "db4381c7-8f26-48d8-941f-983cd99c008d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470976, "uuid": "832da746-0eff-45bf-9ef2-43af2ae7c411", "value": "24576:0KiZ4G1+g7ZcwG0iwnKFAtqQOfWPa/Q6KzHrR23:0KiZ91+g7ZrxRnKFixOfWPaort4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470976, "uuid": "1b8c31f1-f591-48a8-a3da-916189c45bcc", "value": 1803776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470976, "uuid": "6d158ec8-9011-4ebc-85d7-e46acba4b5da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470976, "uuid": "c035c7a4-6bd0-43ce-a93d-815f5001ea4e", "value": "Rescheduled_DHL_Express_Courier_Pickup_CBJ231025122556_DEC23_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cf1b31-995d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702433746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702433746, "uuid": "f4fffdac-25f6-47ce-a133-89cb00cf40cd", "comment": "Malware payload (AgentTesla)", "value": "31654c69d6ff281613694d10f14040f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702433746, "uuid": "bf7add44-3271-48ff-833d-ea431801f62c", "comment": "Malware payload (AgentTesla)", "value": "25ed66335a82f70ae9980bb3f4635398c537b294eeca7728d5994ce9b266ca12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702433746, "uuid": "049105a7-d62d-43bc-9a2e-37578cfb1a68", "comment": "Malware payload (AgentTesla)", "value": "d47e5c4b893480486932190052ce154ccdbe14ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702433746, "uuid": "db8e68c2-01fa-4731-afbc-8a6c61c59eb8", "comment": "Malware payload (AgentTesla)", "value": "9028cc36f2afc3a4ddd3848420bccb506c3760689f72e4137cfa8fa233a433aa5306fcbba591e5e1ac1c686c106f8e5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702433746, "uuid": "4708c639-ae09-4ce2-a3e9-286511fea3bc", "value": "T1E415B23D19F92227F075C7A5DFE0C527B260A5EBB056AD24D8D243960307A4BB9C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702433746, "uuid": "9168184c-5862-4f61-a39b-fda38ab02a90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702433746, "uuid": "d7a1808d-872e-483b-ab44-3d41ea66b1da", "value": "12288:RwrPtrlHjVOhefWnE29FPcAqox/P8XHyf+Ivtln0POehoAp:RetrlHjMhd//Eq/0Xy2cn0Wehn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702433746, "uuid": "6dced96e-abf2-4e59-9c5c-839f96bf76df", "value": 911872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702433746, "uuid": "f38b91f2-3c1c-4385-888c-c268d723917f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702433746, "uuid": "518909cf-007e-49fd-8774-d28f8dad3b7a", "value": "SecuriteInfo.com.Win32.RATX-gen.14246.10866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec35d9da-99c6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702479014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479014, "uuid": "d44d9816-7a4c-493a-bfbc-992001e9e6c8", "comment": "Malware payload (RedLineStealer)", "value": "63b6fa87eaf88cd197e41e62ecfc90db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479014, "uuid": "f819b19c-de59-4fa2-945e-f6b3ad14b1ab", "comment": "Malware payload (RedLineStealer)", "value": "261f48d83f212c741ba1b6009edc507e122b144768f0fce2510ac745eaea9c39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479014, "uuid": "45e2fe24-1db0-49ae-bfdb-8cf290a4f325", "comment": "Malware payload (RedLineStealer)", "value": "b32d2531aed979041d58a11e140bcf4629b906fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479014, "uuid": "14ae74e4-3d44-42cc-aec0-002b7f59ead0", "comment": "Malware payload (RedLineStealer)", "value": "4148a1a5ffcff1754d77159bde818a180f89a8f2cf2c7af3945857887aa266018c2c27814596a73d2dc4c88ff6128bf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479014, "uuid": "90967e04-c15d-4ac3-8e50-8475eba61fff", "value": "T14A4633CFBA9940CCDD89F97A7585FE003F2514FD02ADE30A97A4AF0AC42575290D97AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479014, "uuid": "aec57bda-e9cd-4bbb-8aff-173529c9cb83", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479014, "uuid": "c48b3219-9517-4a46-811d-0d756b0913ac", "value": "98304:bXbDQxkqBWBGYqzMol3i33vTX5Pe3ar/odenW0fhQfNlrwl/IjgJVZgLNMA4Xh:bXQSOWBGYqzMEinvTBHToEnW05YlkIQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702479014, "uuid": "d43adabf-260f-4925-9448-773303bd3cdf", "value": 5851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702479014, "uuid": "03955e4e-c486-426c-af3b-dcaabd3f8e0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479014, "uuid": "73a82a74-4678-439d-95f9-fb8bdcff7b3a", "value": "63B6FA87EAF88CD197E41E62ECFC90DB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af66110-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480917, "uuid": "6d2ed2da-a771-4148-b6e9-9bcfa0d4bc1d", "comment": "Malware payload", "value": "10dc8b306c3eab736f3fad11753210f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480917, "uuid": "4339331b-2bfd-4c55-a86b-9b93b56492dd", "comment": "Malware payload", "value": "2759ec400e8089311e9f3991090ddd77f3cc7024b365a2b94cda2aa531d017ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480917, "uuid": "cb9d8066-2474-4803-b865-502e1dd1a3fa", "comment": "Malware payload", "value": "b52a08aeb8b7557f57ad42bae900d461e5296d10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480917, "uuid": "c52922cb-4e10-45c6-9c4f-3d0941e6b3d7", "comment": "Malware payload", "value": "c01968f908445ba78dd0be2b1c562a3c5cb852d9af9c3ffb117f27c9e1e5ba66b5d68d003a4d09f23e2a4817a59c7ceb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480917, "uuid": "b510cfd2-c75f-4dff-92c4-fae2d729f3a4", "value": "T1FBB56C323E71A056C2B33D74826D977EB67999208F3D12C752911F3C2F70A929538EA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480917, "uuid": "ad872d86-5ea4-4163-bf2a-a77c8fe5a527", "value": "49152:wBxSWAghe9DihzRQU66/hGOL/92esx06DBbDPHVrzVNqpU/abIg:wnnqDihzRQURpGOL/92esx06DBbD9rzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480917, "uuid": "ddd1cc5b-1aac-44bd-b62c-5822da4103cc", "value": 2453504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480917, "uuid": "12648851-16a1-457e-b88a-28bcb13860ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480917, "uuid": "c202f9a8-8f02-42b5-a701-d51bb7e79684", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1318457.28110.25309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ceefb2-99a6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702464888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464888, "uuid": "6fb1f129-c09d-4a78-9dff-80a8995be88e", "comment": "Malware payload (LummaStealer)", "value": "a1d00e2f9203983edab087b1db560c9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464888, "uuid": "a43dca66-8b5f-4e3a-97d4-5671db0855bf", "comment": "Malware payload (LummaStealer)", "value": "2798fee2c619a5c051303f825079e25d08deaa66c8dfdcef20a9d13057867146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464888, "uuid": "fff3e4e3-f1aa-4e60-bab4-96e90b6ec1dc", "comment": "Malware payload (LummaStealer)", "value": "bc561e229cd5166b0bccb64b6e592b4a87a72642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464888, "uuid": "7bef80b9-61ed-4081-96a9-9143bcc36108", "comment": "Malware payload (LummaStealer)", "value": "2d4843c118065265eca050185153b4536a77316c2dc0b2eb288b5dd93deedc6d820bb6fc1571a54e3fd05d64e0ddf76f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464888, "uuid": "9d7c4c8c-a99e-490c-8efa-751d6855e2e2", "value": "T1AFF4AE36A7C542FCC452DA3598C49F28D62CE1A6CB566D47B30A09C6CEDC58ED620EF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464888, "uuid": "ec6ec2fa-6fa3-453e-bf53-746a39aea865", "value": "5126f161c901e3ab94a05a58465b8645", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464888, "uuid": "a4397a11-729d-4117-a142-42cdc894d968", "value": "12288:+0G2CbklWvwVkkeo2B8Ohp72Qu/sHCxXgvVVxMDePQ8++iywzMxv:+0G2CAYv5JBRhMTEi4UCtizsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464888, "uuid": "7573c350-8a15-44f8-bedc-9b66480666fc", "value": 731424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464888, "uuid": "2e093eb4-23d6-445f-af86-20d187bfea25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464888, "uuid": "f6f1e671-695b-406f-97b9-eabdfecea875", "value": "a1d00e2f9203983edab087b1db560c9b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f18b23-99b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702472507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472507, "uuid": "eba5cd99-9a81-45f9-a442-0ad044470368", "comment": "Malware payload (Formbook)", "value": "ae6845b38453a7fec25dbc4239195544", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472507, "uuid": "26295a04-5bf0-4ba4-8025-6be156303156", "comment": "Malware payload (Formbook)", "value": "28cae570f064be5296ab1494ac94ac33772fd78f411f1c73386795778e428ae9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472507, "uuid": "bdb2af1d-d059-4395-b4d3-16a105661c9b", "comment": "Malware payload (Formbook)", "value": "77d05faf6a326586312215d3efd2eed8b1be653a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472507, "uuid": "084d658a-1e8b-43b2-9127-385eaa4eff07", "comment": "Malware payload (Formbook)", "value": "6b4bb15a189cb4be902026f2ed3480a02d74c0fa2807b69ad4a34d8ea4e16d72681444a2f31e80094a904116c07176d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472507, "uuid": "6b122a3e-db69-46b8-99d4-0f9ba43149be", "value": "T1FB15B33D19F92227F075C3A6DFD4C527B260A5EBB066AD24D8D243960307A4B79C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472507, "uuid": "d6f60908-e8c1-4892-9e5b-138186ec46be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472507, "uuid": "9494558c-4de7-46de-8e47-b09bd3fc0d34", "value": "12288:I7PthcE9EPHL2rJmZVEAk3OOQSQDaV/iA+RPQUMqERmPF:IzthcPr2rJm3k3BDQA/mFQUMqERm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702472507, "uuid": "2dbd49f4-9577-44f7-a3ff-f9eab9ba17f4", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702472507, "uuid": "aa32570e-5037-4806-a082-ad5938f63f3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472507, "uuid": "4be8bff3-8f0d-4d2e-b51f-04d526a926e4", "value": "ae6845b38453a7fec25dbc4239195544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e731333-995a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1702432497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702432497, "uuid": "322d6229-1400-46dc-9ff9-06a796297770", "comment": "Malware payload (Smoke Loader)", "value": "0be90dc3245c6e5a4ddb14c9cd1b6520", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702432497, "uuid": "0e29cacd-1920-4fff-9b3c-f493fbcd01b7", "comment": "Malware payload (Smoke Loader)", "value": "297923a6eaeca84d054a263d3a9c13cb3fbaf5704f714d308bde0fc7a4630c5c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702432497, "uuid": "d257f5d4-368e-44cc-9ae7-6d0a47b203b4", "comment": "Malware payload (Smoke Loader)", "value": "ca15142e1c01ad9a8a70952988c071cac60a7863", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702432497, "uuid": "6c34663c-8aea-4d47-b769-cbb14b9a9f6c", "comment": "Malware payload (Smoke Loader)", "value": "14860af36dcc6a8652fca1211602db3d6131b8ab60d30f486ce302e86978e939fbe1e4c668c479f0a4596681368e3820", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702432497, "uuid": "b7c4100a-ea46-4de3-a4ad-4cf571678e98", "value": "T11744D743D2A27D4DEA268B729E2FC6EC761EF6518E4A37693118EE7F04B1076C163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702432497, "uuid": "03ed1615-6fa3-4fcd-ac27-edcb6b04f9db", "value": "f1edd1c9959f43c2a893876cb1c37136", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702432497, "uuid": "84877d53-bc15-4273-8453-d71e9c393798", "value": "3072:iZDH6ynB25042kcb+FwCFZ7o47t8FAHaU5WDWVdLv9s9mVVyTu:mDH6ynB007b+FwuSAkkRVOm+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702432497, "uuid": "2f1d463e-bb05-4e9a-9125-6239921d8c96", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702432497, "uuid": "ce146e2c-8ecf-4a09-b3e3-a0e7d234745e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702432497, "uuid": "1e2f9aff-40f0-44aa-8c10-91c16328aaac", "value": "0be90dc3245c6e5a4ddb14c9cd1b6520", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49bf20f1-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480888, "uuid": "0621355b-a1f4-4d62-b6b2-6e622d9a7070", "comment": "Malware payload", "value": "02c5dc235a3815ae32649ec6dec8b63d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480888, "uuid": "a5baf0d2-3c67-41ee-9d5e-fba8b3674458", "comment": "Malware payload", "value": "2b79b44b0f533dabe4d08cc0aed9139017ecf2571597ec816bdffbe8aea59107", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480888, "uuid": "ab30ac78-2f45-49bb-9b8f-070216b6d332", "comment": "Malware payload", "value": "3a4ed8e57d02c8312147b13b6153ec50dc0258a8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480888, "uuid": "037b76e8-80db-4982-a122-947d547ae24c", "comment": "Malware payload", "value": "29ad3161c8248407647fdbfcd0608ea9cab49f9a8a628c703110d671b0a7b13fa4334b0e068aafee3e6bfb49fbe5aa24", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480888, "uuid": "740575df-7f46-4c75-a685-c66572475f47", "value": "T18844391A3DF4E873C00B4A318CB766BCB661B8614D428F4B26D6D71DEC3A1916E22D77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480888, "uuid": "bfc2c2c1-3e2f-4a62-8dc2-900acd8c71a3", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480888, "uuid": "9936f288-6467-4a81-bbe0-7941d4f86e53", "value": "3072:0HDp7pRuKjsir5HZFQGrsUwF7hplPoutjgVp25skQ4qu/m1qocmjHwJ0fQh8cP:+RR5rhZFQGrsUwF7vlPoSM0Ou8JcUQ9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480888, "uuid": "dd9bce7d-eb37-43f7-bf98-cb4cedae6473", "value": 275379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480888, "uuid": "410fed75-0b7f-467f-be22-3b4e552e7308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480888, "uuid": "b448b225-6fb5-43fa-9ef9-ae675a3641b8", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.19553.21244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d992225-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480868, "uuid": "7be26846-f510-47ac-a349-86dc8f0f2ac5", "comment": "Malware payload", "value": "2dee40584002216694f03ede5db75601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480868, "uuid": "11fb3085-1e98-4c33-9ae0-e80d81ff5b33", "comment": "Malware payload", "value": "2d49082e491f3467f9eb76bdb078a6069514e54100a194822e07e4a8f1dd4e85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480868, "uuid": "90c8b772-e202-4e4d-9bfd-5a6b3d7dfb50", "comment": "Malware payload", "value": "3565c024a35ab07a259d7ab6bb2d07a954657258", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480868, "uuid": "ea67a324-044d-47e2-aed8-471b04d6ef72", "comment": "Malware payload", "value": "4ad188546fb8a619c33511581520306f16cdab1a138a14926727eafb297189bdd96daf9cc45cbcd561f63df69f7024cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480868, "uuid": "b79b4e4b-7a18-4112-a776-43eae406b14b", "value": "T1D0E4AF06F9F294F6C21516B0096A6776AE7ADF460B10CFC39395EE9F5C331809E37226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480868, "uuid": "99773721-bb0b-4ec5-a0df-057712effd43", "value": "0cbb5e766e0c553aa9cb06a3e0c9c680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480868, "uuid": "25d30a03-db4b-4cdf-9b47-b0739ad6c725", "value": "6144:4mLqiF5FJM/hMyfOiMksZMSCrNIY3UPw0WmJEY7qcD17HonFyTA6ClGa9/Hu1lss:4kZBMKyYDZMSCxIzWEThHoFZ6ylOLr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480868, "uuid": "42f6b384-6c5e-430f-8fe1-c2ef01e8dc09", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480868, "uuid": "65277b5c-e5de-4f02-8bec-4749550cefc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480868, "uuid": "f7517616-5390-4965-aefc-4ddcd2c27898", "value": "SecuriteInfo.com.FileRepPup.13851.206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d005473-99b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702469834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469834, "uuid": "9eab14ea-b11e-4b2d-867d-0498101ee295", "comment": "Malware payload (RedLineStealer)", "value": "71982a443454814e3f8296ab5837a682", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469834, "uuid": "e667ba1c-9dfc-44c4-aa2d-ab6585eccce1", "comment": "Malware payload (RedLineStealer)", "value": "2e5481ecade50afe4b022859750ca581ef9e9819b78a670ae9cc98665efaca0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469834, "uuid": "5f5b2e47-74c4-4327-aad4-140639a81948", "comment": "Malware payload (RedLineStealer)", "value": "2898edf566d1a90b0454f1dade9b65067b611ce8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469834, "uuid": "656d3092-3181-4d1d-966f-3db642d7112b", "comment": "Malware payload (RedLineStealer)", "value": "e7293f4c6af458b6e15763f76236e87003fc358cf09ece5efb9d813e9d69710e3c2bfe732725da07d79fdf616ad636fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469834, "uuid": "eb7170ce-584f-4dcf-a6d9-3ccc3eba96aa", "value": "T154A47C13F6D488B2DDA1873586505723982F6CD0A319819BB7E5EF9EEE701C08E39C5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469834, "uuid": "c7d427cc-e25a-4acd-b4ae-b042db67cf35", "value": "5126f161c901e3ab94a05a58465b8645", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469834, "uuid": "dcfdd966-4318-45e5-a678-aa44edf735ad", "value": "6144:a0vBcCFdklWvZMJvez81T7vkAOF2VMEyYPEUUvLB+gtYKwz4yH0Txv:a0v2CbklWvwVkz2EVLLtYzb0Txv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469834, "uuid": "e27bebf8-0404-46f5-9484-5d09230b137f", "value": 452896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469834, "uuid": "b3b6dd58-9243-41f2-8e3b-ea1258c409a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469834, "uuid": "6e630562-5f04-4d24-93f6-0173ba1dc842", "value": "71982a443454814e3f8296ab5837a682.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27da6225-9a05-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702505742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702505742, "uuid": "bab79798-49a5-4058-b3ca-5a18d8a6c893", "comment": "Malware payload", "value": "1e4c3369deb42f0f7593b2cbf1c8cc98", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702505742, "uuid": "50e3222e-7799-43df-b426-ae724cfd1b93", "comment": "Malware payload", "value": "3026b7cd77a6b6b93f8adf246282ac0640a8756bde9838582cfd26c671f4425c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702505742, "uuid": "5c8f426d-7d0e-444a-a47a-1a3f7edbac1d", "comment": "Malware payload", "value": "73a18f0ddc4e5748cba049fb68027e516cf8b020", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702505742, "uuid": "68f96bcb-eb85-4683-964c-c8566913e7a8", "comment": "Malware payload", "value": "bbe50908591697865de80d0c77f14bc6d7121a2252e435a67a42d1a31ff261c506cad046c016ab3c79164dd53e2c6137", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702505742, "uuid": "8e26e4d5-0410-408c-9ac8-524e681d5466", "value": "T11203F161753D2B72E2E077B82D72A5CC901763326AAA633FC010D29D9B5B982D0702DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702505742, "uuid": "e4e897df-bb75-4f01-bf38-454a3350d508", "value": "768:zGvnDoZ2Gw5NlQd4CbBbdNFdXvKp5l7QQtaVgCbDbXZ9ozYQ7XRO:zK8My4CNpdipvDtay4bujRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702505742, "uuid": "c7e5d58b-35fc-4d7e-a17b-58d07c03181f", "value": 40552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702505742, "uuid": "28dacc14-30c7-4a44-a7fa-bdc8f30b382b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702505742, "uuid": "74591735-0494-48df-818f-3d27c64a73cc", "value": "crond.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fefc40da-99a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1702464872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464872, "uuid": "21e0e3e6-18ab-42c4-9f4a-234361e27854", "comment": "Malware payload (DCRat)", "value": "e4c7371b1f4eaa0149bf407f93b3310b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464872, "uuid": "b358bd8e-e3f5-4482-89af-65643aad0b3b", "comment": "Malware payload (DCRat)", "value": "3250f8266f9bb3418ed5559551e9c7e3503312a44c314ac409f873f7e3c100ac", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464872, "uuid": "277e8d52-5710-4765-9315-ed436e20c596", "comment": "Malware payload (DCRat)", "value": "6e3318db381c44d4a8c4022e44b9ed8f56ea998c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464872, "uuid": "a23b5a9b-fdab-46bf-9ce8-ddc1dbc6a943", "comment": "Malware payload (DCRat)", "value": "460814bfef3ed0d4f79b50d88a61679c031595b6f0a8d1c3753e85c0b7e26f5e3043da1f624f162719467244ca9dc85a", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464872, "uuid": "5f9829ba-fa31-4b67-959e-ee5a38174e71", "value": "T156068DB3B68971CBD4A215759523CC42AE6F03AE5B2156C3A839B07F7D32CC4197EE24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464872, "uuid": "d0b08232-1bda-4e32-a277-9644cda35f91", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464872, "uuid": "23a7fc2f-b392-47aa-b84d-2fcd2ed6e8d3", "value": "98304:yxoQU8cLbTqaXSbfO3RECsmDzOgEZq7soqbPGd1S:yiQIzOgEZqe+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464872, "uuid": "ab95a3ee-161b-4337-8887-6a361af18f15", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464872, "uuid": "f36366db-fc0e-4894-9c29-64323c9ffa6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464872, "uuid": "7ac36dd5-d80b-4936-9984-3e30addcc944", "value": "e4c7371b1f4eaa0149bf407f93b3310b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce495ad8-9975-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702444174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702444174, "uuid": "910bfea2-fec6-48dc-9619-78acc5617b26", "comment": "Malware payload (Mirai)", "value": "d8dcff282cdb89347bb4d7b29e1db8ff", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702444174, "uuid": "cd5a4fef-b578-4f12-b5c9-83d1c46e1b87", "comment": "Malware payload (Mirai)", "value": "32b050d97fde12ed5ff1705ddd79922538b6786f5d5cfa7939c769ebf8d9ec9d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702444174, "uuid": "293722f4-40b4-4a76-b520-aea1483f988c", "comment": "Malware payload (Mirai)", "value": "ceb14931b914264dfe45ae9c79dcf6884b83a209", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702444174, "uuid": "1401b09c-ba7d-44cd-b3bc-1d5c401835d0", "comment": "Malware payload (Mirai)", "value": "edd4718330576c3a816eded2474232f4a1d7a069346e1cbc659603509bdf24c67c1e87fa95252a5c189a9238623bf0c2", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702444174, "uuid": "6a6d4d04-b9ed-4620-98c7-f3c24848da5a", "value": "T102535AC0A683D8F5EC5212716537E7338B72F47A4129EA83C7E9D937BC92910E65728C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702444174, "uuid": "173bccf6-c111-4ed8-9d7f-4a4d9484423f", "value": "1536:u3BINhl3ldUiL9G74LaMg/qpxh9WrJgaSqrl:u3G7l3ld3lGMOqVQlgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702444174, "uuid": "42de350a-7ab0-48f0-ad0d-e5a98b7155d7", "value": 62572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702444174, "uuid": "e7b7a36c-16ef-4f9e-b786-36e104d39e0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702444174, "uuid": "73b07377-8d04-4087-8f60-b608b6bceb1f", "value": "x86-20231213-0509", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3080251-99c2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702477253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702477253, "uuid": "9e002b46-ffcf-42a8-82f8-3f68b72a2c7b", "comment": "Malware payload (AgentTesla)", "value": "bcb4352a53d4641c9f79043596d387b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702477253, "uuid": "cc4e8b8d-79f1-428a-bc39-fc6622b7277b", "comment": "Malware payload (AgentTesla)", "value": "338296c4afcdc67873712c300d6977a7e442437b05968c32c90909d623d1e1f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702477253, "uuid": "60bcd9f8-3414-4d66-a78c-3d72a1a6c28c", "comment": "Malware payload (AgentTesla)", "value": "556cc660c68f52c423cd33475a65167864abe118", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702477253, "uuid": "b2cf177d-33c7-48b7-8634-338627e3cd55", "comment": "Malware payload (AgentTesla)", "value": "f3b37329b482583cf1b0364d867416d765336405d00bf0744abbd4b920b2dc5e4d611462c93d6edc24475019aef15f1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702477253, "uuid": "6b68a609-7230-4929-9124-f73a8e0ee194", "value": "T10BE423013B988763C32E53383CB3472143398A97BA95E71F3DDA84E9E5D3B451262B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702477253, "uuid": "f69fec2c-4f6e-4d6b-be02-1c02d9c32628", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702477253, "uuid": "3225b855-5f8a-48c5-b3ee-a3d6d6dfbbda", "value": "12288:1EfnIPGy+YYUBYqFrEqH6+DI1egAnyZpzW8ysZ2pfKK/3ySPS49Nk:YtYnCqFrVHNI1egAnyZpzpqv/3JP99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702477253, "uuid": "eee0a7c0-c841-4ba2-9a9d-f93e9db1de31", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702477253, "uuid": "0b9a240e-15dd-4f84-8050-35e777f341ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702477253, "uuid": "e259145c-dd0d-4f78-82ed-5bbb23d758c1", "value": "Purchase Enquiry-Y97STVZCPZC12AQ-03315904351-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f317f1-997e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702448086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702448086, "uuid": "c1445de2-d76f-4eb8-aff0-5f06d2ad2633", "comment": "Malware payload (AgentTesla)", "value": "f6953ef972f68aa5ddf83fb22694885d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702448086, "uuid": "a84e8dbf-17b8-4e05-96f2-8a8fad8533f1", "comment": "Malware payload (AgentTesla)", "value": "355dd2c151a8acc04968060f9a92ddfe6d35839b63cae0a5e4f275ed7b5af945", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702448086, "uuid": "3ba5536e-2316-4592-b44d-a885d16b87da", "comment": "Malware payload (AgentTesla)", "value": "ef1c44e51d2e11c27b09f5b86ad1cc296b3391a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702448086, "uuid": "ebfe7999-d23d-47ff-8b43-e080d5091094", "comment": "Malware payload (AgentTesla)", "value": "e9f0d49d4eb18862abc9013c751831167cec8c95e142cf2c2467ffcea742db2fa24c2e6e9596f7837a3664fec6af079f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702448086, "uuid": "5a191c56-3b11-436c-a23a-7a2848a39f74", "value": "T14D15C33D19F92227F175C7A6DFE0C527B260A5EBB156AC24D8D243960307A0B79C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702448086, "uuid": "aa8bfef3-e37c-46bd-8b1d-f7e4e60f2ed8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702448086, "uuid": "acf35bfb-01bd-4785-ab25-02dfa71fddf0", "value": "12288:VyVt2vuIQIeyxVfgArI7C2uQ1qEyIFPRj74tXg/i9Duk2y377rQwJXP:VIt2vuI1jzgJYmfy0xqXg69S23nkwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702448086, "uuid": "67c78c02-2585-42ae-b9d7-5ac071ff3a3f", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702448086, "uuid": "76a533e9-7998-46a5-9983-6b0c6993682f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702448086, "uuid": "d2498a0b-0caf-4df9-8be2-8af76ec4eacf", "value": "SecuriteInfo.com.Trojan.Inject4.59820.12270.7710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3e8b0b-9975-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702444172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702444172, "uuid": "b7996542-3e30-4d63-9097-4f307b7c5b8d", "comment": "Malware payload (Mirai)", "value": "b2b58a35494189acc95147ba119fadf1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702444172, "uuid": "6f2edbc7-8350-481e-a2bd-d819695a2c1f", "comment": "Malware payload (Mirai)", "value": "360df10b5844624d4c70d4c1dfd4c7f235deb2dc5fe67d8bd4e93f8d17dc6fc0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702444172, "uuid": "80b86fcb-c105-44fe-92df-214c3b296076", "comment": "Malware payload (Mirai)", "value": "7cf6bd7e56758074b424228145cb39bc06f8d318", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702444172, "uuid": "aaef5245-8b55-4c50-836c-c21024f958eb", "comment": "Malware payload (Mirai)", "value": "3245af3577064a0c74298bafddeb2b64f0992f5a5f00f1816aee7fb7c7b48772765528a9690270c1afce0c5d028f80fc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702444172, "uuid": "187aa910-6509-411c-baa1-8570af7709e1", "value": "T1F7E32C56EA408B13C4D61776BAAF42453323AB64D3DB73059928BFB43F8779E0E23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702444172, "uuid": "7e6a080b-04d8-48aa-b177-fa329055ea0e", "value": "3072:G0HHi7gdWqCVa8y1fgSFBzlKaVZQaDNejk5M/9OM0V:G0HIOTua8y1fgStK/WNej6M/9dY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702444172, "uuid": "eb8a4c17-91d3-451b-a948-34836083b5cd", "value": 152885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702444172, "uuid": "f584919f-aadb-465d-b2e6-4a4b8d98e5b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702444172, "uuid": "07838807-bc5a-4268-ab07-a3da6afeb762", "value": "arm7-20231213-0509", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b071f30e-99b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702470753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470753, "uuid": "c3c9626d-3e6c-426f-ba2a-5f358bc3c13e", "comment": "Malware payload (Formbook)", "value": "53532a3ce7ecdd7d9f683119e97ca071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470753, "uuid": "daff6cc6-6b99-44aa-aec0-bf83ff0d4db2", "comment": "Malware payload (Formbook)", "value": "3669763315f84b7a290c35dac2ede474e2f66915f0d3ddafb901f5bf38640d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470753, "uuid": "f179cd08-290e-4b0b-a7c9-1634674bcabe", "comment": "Malware payload (Formbook)", "value": "5fbc52d53468cff1283232c94fbc779966e22144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470753, "uuid": "714e97d3-9d88-47b1-95c4-fe96847b74c3", "comment": "Malware payload (Formbook)", "value": "c7242c03c37cf657971b1c811ca5a6b0e00c539af0ba177ae3564cf4cddcac02cb7f5de375a3a4525faa5eddc5a1e04f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470753, "uuid": "32a711e8-9e75-4d71-839a-a84bc57cbea9", "value": "T190E4238876A5C3A3C1F63BB91C22C17653B4D2624546E71D2C43A4E85CF7B881AB1FDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470753, "uuid": "bbee87da-9e28-4062-a003-61cfd6fd5776", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470753, "uuid": "2a088eef-f553-4ede-9c82-e2cf04a4ac36", "value": "12288:dEfLInGy+YYUBYzmjEZ2Yd30MLPnjSg97IQaQRjRcfvrUZWfgZRVHZS0C:M5YnCzOEMYd3RL/mJQaQRVcfgsfgZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470753, "uuid": "95f59761-bd9c-4461-b257-4ec22641f54b", "value": 684544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470753, "uuid": "8bac4a0f-3a95-4f83-bdf0-ad90e6a1a7a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470753, "uuid": "8cac04a6-3cdb-4786-a4d7-ed3cfe62b812", "value": "SecuriteInfo.com.Win32.PWSX-gen.26085.6151", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eadf56d-99fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702502291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502291, "uuid": "333ca41a-d48d-47f0-9914-274c07d66c61", "comment": "Malware payload", "value": "991fd7f47b898fc144bad463347c1485", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502291, "uuid": "2e86bc3d-9bf0-48e7-a6f8-e2e699542009", "comment": "Malware payload", "value": "37421c02eb585050589bb0eeb18668d9f6640477f2af15d36e9ca29975b96100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502291, "uuid": "effb409a-162a-46be-8ed6-4606bbe1658b", "comment": "Malware payload", "value": "bffe128a12ade2c7cce2ca5f81941ac2eea9fe54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502291, "uuid": "ee2d070d-e8e0-4c9c-9f4f-35c257bb466c", "comment": "Malware payload", "value": "e65d30824cdec2aef1a42992bf28c181c7e155d54bd89ba28b463e29ed02ad4578d4f4aaa507bc065d6077cd854940d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502291, "uuid": "bf811946-72d5-4b1a-88b1-7775c135fb28", "value": "T1358423966610C863D445CFB2153EB2ABE7BA9A60B05DA60757009F8C3FB7790890EF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502291, "uuid": "cbe7073d-6007-43e8-91b4-308ad2a19435", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502291, "uuid": "dc639f72-4f4e-4ae6-b0b3-4ca77ae5529f", "value": "6144:wR+xXmb87zbD7NtFeHKG8DltLtMZ+ZnjRXhrmQ2aW93g9y5G3qg3xegE5:YZA7Xn9eLS/LGZSndsTae3K8Oqgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702502291, "uuid": "1eae73c7-42e2-4d30-bb61-d6f66bc5abb1", "value": 396944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702502291, "uuid": "7b78d6df-665d-44c8-9de9-ad23754a2f42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502291, "uuid": "836f8024-38f8-49f2-a37c-1df26ea6a851", "value": "SecuriteInfo.com.Win32.Evo-gen.29997.1899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1434025d-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702470920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470920, "uuid": "ae7d41c4-3567-4cf1-8c89-4dc756f0e032", "comment": "Malware payload", "value": "a213aa183eb3b0a18b042b197ab86d09", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470920, "uuid": "6e8d580a-89c3-4513-846d-1d5203772088", "comment": "Malware payload", "value": "3792408618099db73b654704b12c9520d3267c37e50bf9718c2877ec2e65133f", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470920, "uuid": "c1ad43b8-3ddf-452c-a4ce-23553bc85e49", "comment": "Malware payload", "value": "bd436b7b38d939c41f88332266e8828374297a70", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470920, "uuid": "4446a08b-db71-48ac-852b-26ba165a7d9d", "comment": "Malware payload", "value": "2391803aec32e1c5eb86dd8bf4f82ff2ce00b88913be4362bd0b336eb3834bf46785a97a039e34914d85e286be907230", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470920, "uuid": "b5e6cb85-b4be-42b2-a556-e40596021a5e", "value": "T142C3C555B681C61BCAA80B314C9BD7F53379BC01AF8B83173245B33E2E76F449A06796", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470920, "uuid": "d9e1ad5e-10ee-45ca-acdb-f1b70b755347", "value": "3072:JCZ+RwPONXoRjDhIcp0fDlaGGx+cLYWxbZZD6tu4vsu:wZ+RwPONXoRjDhIcp0fDlavx+WYWxt9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470920, "uuid": "25f6ae10-b9b6-47a7-86cb-009a355807eb", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470920, "uuid": "a47543b0-53c2-4d2f-8ca9-8b6d009d9e7a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470920, "uuid": "a86dc2b0-0624-48db-9ee8-0a1a6873f5ad", "value": "Persian Function For EXCEL_V2_1.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78912565-99ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1702467653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467653, "uuid": "0b2ba4f4-168b-4ea2-a9f2-dd1c1cf40356", "comment": "Malware payload (zgRAT)", "value": "f43626e472d5087cf56d2e4ee952a2c5", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467653, "uuid": "fcb58316-1240-4791-83c3-1482db5d1ccf", "comment": "Malware payload (zgRAT)", "value": "37f0739db446c13ad3829314232f9e4d1339ebcb3e46823e1593cc942c2cb4fb", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467653, "uuid": "4322671a-f061-45fa-9f46-9b6326beb425", "comment": "Malware payload (zgRAT)", "value": "3178681070aae73be0237962c095311a4695927b", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467653, "uuid": "ad056364-d09a-44a8-917b-a82ccc584d25", "comment": "Malware payload (zgRAT)", "value": "f6f664aca27c3ccb3c2c6e2a201e9b1dcf88cf3202481ac1787d31dbda467991d35359f5d4d9799b571df343bf45c203", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467653, "uuid": "587344b7-d741-43b8-94d8-d67c54a1959f", "value": "T10E15D07522130E29CB656334A973EB010951FD7694B69307F3C9727E626B1AF2FA2703", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467653, "uuid": "830a95fe-d009-4a39-b0a9-71fa04fb4e5b", "value": "12288:rgiWLAS8RJY+EWR5uOpBzbWFRXXttGwt9XjYhRfsk24bNC57Ja6E5J0:oUJY+EWR1B2F17vTXjDApjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702467653, "uuid": "195872ec-ad63-4da5-ae08-65b96b26a836", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702467653, "uuid": "cc426ead-f286-4f04-932e-3d74aa797527", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467653, "uuid": "8e6adad4-0ad5-4ee7-9843-1f1de189a198", "value": "rAttended(1).img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccc9d4a-99b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702472492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472492, "uuid": "20464f7f-8ef5-477f-90c3-9098a82fabcb", "comment": "Malware payload (AgentTesla)", "value": "0f50db5e574357bae8ebcdbfbac574d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472492, "uuid": "8bb6e22f-ea3d-4b18-94e0-67fa99df7dfc", "comment": "Malware payload (AgentTesla)", "value": "39091a34d4907869f77d2a49695486151327daa7a290a964126a722f022d0159", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472492, "uuid": "9b4e1831-ecad-4235-b9f7-a8a5a155a4a7", "comment": "Malware payload (AgentTesla)", "value": "8ca8f8daa276ebbf8ef389757eeb15e67077c135", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472492, "uuid": "2b1b6df6-3833-4279-9e54-23d0b07354a2", "comment": "Malware payload (AgentTesla)", "value": "520ae85a91d2c28a3247029acfd9b90fefbce3df3cc2c2739cdd5c62881a8c6f88d98c01757350b5f8b16cdfb0fc90aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472492, "uuid": "ba3ffb66-ab4f-408f-9cba-0495f52ff43a", "value": "T104E42200332A462FEC761FB29992101153717F2A94A7F3CD7C9171DE2AAAB711E912F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472492, "uuid": "a82f75c9-b817-4962-b5da-d4a35ac801bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472492, "uuid": "60b327c6-b7e5-42aa-a17b-cce79253dea3", "value": "12288:koV+4WpAE8y7asGI4IbiBwyBkDSb9fZ4oR6koLGcUEGgeCp52pn21xx+:apAEdxLbWxBkGbVZ4oRobU2ek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702472492, "uuid": "8c9d8be9-8060-4aa0-97fa-7cfe583940f7", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702472492, "uuid": "0ff0fdcc-7429-4b98-b3f7-5ae9a1dd6eb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472492, "uuid": "7d9f3580-7a9b-4fec-aa99-bd7672dc4de9", "value": "0f50db5e574357bae8ebcdbfbac574d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813ce20c-999d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1702461225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461225, "uuid": "bf18a076-e3b9-45d7-8cf4-e3e17024804c", "comment": "Malware payload (Gafgyt)", "value": "3b7d4f8a55e9e96260890dd150bd33de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461225, "uuid": "3ab08966-a332-443a-a2d8-3967a22dcecc", "comment": "Malware payload (Gafgyt)", "value": "392d81daa89dfaad4197b329517f0ffb658b9a42f9caecfc37b3b5dbf648b7bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461225, "uuid": "3d468cdc-e900-4b24-958a-3065994b09fa", "comment": "Malware payload (Gafgyt)", "value": "8ceb7c6a8d2365c02f90fda90c96aad304a5cda9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461225, "uuid": "aa56fa32-85b9-4a6e-a9b8-1588b74c54bf", "comment": "Malware payload (Gafgyt)", "value": "8eadcc89b0c44b4ff0e7af3f77057a39ae94850139d49751d3841d85c7feec73df003c2065c0baf4b2c98878459247a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461225, "uuid": "51238eba-8ae5-4430-bf9a-f38e2e2ed363", "value": "T135A30896F800DF77F40AE67604D34B25B670BBE14E532622731739A6AE762D43823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461225, "uuid": "77a82d06-321d-4572-b70b-9ffc666b8a32", "value": "3072:pNerWBIvC/IymEdH8ffNBOKmuxVqDr78fz1e:pNerWBIrym+89BOKmuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702461225, "uuid": "34302b1f-01bf-4e8a-ba72-2430813b25b3", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702461225, "uuid": "312d9b9d-d5dc-413e-b5ad-ef31a1e3d950", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461225, "uuid": "84609107-5c26-4223-b5d6-e4143304584e", "value": "3b7d4f8a55e9e96260890dd150bd33de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d872bf5c-996e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702441185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441185, "uuid": "1c236d77-f71c-44fd-8244-34998025e023", "comment": "Malware payload (AgentTesla)", "value": "a04865955d96e4b5b7d0d4105fc7424f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441185, "uuid": "6d3f7394-df87-427c-8176-0a0eb40f7289", "comment": "Malware payload (AgentTesla)", "value": "392fd8412e2fb96a3a9c54cd0aa32cf6c3bea21432e1ee46690412580055c214", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441185, "uuid": "a5f67f77-4dcb-4413-8be2-2c9ba21227ef", "comment": "Malware payload (AgentTesla)", "value": "f7c4f4164659d7196d540708c071b5a5657d1afa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441185, "uuid": "d8281615-5e83-45df-ab2f-799161c2cf70", "comment": "Malware payload (AgentTesla)", "value": "0f44f41cd6ad3a43d5cecbef60625e3ee92ff9db4145378d889832b6e7f700b893e49f1fa25b727edb475dae8ef83823", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441185, "uuid": "56c433ca-100e-4cce-8e1c-79901f1aab1b", "value": "T13515B33D19F92227F075C7A6DFE4C527B260A5EBB0629D24D8D243960307A4B79C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441185, "uuid": "db830971-47fd-4e3a-b9e8-6d8575eb20d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441185, "uuid": "617a4468-2b5c-489d-a805-adec75a275e7", "value": "12288:V+ltcuLojtRy1KUfEFxGuRgOJcLmSbXfYkesJ27n:VotcMcAhfERgOJafJ2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702441185, "uuid": "6aec188a-4af9-4f05-8386-0f68b1665114", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702441185, "uuid": "9e8a8567-f300-46fb-8a08-8ab74e5c0e26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441185, "uuid": "b960045f-5bc9-4cd0-a419-eb290c4b0538", "value": "SecuriteInfo.com.Win32.RATX-gen.17832.13683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c555a5ec-99b8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702472935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472935, "uuid": "1a85c866-d973-42a1-bd61-b764fddd3e4d", "comment": "Malware payload (AgentTesla)", "value": "16b4ed44b4c840eb2f4edc8c03356558", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472935, "uuid": "54c8c6af-1ddf-4868-9f3a-4c91e01b5309", "comment": "Malware payload (AgentTesla)", "value": "395394609e2c14a1a56d03db7fae3306a1a57889e89b119e44d207d6d172e21d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472935, "uuid": "20baf8a3-ddb0-4e1c-bf44-9d988e6cbd5a", "comment": "Malware payload (AgentTesla)", "value": "6cbc2bb664d25398f4a3f8ab90d1a9acd435ce3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472935, "uuid": "5822e978-883e-447d-84cc-33247b1bbc8d", "comment": "Malware payload (AgentTesla)", "value": "d564d38486d677984d234061f6a2060414bdbd41f4dd47df6aa7f5b031f3a61a2716cf3f5ec87c379f51b39516f3c6e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472935, "uuid": "a0f13605-4e05-4854-ab29-fde196143c03", "value": "T16DE4238077F58179C275337D78F2502207B9C3B26847D71A2812AAAD06F7F683991BF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472935, "uuid": "904b84c7-dc14-4f51-8d4a-a111bc3b3bdd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472935, "uuid": "a8a1f8aa-964d-4001-b0c4-c898b00b1a65", "value": "12288:kEfaIMGy+YYUBYSruY+NLaFXRrquJtQ+CocTVithvCN73l+/wQnhJm8/ZCyOD:G6YnCSru+rqUtbZchiti30/wQnhJm8/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702472935, "uuid": "7180eae6-b491-4c4b-9575-453052621e50", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702472935, "uuid": "668dabd9-4ad1-48a4-af74-8de8bc4fe922", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472935, "uuid": "d1d448c8-35ef-4f34-881f-c8d2d852fef4", "value": "REMITTAN.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f91a8c-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480849, "uuid": "5d74f70a-eca8-4c9b-914d-d9f3b16f5121", "comment": "Malware payload", "value": "83f78dadf8c363ca7d74baf9e818e8dd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480849, "uuid": "32369d74-9396-4bcf-985b-59ab48e27ab9", "comment": "Malware payload", "value": "3b0fd96950336e30d3586c719ad802d89668276fbc7d7209c8d8bf4e59eb6bea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480849, "uuid": "2e9e16ec-ec55-4b61-8c9e-52bc7fadea10", "comment": "Malware payload", "value": "3ede8634b392d27e0bf8d19c2ce9113d407bf231", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480849, "uuid": "872607ea-4805-42fc-90b1-30f9176ec9e9", "comment": "Malware payload", "value": "a89c7161fabcd830bab1d0e61535f6a967dae2de064d200cb5c562f5f9e636556fa7c560421cac0150875b16fa781834", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480849, "uuid": "a302b811-5276-4880-9ff8-040fcce13848", "value": "T1A105F11DBAF1C85AD10C39305CB7CADDDAE2AC316C4D860F67885E7E2C7A251EC261B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480849, "uuid": "1eda7458-b061-4378-b176-23ad63fa276d", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480849, "uuid": "4ccd0a47-5ec3-41d6-87bb-0761cc0728d9", "value": "12288:+R5nWFpPoSxgiXiMhr14hBb0QwlPImIyGLj5cExVbR7XPTjx8Gd:VboiX914hBilP4yGikVVXnbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480849, "uuid": "a94d70ac-acdd-4c95-80c7-a316d76607ba", "value": 849896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480849, "uuid": "9644f0f5-9580-48dc-904a-e053e6a124f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480849, "uuid": "30441edc-fc1d-4c80-80b4-d387983bd1fc", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.6760.9415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f7f277f-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702471073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471073, "uuid": "ecaf4b52-7234-423a-8216-76b73d987058", "comment": "Malware payload (AgentTesla)", "value": "84386cbdc4f1fbd675d46b159f930891", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471073, "uuid": "cdd31210-3d66-4c8a-b674-eacc71b4425d", "comment": "Malware payload (AgentTesla)", "value": "3bb6978b8ad3c53b2be51697f42c113fb6e58e168258fa58bd6e1985c56dc46d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471073, "uuid": "3d5bf367-f00a-4443-8e88-3be894f011f9", "comment": "Malware payload (AgentTesla)", "value": "be8f1efd7fb5681a1290ff3a98a469b7e07c012f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471073, "uuid": "68f91c52-ff61-4623-8f7c-2faaff570f91", "comment": "Malware payload (AgentTesla)", "value": "94c610a38445303eabed8ce74d632fb491584aedff31216d59a7162ac1798d801d3d5d6ae3eea153cd33f85094bbd388", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471073, "uuid": "4c348a42-e3c2-487a-8e7a-f76c761228c9", "value": "T18015B13D18F92227F175C6A6DFD0C527B261A5EBB1629924DCD243D64307A0BB9C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471073, "uuid": "6de13fb0-6bba-4311-b28b-4e2aba4650a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471073, "uuid": "3713d90b-050a-4f54-b69b-ab44ab2e87e8", "value": "12288:2fuiNsSheqMWUwaQxynwRIO27clq3Pd8l/J+7iMOJvdF:CXNbheq/7aQxQwOOGPKlR+7lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471073, "uuid": "c1f5bdab-0792-4308-9c69-de39ed5718f0", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471073, "uuid": "ed192c36-1141-4250-ae39-1cbf909ec271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471073, "uuid": "1ad90177-8e1f-4d77-9626-eaf8bc621bb3", "value": "FedEx_AWB# 860123507167.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc5595c-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480920, "uuid": "43082348-b6f6-425a-8e17-a94f5dc75120", "comment": "Malware payload", "value": "55659993517cee9e3cff1f4c04fe87d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480920, "uuid": "3c0b7893-f997-4b15-8a40-5619ee968b50", "comment": "Malware payload", "value": "3bd0f49f15566191431810322475c4e89d37f5339f381cc1aa2156f29eb752b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480920, "uuid": "5d00a626-4e9c-479a-8fb6-567bb1398b75", "comment": "Malware payload", "value": "f6f53fe26b6ff125f55996e7d52be9a4b69e941a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480920, "uuid": "eb743b0d-0483-4728-8395-f4d501b02595", "comment": "Malware payload", "value": "f1005b56cbdb4cfb5611164378b954420984bbefecb87648ecdc6b86bcbc0562cd3a41b340b6f4717ffa3e93f1479fcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480920, "uuid": "d68995a5-73d7-487c-944e-ba9a4d4c206b", "value": "T1CEC502A1D544D2B7F1AA68B1C02741FED62A1DE1D03DF96752F37F4238301E8B53A98A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480920, "uuid": "f07472ee-a959-4646-abbd-cf5b0f9ee843", "value": "cf35744615270a4de80735b46c317737", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480920, "uuid": "5987e68a-cd20-4f51-9594-1505e1c34102", "value": "49152:OI7ETlHLywYF+gb4Sfw9IqcJPUFjS8R+u3D7Gf9lg3jKuCCQ/qsT1Q:OWETlrywYUgQeJPUFjvzKFlg3jZm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480920, "uuid": "58b34dad-67cc-4bce-941b-75fdf8b307ae", "value": 2546688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480920, "uuid": "606a2827-b15e-4afe-aa6b-89045b7932e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480920, "uuid": "98238137-7a73-4fbb-9dc1-1f442af99301", "value": "SecuriteInfo.com.Variant.Babar.204682.1576.17224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa23d3b-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480890, "uuid": "d74ffeca-13ba-4c05-bc82-6921256ee5a2", "comment": "Malware payload", "value": "6c400af17e29363c8d4a9f2812ba0ba0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480890, "uuid": "9ffaac64-af7b-4545-8fff-6d409502e873", "comment": "Malware payload", "value": "3bfd635c9fc712fcf13572b5da879bedae56c788b67d3b54106596dbfc8574e8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480890, "uuid": "22c32d6c-5121-4d61-a227-60ae91c1bac5", "comment": "Malware payload", "value": "001e3a3f5574ff60e9510e02ddd038426191201f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480890, "uuid": "86081742-fb1e-4129-8122-322009cc2fca", "comment": "Malware payload", "value": "d805ec226d8e7a4317db163d9c4288d7e4196a7d2d54b1f0d4f658672b99b20ab245060edf7354a0d08509bf3852fc1b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480890, "uuid": "3a8f96b7-fe13-47e1-9e57-a0719b3b3990", "value": "T112D5E097B7528A27F4278A308897D7B99626EC215E56510B33D83F8F3D332F0E94345A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480890, "uuid": "9e63cf53-8fbb-408e-9ab4-fb20cbc72531", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480890, "uuid": "c4219229-05d5-4c30-b211-8a442d685aa6", "value": "49152:VXw9qh8lQyGiGV4eBKI0e+s8KuqGaX0ToIBAUZLYADGhG0yWlvkP:xw99nGRTBKIgJBAUZLaG0yWlvkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480890, "uuid": "266796f7-d923-40f7-bd2f-0f4fd9c24f27", "value": 2996966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480890, "uuid": "fc51d828-53b5-408c-8e92-0f0b5d0ec9ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480890, "uuid": "ac394894-e1bd-4b0b-b62f-2af40ca527a1", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.9007.7579", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a147b4af-9961-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702435509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435509, "uuid": "f64abeca-de0c-4dce-928d-f3c558888b42", "comment": "Malware payload (Mirai)", "value": "784afaa77fd6553e7917a6b0cdea5dd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435509, "uuid": "248765b1-3d50-4287-8111-8dfb6295c0a0", "comment": "Malware payload (Mirai)", "value": "3c53ed46244cd6188f4849a192678fd9be97cbc4e01eaa7c505f59a2e05426cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435509, "uuid": "4117bb53-4dbb-4c05-9735-4f6aeade7e75", "comment": "Malware payload (Mirai)", "value": "908899bbdac57fa51bcbf027f9683be98437a488", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435509, "uuid": "a95933e3-2f0f-46ab-bd17-16d8b4377bfb", "comment": "Malware payload (Mirai)", "value": "fde94dbb16e6ad484ed74bfc4a6b23fb1c1473737c7bc6de2528e02e6eb8a41bc6eb187db434c59095e39847c2e13d24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435509, "uuid": "aa82cce1-78b6-490f-8664-fd1b74831937", "value": "T106133986BCD2996ACAD01776B62E108E3321B3E9C1CF3217CD245F1177C9A2F0D27A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435509, "uuid": "0a416e20-f77f-4032-84a5-7e74d51eaa8b", "value": "768:j0JbOmlxjyUcgAd+7WjedfEaIr8V8w5ScFKR0oN5FnNqKOBNVt:mymlxTjokuedfEaTWw5Sa+XFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702435509, "uuid": "debd1e14-2d57-45a7-82d1-0686059b36a2", "value": 44124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702435509, "uuid": "7a1d7fa8-b4e2-4ad6-94a6-9c2ff2657a17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435509, "uuid": "20c9c954-f233-4d96-919a-f29c21da4cea", "value": "784afaa77fd6553e7917a6b0cdea5dd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62b1dea-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702471272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471272, "uuid": "75e4bf93-31d8-4184-9e43-8e791c1d7e64", "comment": "Malware payload (AgentTesla)", "value": "66e4e94eab90ef692a166b128ae92b7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471272, "uuid": "4499bbf7-fcbc-4eef-806b-dffa819d2ea3", "comment": "Malware payload (AgentTesla)", "value": "3cd29cda5e8b98120f102925c3781037b3cbae3609a1128e9566511b9a09e03c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471272, "uuid": "639eee8b-0840-4d7d-88d5-6a5f1ca44d03", "comment": "Malware payload (AgentTesla)", "value": "0994071645db19f0be91d9681312c4c710d2fd40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471272, "uuid": "fb3d03b9-dd8e-422b-9483-ff3358b7174a", "comment": "Malware payload (AgentTesla)", "value": "257bdebc53431e774282a37be2ad239286ba516727a18b385a3cdbd258995f4240d5c02191e7ceb9248016ff7eeef1e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471272, "uuid": "2146165f-a15e-4ac5-a0f9-79d9c832a141", "value": "T10B637D5ADA5BC492DD9A66FC9437AF1A0F939D73542395CB328832225C23397443FA0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471272, "uuid": "611c87d7-5529-4a92-b307-9fb3f1928f9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471272, "uuid": "c162c051-aaff-453c-b36c-46366333d460", "value": "1536:Nc/MEGmfSTbjR/KYGivWuM3CEF/7GmqbMY7usiY9hkK:zX3TB/S7GmCMY7pdkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471272, "uuid": "ae2e1926-0b3b-4329-8bc0-61bfc4f99f51", "value": 68096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471272, "uuid": "c7c3b17d-de49-4e7a-8836-a7121b94e0ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471272, "uuid": "a0ae490c-a450-4126-a24d-fcf9b73b30e5", "value": "factura comercial FOB_approved.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c3e8c4-99b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (WSHRAT)", "timestamp": 1702472188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472188, "uuid": "5df6532a-b670-44a7-a92c-0ec0d83d2117", "comment": "Malware payload (WSHRAT)", "value": "516442412f0c621f39abd64b645f587c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472188, "uuid": "84934f57-aa33-4346-86c3-0ee48f158664", "comment": "Malware payload (WSHRAT)", "value": "3dbe569606e7cb9d93ad9f5bb8135fb9e6faf2d525c365dbc0eb672a45419ff9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472188, "uuid": "a642b12a-66e5-44cc-b5c7-b94e146dc1f9", "comment": "Malware payload (WSHRAT)", "value": "20565fcbcf30ced136c6e6a9c6539a139f610233", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472188, "uuid": "4072a85d-7ec2-44fb-8e8d-0b1c611a2250", "comment": "Malware payload (WSHRAT)", "value": "144221b8c780f3afc2111e7b95c7a400abfbc5ba5d9f49c33d13154cfb95853d19b539f106f33ed29d71029e30de93b2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472188, "uuid": "52a6df45-c49d-403e-8a37-95b517a29abf", "value": "T1F1F182B780F3DA860C08FA947FE4B9911894F1B9CE8E6D6DD0C1C6952314D39F9A8BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472188, "uuid": "469a58cd-7628-4ecc-adc3-91ef0f36e319", "value": "48:MOIWNECVZvY3thH1S4T0O2NiIVEggU3mOOFANEeoTmKaU9Osxi4OcKGE+G:zYCVZ+FTbmVEgg+u9Ny8MXV+G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702472188, "uuid": "87a5443e-a977-4d94-a685-074867c57388", "value": 7991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702472188, "uuid": "c196a129-4e53-4a1e-bdeb-9a3a84d0154d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472188, "uuid": "ab1ebfc4-14c7-489b-8585-e7f0b9432045", "value": "SA___CS_Purchase_Order.xls.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d69c5c6-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480841, "uuid": "82f35ec8-819b-4367-8c52-e0cf0e42c708", "comment": "Malware payload", "value": "1901c6026d6a4a4fd523b30245431c0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480841, "uuid": "1e635669-dcde-4582-991f-f59267b1ec8a", "comment": "Malware payload", "value": "3fc359a11ef4e8f948a1b6848227b0c715b717c5fac39a169e1fde048138f631", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480841, "uuid": "0f1a01f9-69ca-426a-9b7f-7a625c376a22", "comment": "Malware payload", "value": "ff4592191231ce3e834df30e85461648596588b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480841, "uuid": "cff796f0-fed4-4759-a697-a8afdaf5fd53", "comment": "Malware payload", "value": "c0e3001d8a92c3882394f492dfc57526c977d9e55e0a15b84cbede19c214bf4753752951d59c173c14fa560f2a059155", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480841, "uuid": "ddc865ca-4af0-47ee-bed8-261f8981ab4e", "value": "T165469D379E1D5CC9E90124719C5A8FDA2955EC20B4086B9B76C1B96DCCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480841, "uuid": "9806c3e3-c0e9-40a1-9827-f63e3fd46451", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480841, "uuid": "75018314-4bcf-4c83-b7a8-5af913785dec", "value": "98304:GkQNemnpl07gOZ1i5sg3qqhRqT+QODzZOVGwx1XKXtb7I5eQIAl:Glemp27P+5d3qQR3vzZOVGwx1XKXtb7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480841, "uuid": "102300f7-6aca-49e3-b6a7-f8d36a01f8d0", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480841, "uuid": "f71941c7-9267-4ef2-896b-5d5dcebe4c49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480841, "uuid": "8c6b8fef-f4a6-4991-ba62-64f5b27cbd01", "value": "SecuriteInfo.com.Trojan.Crypt.14162.21352", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1afb078-996c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702440314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702440314, "uuid": "95bee2e4-37c6-4a51-859d-4d214f110a82", "comment": "Malware payload (RedLineStealer)", "value": "32f1f43c8163556016ff25921117e12b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702440314, "uuid": "b3d2e233-7c1c-485f-bb2e-4400b68e58f3", "comment": "Malware payload (RedLineStealer)", "value": "3fc4ae7115e0bfa3fc6b75dcff867e7bf9ade9c7f558f31916359d37d001901b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702440314, "uuid": "dc4bcf19-3774-4a75-a4fb-477b01b2ca89", "comment": "Malware payload (RedLineStealer)", "value": "e27f67c0946274479166f453ead293470dc3b4c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702440314, "uuid": "7fc044c0-fd6d-426d-a09e-9cb9259968ce", "comment": "Malware payload (RedLineStealer)", "value": "8f20ccb4dc91b032d20578f7314145340375db7dda6c1d5413dc70a57668e13f0fab85d8cc45b334e0970db9571b3e44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702440314, "uuid": "0cc585a2-50c6-4c86-b078-5d10365524c5", "value": "T16B54AF277341837BDBABD5B504E4C714ADA4FA22529D53CEABC8707F8AF58479B2420C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702440314, "uuid": "d1d56b0c-3842-4e6c-b705-0ba44a1519d1", "value": "0622dc360ffbda00211e6d25779cd2ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702440314, "uuid": "1c3e7f95-63cb-4915-bd76-d5b6f5bb747a", "value": "6144:HTGZ9/WmNVTHSiNXSDxkz+uvfBC9BaIGX:HiZ9DTHSiNXSDxk+uvfAra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702440314, "uuid": "88e85d52-766d-40a0-943b-8ec843069638", "value": 288584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702440314, "uuid": "c354d128-8020-471c-99e9-9cc36d3951f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702440314, "uuid": "53f8ef29-e336-43cb-8d11-b058cec5d6ec", "value": "32f1f43c8163556016ff25921117e12b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd1bd39-99b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1702469915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469915, "uuid": "6425e1fb-636c-4d9c-90c6-4f3304570f11", "comment": "Malware payload (GuLoader)", "value": "5471685d3dce7101f0aaa65864318158", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469915, "uuid": "988346e6-7a86-411e-85bd-a04ec51f94d5", "comment": "Malware payload (GuLoader)", "value": "405c6ef30357c9ef5c53787a35f2c20c3311d835eb2d15f61038005efcd19c3c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469915, "uuid": "1abf4c37-27b4-4565-a3ff-dd7a2474608d", "comment": "Malware payload (GuLoader)", "value": "0854fb6b39a577740f7932a70bc16dec9577a963", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469915, "uuid": "f7a74210-d573-4f6a-8331-5db8802e53da", "comment": "Malware payload (GuLoader)", "value": "6a39cc24a489e96855ec14bd2b62b4aa97ff16b4bf279e3aac40c04b0f0e71e323248664964fc64a3f6339108facce1b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469915, "uuid": "5ba0053c-c098-4b2e-af03-49206f863bc4", "value": "T101D41209F591EE2BDC23A434C8CEF5C6D228BC552F50D70F71C6B75D88B2AB60266B94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469915, "uuid": "0f3f54c7-945e-435f-acb1-6c652d933f12", "value": "12288:EMe0yk/R5zXJz8Jn6pa0zxGHxarWsDplif0gPhwA30uIlM/Q5WqSTDeA:EMeo/R5zXJAJ6paCxGHBsDAphwA30uI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469915, "uuid": "da98b0c3-e18c-4fde-9066-69da161853be", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469915, "uuid": "7d6119ce-7d9e-4541-87bd-9af50b89cf9d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469915, "uuid": "9cb089f2-5865-4d9a-bcf0-e421f43f8a07", "value": "Pepsico LLC RFQ Information.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24af8369-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480826, "uuid": "5b8cd24e-cb71-4da7-ba82-5b955fb3ccad", "comment": "Malware payload", "value": "e79c7aa64af288346401de1d9fa73c6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480826, "uuid": "110af25b-0567-4657-a3e9-ff75dc0a1fbc", "comment": "Malware payload", "value": "41af9814830163e32b77c653edf98c87a3dd005cd8e99a44d1906cb013881e43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480826, "uuid": "5a73e243-f7be-4e88-8dbc-3a8613e04114", "comment": "Malware payload", "value": "650f2078617ef2eb889fb74bff9cd35836861b81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480826, "uuid": "6e57e7d1-597f-45ff-bae9-a8677cea55e7", "comment": "Malware payload", "value": "29ee6abce6085f1cda69540efeb5a146de90bfc15fca0ff627c4702955c13cbaa15b9553ebaf08036dcc8e09301231d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480826, "uuid": "c28a0116-2c8d-4706-b001-0b065f58d8ba", "value": "T1D3358C1732911032D67279358E1B82AD892AFE261D79785A6BF51D0C7E30683FA35FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480826, "uuid": "67ac4c4e-dfd0-4cbb-af94-0ad01049a0dc", "value": "24576:F8vxDupOLaKrl1klTDCEVKSwIm5jV9Ud33nf:F8vGOLaOiLMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480826, "uuid": "a1ff11ca-cd3f-4b7e-a6a5-ab0756b84fbf", "value": 1074176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480826, "uuid": "ed53049a-c49a-4e37-828d-6f63d3be85db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480826, "uuid": "41bd2e44-298f-46d3-b551-4c989c0dbdd2", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.23323.32189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c712fb-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480858, "uuid": "56f5d5c2-45fd-4b02-83ce-ff5498b9a69d", "comment": "Malware payload", "value": "5c29859927fcc3592e3e337074e4f9ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480858, "uuid": "8ab556f2-940c-4c41-922a-ef3654a575fb", "comment": "Malware payload", "value": "4253aa7b1b95e7fd99667e4dbd253b3f92a1cb2bd81a4298c48f7b3fbdeb0545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480858, "uuid": "7d615a98-1b75-4153-893c-5af65fef0b59", "comment": "Malware payload", "value": "bc0485c62257c740c9e50308f4abc66aca552237", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480858, "uuid": "fe50c4b3-89e6-45bc-863f-03b0a1ada937", "comment": "Malware payload", "value": "dd211dde8d0c7de9321f2e36871a08605227ee19b9e75065784ee13c57af2e4d872129646041096a1012aded8f2f56f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480858, "uuid": "8f3874af-80e5-48c3-a8b5-e035e5f22b94", "value": "T1C6569D43F3439826E12D66B59B339BA89E59EF033E34C7C63A343E2C66F56407889157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480858, "uuid": "7c36c274-f589-42b7-b121-e423f88c015f", "value": "49152:fn/WM5Lafk+jVZPTskqHBLeEtVg5TVkhNaCAjYuVZIRx+Rflx89fquO1HqglMUyv:fn/W8afk+pZCrmhkhNI+9cXidJPRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480858, "uuid": "baadcb4d-54de-444b-a945-9b3ca29cb647", "value": 5964288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480858, "uuid": "d27dc47b-629f-44b8-980c-7463ca3b71cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480858, "uuid": "d985abc6-254e-4b4a-a6f7-1e418ce0ee2a", "value": "SecuriteInfo.com.Variant.Fugrafa.267606.27379.21225", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd34933b-99a9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702466506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466506, "uuid": "3e1bbb76-d91e-430a-93a9-4645a077020e", "comment": "Malware payload (RemcosRAT)", "value": "f2233d53840d2ab882ed3e122b5112c0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466506, "uuid": "a679e4df-56dc-4c1d-9ae7-f0cfcbf1d02d", "comment": "Malware payload (RemcosRAT)", "value": "4366a7f58c44dd437546451f75e9ebd8c6d27d8900dcfd13c0f06c49363ac0d4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466506, "uuid": "95901eb1-0030-49c1-8b12-78b8f06a99cf", "comment": "Malware payload (RemcosRAT)", "value": "ea52f4f23bfb4bc82642c213bd0f918ab412c0af", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466506, "uuid": "e04c3192-c4d4-4523-9042-e07993b2bcdf", "comment": "Malware payload (RemcosRAT)", "value": "90c491efe7c06aa46a4a2624fbf84f282c7dcfeeaadc8811b93202195912104cd42b48d280ba0a3dfc4b1eb98b53d18b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466506, "uuid": "70dd1d8c-2d15-4bce-b160-6c567d774643", "value": "T1F635D082E3000A9ADE7157719473AF1A0913FD7F58B1921F53DDB57993332AB0BA2B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466506, "uuid": "9ae491c6-cdcc-419d-8c4c-4210da9b04b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466506, "uuid": "7e21a122-e638-4e3d-bc6f-6cd7ffc4a68d", "value": "12288:MKC0h6awgLTDNEHIDUJ6KbXFhpoT0se54U2hrQABC4rAL+XAiHPWJf6V73Md9F0F:g6MTjWY9uM40L+XXvWMMjm3eCyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702466506, "uuid": "1d79570b-41c5-4be8-8c91-c35877b006c2", "value": 1059328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702466506, "uuid": "64b8bdec-96e1-48d8-80db-e231a44195c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466506, "uuid": "9698d9b6-72b4-44f7-a70f-0abc99a4fd65", "value": "Dhl_shipementdoc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cbe460-998b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1702453532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702453532, "uuid": "dc0e0218-f1e7-4907-9f2e-56f8374c7569", "comment": "Malware payload (DCRat)", "value": "a1f23be105511b40de712ef2bb0599e3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702453532, "uuid": "e710adfc-306e-4e12-b1c2-09f3cedfeddb", "comment": "Malware payload (DCRat)", "value": "4486a731ff8c41d483ba7972b424b48f3e6c21849201df653ffea0f2e6d8e370", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702453532, "uuid": "40c42ed8-a7df-4068-8b9b-b193a6117b4f", "comment": "Malware payload (DCRat)", "value": "adf10c872d00fed68d0379ebdf14946573b321b4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702453532, "uuid": "f99a9646-8360-4546-b6ed-5b73e32b4163", "comment": "Malware payload (DCRat)", "value": "17d880254cbe97c1093ad84715c76a263d5ba6fa68ae052ff98ed5f12ab485b07c0a747f250327807230b7aa372ae086", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702453532, "uuid": "3cbd95d7-e5b1-4e99-80d3-df67bda7241c", "value": "T175A5BF0675925E32C2A06B354A97023D92A0D6663A12FF0B370F51D7A907BF09F726F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702453532, "uuid": "445b56d8-2e2c-46ec-b4a1-bae51c66e605", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702453532, "uuid": "282dbe6d-edc4-47ed-a2cf-9c5a1e88422d", "value": "49152:MBlHIUQUiSWQ8Og2M5VEsY8JP2o+aAKMhzl7t:mloUQUii45W1q2o+aj2zl7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702453532, "uuid": "306e62c2-a1c7-4d28-b18e-8897f0c4e365", "value": 2255659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702453532, "uuid": "900104e3-cd2c-4172-8104-2b5f59f293de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702453532, "uuid": "754a4a52-cfc4-4629-a288-33f7fcf92576", "value": "a1f23be105511b40de712ef2bb0599e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986e4520-995a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Meterpreter)", "timestamp": 1702432487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702432487, "uuid": "34f444be-ab8a-4b6a-9b95-588403dceed7", "comment": "Malware payload (Meterpreter)", "value": "5553b09479b6bb61784ac90f9089d889", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702432487, "uuid": "e2b0fb3a-caac-47f9-8204-fdbf47aeb5d3", "comment": "Malware payload (Meterpreter)", "value": "44e022223df79fb2724a328b1390e2724ecaf8721328c4cf36e03da2a67c4a95", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702432487, "uuid": "9595d81b-a88e-4d3b-b5e3-2dc798177241", "comment": "Malware payload (Meterpreter)", "value": "7c4425f36e7fae87183b49b6e64233339c133eda", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702432487, "uuid": "88037bdb-a235-4cf4-9931-393c8012f4c4", "comment": "Malware payload (Meterpreter)", "value": "03c7aa8b7821a426af81bc19bd5bc095c3d60abe3e9561091fe47174f8c02f974190d595c436fe5a4947129804c7277b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702432487, "uuid": "8f788742-b9f9-4654-bc8e-205fca2adf4f", "value": "T177E1751337184EB6E8BC153C06E3FDA761895E293F3B83B28D280317296212878B4E59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702432487, "uuid": "33124726-1e97-42cf-ba17-a63f0d55bbbf", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702432487, "uuid": "8d2ca1ae-e2b0-4a9d-a80e-301b1669042b", "value": "24:eFGStrJ9u0/6QanRnZdkBQAV23WkNYKZqPeNDMSCvOXpmB:is0dahkBQFGZSD9C2kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702432487, "uuid": "44efafac-f26f-45c3-9b2e-67140a9f3853", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702432487, "uuid": "308f3505-4873-4b55-beb4-18cec023d6a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702432487, "uuid": "1204feb9-e0a2-49ed-b5d3-7909b79f4196", "value": "5553b09479b6bb61784ac90f9089d889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4287c3-99aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702466744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466744, "uuid": "29fd113c-ca2e-4f40-961a-e7ced7b06f4e", "comment": "Malware payload (AgentTesla)", "value": "311f1fe192150f49cd219f32bc39a474", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466744, "uuid": "0220d448-c03a-462d-aba5-bb9d54352036", "comment": "Malware payload (AgentTesla)", "value": "46984c41ecc71bf459b9adbefd72cb8eb279c982f3e8458dd49061e98bc5d2d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466744, "uuid": "771120b5-505a-4a0b-98d7-eb5633b61fc2", "comment": "Malware payload (AgentTesla)", "value": "2498b22cefe062c6e5e71d68a9d3e27a35978ff5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466744, "uuid": "4e49004e-ec31-4bd6-b758-fa319fbd1f9f", "comment": "Malware payload (AgentTesla)", "value": "a01a03b4b18041e0891f90a84db799c7f77c3ef7ce17128409b29257f139caaf735a5e669467814826d07a50cb43cb79", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466744, "uuid": "223d4888-9ea3-48a3-a105-284972e7f1ca", "value": "T1FBE422107B29585FD97343FAC9A310082B75BF1AA027E7CC2DD4B2D652D7B901FA16A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466744, "uuid": "20b473b3-769e-4838-914f-8bb67a91440d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466744, "uuid": "f57966e3-416c-4208-8644-4108382b0cb8", "value": "12288:41w+4WpAEay7IPiK2B0w6hwDRIuseaRSkW65h35PdQO5vRT+:UpAE/KJbiVmCkW4hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702466744, "uuid": "4612f8c4-cb6c-4a57-938d-357466f5024c", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702466744, "uuid": "1f6adff4-98b3-435a-82cc-ffdde24faaf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466744, "uuid": "40c213ef-a9de-481b-85d9-6427a66f302f", "value": "TGCT-RFQ0405SWO230005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391bb1f0-99a9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702466258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466258, "uuid": "c7933613-28a4-407b-8f55-8e1866a7339f", "comment": "Malware payload (AgentTesla)", "value": "96af946bfdb975a03ad9550223de5177", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466258, "uuid": "433066fd-350f-478c-9867-4d15c5a1e746", "comment": "Malware payload (AgentTesla)", "value": "4708153c6d03a1d3c32475f529229073defc77516416b5d7b808a9fa345b74e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466258, "uuid": "349a9399-a564-48a6-8322-21d23919aaff", "comment": "Malware payload (AgentTesla)", "value": "7c9771bbd517a0cc0014b999a03a2e2ea5e1945d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466258, "uuid": "6a34407b-8cd7-4227-9681-f2e2a9311f05", "comment": "Malware payload (AgentTesla)", "value": "d2acc6a1cc682107c33cde34ac2cbed32b9f03c9c4db542427b4df957164758e56461881452337e2c2b549bf4d60be4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466258, "uuid": "8840b209-b60e-4618-adba-6bfe7702e6fe", "value": "T190E4234837D8C97AC27C233A793785210338A9135E09D79E5E6296FD796BB0027E1787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466258, "uuid": "b7b3bf8c-e0e0-4e72-a154-de4c19f3e892", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466258, "uuid": "e1e0fd1c-4c53-4c48-b5b0-4e0530fe8c6c", "value": "12288:gEfzIhGy+YYUBYC+XJ0dBnZ6LjJFilgG/0+3Tl2b/iac9Yz8jTmHTRPWU:DHYnCC+XJwnIQ0MZ2b/0YYjTWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702466258, "uuid": "e5a03735-00cd-484c-b95b-b6adf4d120bc", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702466258, "uuid": "481380eb-eeb7-41b6-992f-238b61886be2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466258, "uuid": "ffd800d7-8de4-4d81-bc26-e85a15e6f179", "value": "SecuriteInfo.com.Win32.PWSX-gen.14094.29683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a35e20-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702471085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471085, "uuid": "435a020b-411b-49d6-9933-f25de4a8827f", "comment": "Malware payload (AgentTesla)", "value": "edec3be8c24bfcf948654e2b58674a40", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471085, "uuid": "3c0ec9d8-b54d-4f88-bf4b-9350b96dbc83", "comment": "Malware payload (AgentTesla)", "value": "48640541d98ded5a850e2c281cd551eea3598502ab725bfa2ac4ce5f7846b3ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471085, "uuid": "7f24c8c4-68cb-46fe-ade8-36d5663fff6e", "comment": "Malware payload (AgentTesla)", "value": "5287bc48966e4327b43cabf31bff7babf5a0056f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471085, "uuid": "3f9a124b-53e4-4f6d-961f-f5b20ab9e517", "comment": "Malware payload (AgentTesla)", "value": "e022f284e5cae0e7ee7ec15ac1b85043d81d193aadccad70fb80c679c398f9229db0747d9e83c5ccb40b8a5874386fc5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471085, "uuid": "4917c442-ff04-44ba-aead-98f1aa7975c8", "value": "T177E423641745DA23C0EA2A789971891347715E034607D38B18BDF0AE9BB37881FF2EDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471085, "uuid": "ddf8bdc5-a003-42d9-bbda-e3d8d32ed217", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471085, "uuid": "45c13212-54d8-4de4-9d3e-0819856f7c00", "value": "12288:PEfbIKGy+YYUBYf5YrWKjg2ZZUsl08ve3TNub5ABRjwWj4uWxSDkTF5GsmZze/J3:awYnCfVWg2Qsl08G3hubYmcPISDns8K3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471085, "uuid": "fae1fbac-5c79-4e21-b7c2-b4f449d6cbd4", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471085, "uuid": "ae84cc3e-313e-48a9-b630-cf28e75986f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471085, "uuid": "38013873-6306-4929-b1c8-db278fe1cc24", "value": "Fiyat Teklifi _KIPASKAGIT HPT23031910_0523 2023935164- .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446a1ac1-9a07-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702506649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702506649, "uuid": "a495add7-c6cb-4597-8162-bd16e0a16a9e", "comment": "Malware payload", "value": "ff11c014face4d4da096e5e74568caaa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702506649, "uuid": "eb6fe525-0b57-40bc-87ff-f35e79aec096", "comment": "Malware payload", "value": "498f73cb3d78fcfe879a2e2f3711cdbea1825a367272fa4d1b3d2b0a04ec92d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702506649, "uuid": "4b0215ae-e1e0-46dc-b25c-8c9a4a558f7e", "comment": "Malware payload", "value": "76bb98421f03e5c10fc094472ce857484291437c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702506649, "uuid": "acfaa84d-4789-4dd9-989f-9776fe2eeb00", "comment": "Malware payload", "value": "baee9beafef9bc9a62b7fca0cb07456fb7343ae6e89fe7ec15f8bbc345c0f54698cc1d7d56a703c06795e3809a31dbf4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702506649, "uuid": "dfa58d3a-ebf0-4e06-b75c-8a5882aed6e9", "value": "T18503F12C2D19B44BF02597B1CD38168314652C64C7AFF34309D29E97EF95D8BF6B09A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702506649, "uuid": "b02997a9-a236-494c-a8d0-cc3805273112", "value": "768:2Qebr78eKx12VmVGa/ldUeFbvoN5bZftQxMJNAEX7XRl:q/78eK72Vlad5E5bxtEMdrRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702506649, "uuid": "ddf4811f-c4b3-4b76-ba7c-9e20791aaf0b", "value": 40444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702506649, "uuid": "7ee3a266-778a-43c4-a86d-5bb5fe6216c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702506649, "uuid": "d38173b8-6d44-4156-921b-ab6caa31a9b5", "value": "ff11c014face4d4da096e5e74568caaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44dc4137-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702471002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471002, "uuid": "f78d30aa-48d1-42fe-8498-5494a466b09f", "comment": "Malware payload (AgentTesla)", "value": "54f09aa4e6465feda764173d69b0f14c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471002, "uuid": "4701931c-5391-4a5b-9ea3-8d6806e3e02a", "comment": "Malware payload (AgentTesla)", "value": "499b83d31856521579e10a5b746502955c26bc0668e1ab2323f57084d7e5ab98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471002, "uuid": "4ea4fe0b-8a38-4aba-93f7-c547c9060e84", "comment": "Malware payload (AgentTesla)", "value": "6d591e7f15f4071f60bdc6c88ea07abbff892f15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471002, "uuid": "28a29450-c3de-4754-8199-e28cc337c54c", "comment": "Malware payload (AgentTesla)", "value": "3f6170cf69dc4bf71c7ee25eda86cafcabab59a09e7b99f809b0fbee8ecb33ce74189732f775638da32689e86406ec1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471002, "uuid": "8f9799b1-12ca-473a-8e62-c06b1090aa57", "value": "T15375BD17F70C5BACC8594FB1F033402042659EA7932686097AE9FA7D6DF6B8A16130F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471002, "uuid": "15fbf3e3-c781-4303-91d7-ad3a73666f31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471002, "uuid": "48b2ca9d-057b-4023-8af5-9e49b6755e22", "value": "24576:bjS1pzw4kQFj5e4b6NSCjNrlGWGDyaWUa/Q6KzHrR23:0hw4kQFj5/4SolIDynUaort4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471002, "uuid": "5d7cdaac-fbf7-430f-bb28-0594dec962ed", "value": 1589248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471002, "uuid": "647820b0-07ae-4252-ba54-85507d43c878", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471002, "uuid": "8039275c-40fe-4578-9074-8d65d1731af7", "value": "INQ#23P6200562_supplier4_mpjxPriceInquiry_1697504449019_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "399e0554-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480861, "uuid": "2a4b088b-6e43-4f63-bdb0-0ba19328d0c6", "comment": "Malware payload", "value": "563ff6249d0d3953171d06aa0b0750a7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480861, "uuid": "0eee73e9-c2ae-41bf-8578-7b8a1896b568", "comment": "Malware payload", "value": "4a4a86ced15426aaaecb9f00eacb2c29a99dcb6ebf9184a3deed56f766d604cf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480861, "uuid": "ff71c625-62af-4c25-84fa-272952850ccd", "comment": "Malware payload", "value": "b1fde754918eb4bea95c46d0ea3c8b105856c0b2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480861, "uuid": "956a24fa-2ccc-417b-a72e-65a0335e787d", "comment": "Malware payload", "value": "034982ffbab203aa853821f9e0ac84e81b62d8d8a5faabd9ac0c7c26e6b6e04f76d539cdfc12a42dc2d91771495a6962", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480861, "uuid": "eceecda0-32a0-405b-8f69-2683f3e04ec0", "value": "T14E35E01A36A1CD96C1C41930CCB78BFD99A2EF23CD11824B5B907D7E38769CD68125BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480861, "uuid": "31450300-c21f-4892-8629-2c31dd79936d", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480861, "uuid": "d20dbe2f-baa8-4adb-80aa-5b883e51d706", "value": "24576:VbTiX914hBilP4yGikVVXneeeoUfQ+HghB:VXw9qh8lQyGiGVfUf/HQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480861, "uuid": "7ed3e0aa-236a-419a-85cc-5611208ced45", "value": 1086789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480861, "uuid": "6e25115a-d61b-48b9-ae53-df58194cd5ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480861, "uuid": "2864121e-ae73-49fe-9071-633bd4db85a5", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.32606.17233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16a41e30-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1702470924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470924, "uuid": "e7dc1687-6e16-4b4e-9c3a-299fc72c1df9", "comment": "Malware payload (AveMariaRAT)", "value": "081c8b58521d5562fae1a563f7635dd9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470924, "uuid": "9a518429-8394-4f39-8f28-f9c95ac60507", "comment": "Malware payload (AveMariaRAT)", "value": "4a92ebb3b916cd8155c0c450f7529742c89938f244fcd4c3e9fb2ed1cd89feb8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470924, "uuid": "7756fb8f-e49c-45ee-b93f-b238cc71d950", "comment": "Malware payload (AveMariaRAT)", "value": "12765cb764c8fcd4df4ad7d54c0dd9ea30507c24", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470924, "uuid": "2004f7e5-a5fd-4e81-a4af-a9d40b1eea87", "comment": "Malware payload (AveMariaRAT)", "value": "5eefc3b1d19cb834190d1fa2565bef86274a24c20a7fe6ef7fe0b0970309f709322a17430df269eb219860aad214d06f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470924, "uuid": "872dadaf-5c60-40d4-9cf6-a217c2d664e1", "value": "T14C35E153F6E3B679E6FFD2BAC6B1D92C21B3349603B0928E774165492D12391493CB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470924, "uuid": "69a30212-fa0e-47a4-8d18-3a914de18c92", "value": "d4c9759f791ea559bbad095fb49820d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470924, "uuid": "c06d18cc-a060-4041-b235-56471e37f95d", "value": "12288:xG1N4HkcgMsiOd58bzbBSreRQ0uqZzD1reWabd/iuPY5Y7/5Iv0nry/sw+x7s6GS:xoOOMX1h+QHT+dtA5YSv0AW7eqxDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470924, "uuid": "5d64624e-83b5-4b92-a062-b234f3e82277", "value": 1099264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470924, "uuid": "7eb52e01-66f0-4080-a6d9-b3dbf86dfb02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470924, "uuid": "d35769cb-c08f-450d-b3f3-03254e5201c0", "value": "Orden.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392b98a5-9955-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702430180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702430180, "uuid": "4f343abd-9f0d-4890-85df-0e04a1ffb074", "comment": "Malware payload (AgentTesla)", "value": "7fb1638e865e58b80b1726a7f7be73f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702430180, "uuid": "1ff9a0b3-ae90-4f4f-88de-289ac0b476ce", "comment": "Malware payload (AgentTesla)", "value": "4ac078a48ff7d80ccbc37c526e395b51f900c8206afe29e27b2a84bd2cd84532", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702430180, "uuid": "cb7736e5-24dc-4e4a-b435-9d02de72a83e", "comment": "Malware payload (AgentTesla)", "value": "d1a0f23aa68c74558b2762d21cab404d7ca92217", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702430180, "uuid": "44feaae7-0394-4093-a9a4-4e44fbb48d10", "comment": "Malware payload (AgentTesla)", "value": "5c4b712504e8aba8d9698867fa0d19ae591687e86d3c3496b5ecb8af576da16280fe6533f68caa157873738b24fdf4b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702430180, "uuid": "563d518d-b73c-4987-8554-e4ac3cbaf969", "value": "T11605A13D19F92227F174C7A6DFE0C527B260A5EBB052AD64D8D243960307A4B79C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702430180, "uuid": "a016d782-bb85-4c08-9bda-3769086dccff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702430180, "uuid": "ca6fd84f-3bc3-48d2-8138-b0a9067f7621", "value": "12288:Wd6tmebg0pGSMujFv+HUL1300mv6wjIq40+vSIRmx8x4+/LVmIK8:WAtmebgIRvsKJ00mnjIE+v10IZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702430180, "uuid": "0aeab5b5-e614-4855-a4f2-f6300b04e9ef", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702430180, "uuid": "dcf16fd2-31bc-459b-85f1-5d3ecc86eaed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702430180, "uuid": "104f658c-447d-4353-bb8f-716ea247056a", "value": "SecuriteInfo.com.Win32.RATX-gen.1832.24679", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f1f583-99d5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1702485422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702485422, "uuid": "1a595d1c-2e96-4117-beed-361ed7727621", "comment": "Malware payload (zgRAT)", "value": "cdd0fac12ad7f96185181d71647ddb98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702485422, "uuid": "d08d40a1-aaf2-4da2-bb68-d98e76b91713", "comment": "Malware payload (zgRAT)", "value": "4b41260da8f93986ca0bac53fd006dd6e17fb94b81960677221ed9ecc63b0eed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702485422, "uuid": "48617a90-6843-48c0-b8ca-d0e179e86ee3", "comment": "Malware payload (zgRAT)", "value": "95d78dfd69a844307a3e0eaed654841e58cd98ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702485422, "uuid": "807160a5-7841-4be4-848d-55f6b40c21d7", "comment": "Malware payload (zgRAT)", "value": "be28224e3933d0c2ef8e3fc226f641a7f9b3e50282829fbf84b91c7aa6f47bcd8c46059ccce502ec224a8bffa75ee427", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702485422, "uuid": "92365d6f-8b1a-41c8-a750-dc7b9885153a", "value": "T15A15B23D19F92227F174C7A6DFD0C527B260A5EBB1629964DCD243964307A0BB9C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702485422, "uuid": "53767eac-64fc-4e92-9a0a-d303d91ef165", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702485422, "uuid": "a1660144-eca1-497a-8c48-fce0af99b326", "value": "12288:dfur0YLiIDgaQQM1u1SSScOPCaGbC7x5k2/GxBCNb:VB/Iq3WSSXOPLX2BCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702485422, "uuid": "eebbbcef-3d02-4ecc-9e4a-c24d50f7d8c8", "value": 943104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702485422, "uuid": "92395328-c4ff-4615-8790-fb62d633f329", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702485422, "uuid": "2d3fe6c5-ec64-497d-ae38-c65a82173304", "value": "proforma invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d251ca3-99fc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702501913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702501913, "uuid": "db502c8c-a15e-4834-8912-ee64f8d68a66", "comment": "Malware payload", "value": "cd6f6b6a05cd94839beaae7f59b4d6dd", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702501913, "uuid": "b0b31d5e-ed2c-4b25-b518-56a12d24e954", "comment": "Malware payload", "value": "4bf1915785d7c6e0987eb9c15857f7ac67dc365177a1707b14822131d43a6166", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702501913, "uuid": "10a54824-5421-4881-b866-649519b65786", "comment": "Malware payload", "value": "5310270aeeeca3fdb38beee7021f3cda591b70d8", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702501913, "uuid": "ef8f5599-1b89-463f-9ea1-9a40faee6739", "comment": "Malware payload", "value": "717141daf7266e4e3a9c47925ddd2e1881395b8441927b4bc60809ca76e1dc74ec08f9b8303f2ca19248066cda7a621b", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702501913, "uuid": "6f74735d-ae0d-4d80-8388-d112e33f1b9b", "value": "T19FB5D0625DC42FF5EFD8112D90BE6B0E43B06187241A608FFB656F09AFE7E44850B297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702501913, "uuid": "f9d935e3-6e55-4909-8b22-0abe7ce2d5a7", "value": "a71f9a1c4a1445f92b7bbca6fba33a96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702501913, "uuid": "4a763533-3248-4bd2-bf5c-ce88a56cb598", "value": "24576:9GBiY8bJbBP2BlK3dsdhmYSUUlmYorz5/nPqCXM2ntWdN8ANFOjJwFzCJvHuUGyw:Ouj8R856N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702501913, "uuid": "1268ccc9-a6de-43f6-a8cc-c9c8581317de", "value": 2476544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702501913, "uuid": "98dda8c9-faeb-4dde-9018-5729a053e2f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702501913, "uuid": "4a397e86-4a56-42be-836e-a6d1b4818ca2", "value": "WRUpdate.x64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7039a8-99cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702481940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481940, "uuid": "e9b6edf7-4487-436b-9a6c-9a99dc32a966", "comment": "Malware payload", "value": "922d0a2e1bd9ea4dcec5dbdcff25546c", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481940, "uuid": "61ed2f7f-a466-41e8-85df-36aa0b530e79", "comment": "Malware payload", "value": "4c0fa59d0417f543444a338654cf5a3a1f7bf1aab9c900ade77aba15af0f7343", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481940, "uuid": "b9c8c702-f978-410b-a0fd-ff7ecf3eeab7", "comment": "Malware payload", "value": "31f676cc5b235e511126d12616a25f1ef7beda70", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481940, "uuid": "5b83ac7a-083b-4aa2-8166-53122da566c8", "comment": "Malware payload", "value": "69a6885cecfee302a837cd10526d4000bd591519fee0b1d668d65fe082713f4571379513031fbb8c2ebacdeffb47e6d7", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481940, "uuid": "b4dd3ed2-efed-4324-81e7-945ac2e2bce0", "value": "T1EDD3F188D5D9CB1E85B884B6926D0DD63192C14B4CC1B8B148FBF642BEC7A48E7F1D93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481940, "uuid": "238216a8-4423-48ed-a3f6-89d067ef887f", "value": "3072:vTeIv4WIhwFlN2gnLR6JFu/dEYhHWxlM2qlCnrBjr8mOg7GmL39MgbmET:bH4Bw3o0LQFyTolM3lCtjnSk3NmET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702481940, "uuid": "94d0d9c6-6d7c-4e29-a7c9-a770013c4441", "value": 142953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702481940, "uuid": "8c2ff6f3-28c4-44fb-98a6-1ccc5efb98b9", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481940, "uuid": "d33546ba-a612-46fe-a4d5-75b97014cff3", "value": "TY.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d0d686-99e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702491326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702491326, "uuid": "384653b4-7ba0-4e4a-9440-9dfc6391b800", "comment": "Malware payload (LummaStealer)", "value": "1fb12f32d20b80ef260cd2470738ceb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702491326, "uuid": "ec2f1e4e-ada9-4e8b-ae49-47b582ff6f9b", "comment": "Malware payload (LummaStealer)", "value": "4c88995580a3340b9f3529d77c303b227f3f8cbeb73c4bd9a13121429fed6e44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702491326, "uuid": "175d13c7-c7fc-4a2b-8616-aa062bfc65d7", "comment": "Malware payload (LummaStealer)", "value": "3e71d386bfc80cfea4d9a05fd6b5e970b89195d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702491326, "uuid": "ea3d764f-6da7-4ccd-ba10-fc8cd782141b", "comment": "Malware payload (LummaStealer)", "value": "43b70ea74b15aa892cd814db98e3a9ac7225cf0d8498f054a260920bf3b3119d1f74e8ee5efa0b71f23a593d88ef1b37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702491326, "uuid": "5bb76338-5704-48ab-b963-fec84362230d", "value": "T14F3633DF2FEC912BD06897B147E1529F24313866836853DB27CFDE99D9234A4313AB81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702491326, "uuid": "08e57280-0e62-4f27-b998-83cc1d394a2c", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702491326, "uuid": "87c908c3-5e24-4624-804e-ff7a86ef6b45", "value": "98304:XXETsu07so7P0MlgWclAIYm8g1iNgHbyoqAX/wld9DEIhx7T7R:EgJso7PPWSml1aKX/2XpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702491326, "uuid": "7c54e8fe-b535-4fbf-bfb0-96d49dac4cc1", "value": 5117952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702491326, "uuid": "3b222168-3268-4bcf-a711-16039e3274c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702491326, "uuid": "b541ece5-5495-469f-b10a-a5f5ff455999", "value": "1fb12f32d20b80ef260cd2470738ceb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587c58f1-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480913, "uuid": "e37283ef-01c5-4287-b03d-205ffd484e39", "comment": "Malware payload", "value": "522d521510528c983e23e85d7ae5e88c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480913, "uuid": "15eb4ab8-45cc-41c8-ad65-7af686435048", "comment": "Malware payload", "value": "4d9f557790e63bccbca6fbc20a47661e15869004db64412196b8756025ea1f24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480913, "uuid": "a44ed356-af32-40e4-8235-020db86276a4", "comment": "Malware payload", "value": "f585eda5e0b95d958c0739d52c056aa946211848", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480913, "uuid": "358b6f55-eae2-4d45-9f5b-41d65cd28451", "comment": "Malware payload", "value": "7bb4eae93cbc9a574c33762f00c488e08e15e264b2ef46d8f13221536d209edd477ee27f3a4a1e18e2163145baed4678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480913, "uuid": "5bbcb8cb-807f-43ef-9123-e53b3a2dd5b1", "value": "T15D05233EB7448C0FFB406874A6E1F8704D7C5B789DD1076275B1366F7EA1B38A41AA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480913, "uuid": "fc73d38d-2dd5-4224-b744-bffd1d46e51b", "value": "2b07ba9c1e54b04624dfdda69d875a1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480913, "uuid": "e5fdf62d-5d91-44c6-b5a2-b548bdfe9674", "value": "24576:keODPIzgOiCVHfUro6fVnho8ekrnupJn9R4D3ii:kRAQYMo6fV7nupR9Gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480913, "uuid": "cb7ed396-1f2f-45ef-a4b4-834da2845e54", "value": 859098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480913, "uuid": "c9d80d00-555e-42e9-9263-88a63ae5deb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480913, "uuid": "0c0f8451-6f86-4a85-ba17-5aef81637d1a", "value": "SecuriteInfo.com.Win32.Evo-gen.30261.7425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2538867c-996c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702440025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702440025, "uuid": "834add73-7095-4da9-aeab-bbf170fa6810", "comment": "Malware payload (LummaStealer)", "value": "d6409c3b8d0d254122c0ba570fb98cc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702440025, "uuid": "1bde968e-fe58-4ea6-a0d3-22038b1c7a9d", "comment": "Malware payload (LummaStealer)", "value": "4df62c5d2e5c3ae6d0fe21ae33d398dce6ee8a166b032501f290f74b6f7b075a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702440025, "uuid": "bf1dc99f-5659-43d1-9068-74d3ef2db46f", "comment": "Malware payload (LummaStealer)", "value": "4dad859a891ff2fcac860a527d78db92d84a6403", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702440025, "uuid": "a6a950f7-6ce2-4b20-942d-bc6e66d87a08", "comment": "Malware payload (LummaStealer)", "value": "98d147396c17d6402785076afea4488b5038bab0296071bff8ed0dd7f123fb5aa62d2510a6d2b399b418141051b975c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702440025, "uuid": "df736c69-2127-4caa-b5ff-f13b10b716de", "value": "T1C1752312F7E8547ADC336B341CF327A72A357C239DF0119B266498690CB3994BDB136A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702440025, "uuid": "be2e3a04-8856-4201-a3d4-6d3e81a60fa2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702440025, "uuid": "2fd58a34-da85-4dca-91d0-0978f7207930", "value": "24576:eynbUQ+9zIFfDnV3Zrc9rOvYGDBWx4P41/6A5GRs3tZoVx1UZyoorfV2WWp:tnbNEzurnVOVO1Ex4PGSAkGdKVXUZyo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702440025, "uuid": "1a5e888c-70fb-45d6-92f3-ade71c62abe9", "value": 1570304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702440025, "uuid": "9dd7ebf4-1c09-494a-b3f0-54c611bddb83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702440025, "uuid": "095f0fab-8fec-4d06-84e3-7b47f1ff6aff", "value": "d6409c3b8d0d254122c0ba570fb98cc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2453c49a-99c2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702476960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702476960, "uuid": "be9aa27d-44b8-4529-ab9b-646881349d78", "comment": "Malware payload (AgentTesla)", "value": "1b3e2ab3690f0eafb88f1b69f16ccda8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702476960, "uuid": "654d17d8-ec36-42f7-8701-57540850b86f", "comment": "Malware payload (AgentTesla)", "value": "4ec757a53ab17fbf9fb784f7acbf23a44ce3fcff4ebe00c067ec36bdc6c0e8f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702476960, "uuid": "18e8046f-ce97-4bae-8bff-c82c829e665b", "comment": "Malware payload (AgentTesla)", "value": "084cdf2094d182a00ed7907c450e7528d7373896", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702476960, "uuid": "f687bfcb-4aa2-4d39-ac48-df1336f1f9be", "comment": "Malware payload (AgentTesla)", "value": "389e7842610e8fb326f03156fbf368d7dc07977b949d15f9af59ebdd1e60110f39dd3ae2e47c767e7db39607c60c886a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702476960, "uuid": "af02b5a7-f1fe-408b-af4e-75b7e05942a9", "value": "T16EE4238123A8C6A2D3F5373DBD33536217B881129D15E32E14B9B6AE64B370815D3F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702476960, "uuid": "5061e6d2-524b-4856-b2c8-c7d32e877245", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702476960, "uuid": "97071e0e-e6cd-4f70-bdad-2559c3bbe6ac", "value": "12288:2Ef2I9Gy+YYUBYUKJNav9jmugrHR01rhRdilTW4QlS3Ah9M2gS40lr0033I2v:obYnCZJNavnMHarh3iBsMkr00nI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702476960, "uuid": "17a5dd48-1124-47c2-8cd8-a9ca64730199", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702476960, "uuid": "fbc6eed1-6b28-4cb5-8a31-b745d984c4b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702476960, "uuid": "492375bf-b68a-4bbb-a50f-3a0db00f5a63", "value": "payment information.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3095e7fb-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480846, "uuid": "7ac1696f-4f91-47ab-937b-3975dbf22047", "comment": "Malware payload", "value": "a762e3bcdd0d56fb6d8e082553a065d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480846, "uuid": "c4dbe72b-f592-4e81-8748-b3686716b78b", "comment": "Malware payload", "value": "4ef6731c64c9aef828a865f74059c25be25365db7ac14cd679fa730784447934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480846, "uuid": "0dcbdb40-87d6-4571-acd4-b0bf7c82e41d", "comment": "Malware payload", "value": "b5ff5fcab6575237a31a151f8e410b20a5889883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480846, "uuid": "d077abfa-b614-465f-a078-679631f819e2", "comment": "Malware payload", "value": "8a98b0b870f4a5291a5c1dc726ee232f4b4c329c708233174361da0b8b0f60144d665b00cd4700021b124b63ff044305", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480846, "uuid": "af1f67c7-c0d4-467b-90d7-52bc6703509b", "value": "T137469D379E1D5C8DE80174719C0A8FDA2955AC21B5086B9B76C1B96DCCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480846, "uuid": "675087a2-11c1-43bb-b56c-9003f59fbf8d", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480846, "uuid": "ff59109f-402b-412b-8edd-ffafa8db7c28", "value": "98304:AgDXacZpRCFNbUlAmEgp7thOqTEMOXM65eGwzVXq590IjPtGg3le:ASaczMFVbmlp7/OtnM65eGwzVXq590Iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480846, "uuid": "cf6c0bf4-0a6d-43b5-8c06-093ecff40c77", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480846, "uuid": "d64c455e-98e5-4bed-9ae6-b85acdea50d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480846, "uuid": "691b014f-945e-44a9-9f9b-7b27dd2c8108", "value": "SecuriteInfo.com.Trojan.Crypt.28039.10086", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bed12f1a-99b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702469918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469918, "uuid": "38c6e244-aecf-4bcc-94f7-f804f8a7e8c1", "comment": "Malware payload", "value": "d681cdd4640eba80d8f344ec9ed3627a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469918, "uuid": "df2a7a93-69a3-463b-b80e-85cbb843ab8c", "comment": "Malware payload", "value": "4f7848518acd8847a6fc4f87ca7a20ef502641426ae1bb1353df989a8edc076d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469918, "uuid": "deb1e69f-6b64-4d8f-b8ba-0e2b200e56df", "comment": "Malware payload", "value": "cb2f38b7136f02eb88bca498245fb065908ebd7e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469918, "uuid": "66063018-6b2d-4100-a36b-178ca8e22f26", "comment": "Malware payload", "value": "3a6f7ff7b5519a0558bc9562aa2213e513095f989c6b1d94d84d0bdff669b1a930838f039041f7a3fc0bb01685cf5260", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469918, "uuid": "4c62743f-3a20-4e5e-ae0a-4a9c666131e5", "value": "T1CE935051B546CA5FCBA411341CDADBF663B63C078D8E825B7091B31E3CBB6A0EE19784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469918, "uuid": "b427744c-7e5a-4de1-a724-4bbc089ba339", "value": "768:0MJgKNRGh47XzDCAUdO7nKj3bSP1EZJ0i1ykFyohCbIoxYko38Phe2R4DcODyZet:mKNRGSW+nJ94J0HW7mR4AOm8dpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469918, "uuid": "a6af32d1-fafd-4752-999b-ac37dbe31efe", "value": 95232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469918, "uuid": "d7fef49b-5286-44ee-aa57-9719976b606b", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469918, "uuid": "9ac47bb4-46cb-45b9-9eef-b03d3454d43a", "value": "S-INV-BROOKSTRO1-476006.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89b0af6-99ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1702468700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468700, "uuid": "b125003b-8d13-4fb7-ba81-958cfb1c48f3", "comment": "Malware payload (GuLoader)", "value": "a132d73e768ca2c03c777ebd74c343f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468700, "uuid": "a627ce8a-bf4c-4285-a573-dc22a97dc72e", "comment": "Malware payload (GuLoader)", "value": "4f95714dcfb978a9c3da1df0dcab412c6784b633f7152506a6c547131640dbdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468700, "uuid": "2779750e-b1f7-4d5b-88a5-61a1bdd743fa", "comment": "Malware payload (GuLoader)", "value": "4c70a59fc1a5f34dd04c94d7ecec2eaacdf5a167", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468700, "uuid": "99d35ac8-ea9e-4c87-8052-7f6a3bd5c8fd", "comment": "Malware payload (GuLoader)", "value": "2a550e3dc5ff7f02ed3c2f5217a48b2ccf0faa077cc6a8439a8fb902bac16e291dbef86f19c191919513a5e6fc4b2fb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468700, "uuid": "5bcfe1f0-31d9-491d-b8ee-c5074fc8d6e8", "value": "T1EF1523D06368C827F9E7753418F41CEB9CB251462D960F0713A64A3ABE51581BF9C3FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468700, "uuid": "ddf34cea-a4fd-4670-8068-d8bbd24157c5", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468700, "uuid": "8a5b29af-6a62-4e55-b735-8c75a3029fdd", "value": "24576:xyTRCS30G/nG6T5gQBOPTqUqtLRTZoO/rAfWMyQqpO:20SnG45TOP+L9RV5/rAfWMApO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702468700, "uuid": "6ef20cab-bf20-4c63-959e-9e459be03419", "value": 923624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702468700, "uuid": "171a51c3-a357-4a07-a11a-bbbe2f0ce5c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468700, "uuid": "ca9f5059-284c-4481-948a-f1186f68a947", "value": "PO BCA08727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f105c887-99b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702470861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470861, "uuid": "1b4ff5ae-6543-4a26-8aa7-9574a3ba7490", "comment": "Malware payload (RemcosRAT)", "value": "849ffec0b81a28b95e18a0ee5ebf34f8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470861, "uuid": "e2f61588-3387-424d-8cca-0ee07e732c90", "comment": "Malware payload (RemcosRAT)", "value": "502a4b4a5c731a429d87dad2391e78f2bb6464c9fccc4fbc36d85ed8849b3879", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470861, "uuid": "ecda17b1-9ef2-471b-8364-dd7ed37a08d9", "comment": "Malware payload (RemcosRAT)", "value": "7b0cd2c9de0969ae8f17531bd3e2f73eb1a4df46", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470861, "uuid": "5b97185e-7b64-44ba-a1a2-080bb7fa7ad8", "comment": "Malware payload (RemcosRAT)", "value": "12968b719a39b4c4397d04e6ae0e622a33e69f62ee97b250d07324c2a91a227a47af330337c5dba03858664fe63edc85", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470861, "uuid": "10a9dd60-da96-4f77-a871-7eb66854ec47", "value": "T128B53386166CC7590C7EE09062C7FD71765DA34B21F9A8216BD19437088B73B33ADA2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470861, "uuid": "6eb287fc-b7df-4e8e-990a-485eb999c156", "value": "49152:L8jmzqWFy1Xt6wzmUiwVksjmzqWFy1Xt6wzmUiwVkp:oW0Xt6wW8W0Xt6wWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470861, "uuid": "ed373601-874b-4dd9-8c78-d437d380c0bc", "value": 2339581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470861, "uuid": "b735a83e-0785-4514-a3ff-191e24915652", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470861, "uuid": "48ab6352-b44d-4603-b04d-550558b73324", "value": "PO98654356789999000.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115d6eeb-99c7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702479076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479076, "uuid": "8d51c275-2488-4791-a416-faccc712919a", "comment": "Malware payload", "value": "63bd0b13bf96807afef4f53bddc7d59a", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479076, "uuid": "e4664762-2102-458c-9642-fef52cd0421a", "comment": "Malware payload", "value": "529d3eccf1000887f5e35b3eb8e732066b819201f37651d1ccca41d5cc2c1513", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479076, "uuid": "1f017e3d-4b12-42a0-b3e7-82dffbec3068", "comment": "Malware payload", "value": "f2a20c2d69c7dcd93edcd83f2ba4cf84126fe7fd", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479076, "uuid": "bc9886db-3094-46d0-8ac2-20ef220c4b16", "comment": "Malware payload", "value": "10d68d638e0d5dc7e94f9cb506f45674cbd078c1f8bfc5a035ba4275f3de5deee6e563f0ff1331678ec4d1c8fdd86dba", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479076, "uuid": "da8f8670-4588-4201-ae69-04064595eaf6", "value": "T143C08C08829FD425C077884DCE088CEEF88398872516C83243A12D88EC87CA93EC88DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479076, "uuid": "b5d3a913-efc5-44ba-8178-1cf91b730fd8", "value": "3:HRAbABGQYmaUMv+kJZgKQI89qe1YSo/QJ4ovstyYesbBSl:HRYFVmapvJZPQI89ISoIJlvstyYesbBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702479076, "uuid": "0fa18640-5139-42d4-891d-1bc7c9bb6bf0", "value": 158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702479076, "uuid": "64f18632-a857-4e21-94ae-ca88b882b4f1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479076, "uuid": "cbee0246-8bde-4041-a12d-fd3602b50bdb", "value": "11.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea4192c-99f4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702498613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702498613, "uuid": "08dd7403-e824-4fd4-a2b6-8b9783b2e9a1", "comment": "Malware payload", "value": "5b3d1e5fc769277cf03e27c4929085cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702498613, "uuid": "c16fbe7a-fce2-4674-bdcd-7b6c85392a0f", "comment": "Malware payload", "value": "52c76dd8c1caaf930ccb5f376b9731b21611c55ae4cbbfefb41fe3e50e66a3d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702498613, "uuid": "763a683f-eeef-40a6-95ae-fe298ad6a036", "comment": "Malware payload", "value": "ef8d7fbc30c3205628e5e9f31a8fee8292cc7d83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702498613, "uuid": "368ebcda-2bc5-4714-935e-ed2ba253886e", "comment": "Malware payload", "value": "bc584ac27e781a8eeff21f465bf72d047d7e30f25ebe5873077b0a1b83730e70f1d045ece4458fcbc3ce50c767a05d64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702498613, "uuid": "a2e0157d-8279-4bbf-b44f-e3a989732de7", "value": "T18F917320A3E84737DE360777DCB3A341537CFB448E8B8B9D28949507AD567580A72B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702498613, "uuid": "557bc15a-0282-422a-a398-469009642dbe", "value": "48:6MLG1cVeqvdbEuPTiztIHq4XskXME9nP4az6mVgMvsyHttPmCtiOl1GAAqFf/pfG:61gNbExtIHq4HH9nsYsyttH+GxzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702498613, "uuid": "0c53ebe6-9dec-47ab-9c35-7ec6cbdb59bd", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702498613, "uuid": "440cf559-3e67-4fc9-9ce4-dcf558abc994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702498613, "uuid": "eed9ca14-9339-4592-b0c2-cb4894993bf4", "value": "SecuriteInfo.com.Win64.TrojanX-gen.16896.9685", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b3030d-99e6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1702492525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702492525, "uuid": "f6354083-e18b-44ec-b722-de6c148de794", "comment": "Malware payload (Stealc)", "value": "f827b1ee6e6e58d3c210827d6bdc14a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702492525, "uuid": "a0062032-bd9a-4ebe-b2e2-e5e657ab789e", "comment": "Malware payload (Stealc)", "value": "533eef2043772af8b5dbc4333a16f5a12b667b89f7100ac34e4bb8d3191cb2d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702492525, "uuid": "fde5dcc5-d31b-486a-a58a-f667f8328217", "comment": "Malware payload (Stealc)", "value": "773e00b0d69d23d95f461e9eb54f5d616d7374a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702492525, "uuid": "7cbc5ca3-fd2f-4bb6-ab50-721b926313c3", "comment": "Malware payload (Stealc)", "value": "cc9654dc1b3b030c1eac8dea6a2e97736cba67185e378fb63cc54923c66910120bc15cf1ac3bc66af63a9cd1a3348d01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702492525, "uuid": "d366e6e4-1145-4fe1-8052-870b5fa34775", "value": "T1D974E501A340A863FA674AF39D91C8B837E97C939E8078D613C93A539A35FB06FD1547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702492525, "uuid": "8ac68fad-14af-4268-a5bd-d58e584846fc", "value": "2f8dcdaca9364db43601df4afdf48b06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702492525, "uuid": "207c9d77-8da6-4407-b403-3e29c51da692", "value": "3072:08XtDCVbKqJCLsqYug1nJW/6VB00KO6r5XUDASJHq5WlGhZMvm3mgtaraTx9L3qY:/tDsW4Ljy/QN+r5EDAoqJual9L3qY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702492525, "uuid": "14b4c218-a793-453a-bab3-7f73603fea4d", "value": 352056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702492525, "uuid": "07a4a940-8eb6-499b-ab1e-e8bfc20e7835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702492525, "uuid": "db6932e6-aaf6-4fa4-9184-73bba3fb1b00", "value": "f827b1ee6e6e58d3c210827d6bdc14a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6173f3f4-99cc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702481358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481358, "uuid": "d1cace6d-bcac-40c8-a8ce-087ddb4dbe62", "comment": "Malware payload", "value": "27ec1ce7af7918df00c51de6e2ab9b82", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481358, "uuid": "8103b627-5c90-4c17-a9ab-04d4b6c38148", "comment": "Malware payload", "value": "53418d5820ac5fe686da000f652f3331f8e0d9cb7407c34d2c3c8126ff476314", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481358, "uuid": "b085f123-c283-4071-bc49-b7cc69328437", "comment": "Malware payload", "value": "68900b6ec5a8115521047e26114a24150b2edaf4", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481358, "uuid": "99a365f8-c2af-4468-8d10-845cf6e3687c", "comment": "Malware payload", "value": "4a95067414f86d9dab90989a31a17de2890f0fcc447541604eed7b1a2095cb72286a820dc33133146781da436e7ffcf5", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481358, "uuid": "eed4cb90-080f-41a0-a941-4ab552238125", "value": "T1051412552A1BC417D6DD8F58EE2890EEE27E1E1B2448FB28CC278767A31452CDB27474", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481358, "uuid": "378849ce-33a9-414e-8ad7-2b36a258cf46", "value": "6144:JaOPnPo8nwr8cLaDCuVDDM/5ZWWCNPtdpFy:JaqPpnNTBVD05sTPpFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702481358, "uuid": "0ef0b60f-ed2e-47ec-bd43-29eeb2259f81", "value": 205618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702481358, "uuid": "56846983-6305-4ef2-a288-ac803906f0b2", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481358, "uuid": "c6c29718-6a3f-4920-a5a0-7755719ce4f8", "value": "APERIAMQ.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6861ad65-99b8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702472779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472779, "uuid": "e9b4e96c-4290-47db-88e2-c6da371004d3", "comment": "Malware payload", "value": "96d98c83daf368066efe3dd41a0dc622", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "NineRAT", "colour": "#C296AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472779, "uuid": "76aad079-c021-45a2-a523-386e23c958dc", "comment": "Malware payload", "value": "534f5612954db99c86baa67ef51a3ad88bc21735bce7bb591afa8a4317c35433", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "NineRAT", "colour": "#C296AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472779, "uuid": "065ff66a-7b84-495e-9fa9-64d7fd4e95fd", "comment": "Malware payload", "value": "be49443603068d9913b4634126749217df6a695e", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "NineRAT", "colour": "#C296AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472779, "uuid": "eb98c123-cc8a-4ccf-8c64-2e90ac2429f6", "comment": "Malware payload", "value": "76f8f4bab0af92d569817cc0254ef1c4c5dca52d45458b45a16068c62afe022614743a3c226f8bd6ac06826deba205a4", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false }, { "name": "NineRAT", "colour": "#C296AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472779, "uuid": "19990c81-9046-4ef1-a95f-e5af4b145fb2", "value": "T1838633DB723530EAF47AA078C29F5902D3B634B089A32BAB1BA1075B5E5DBC05D2D711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472779, "uuid": "15e0ea76-e316-4601-9019-999df28f0e49", "value": "92b8e9dea06fd5719e29a510e95b92ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472779, "uuid": "3c82f65d-4340-4e33-9635-af45589bf589", "value": "196608:Fu/iaU3H7LqvJcDzRzI+cSjmcdVbiNHNqorr2e2OP1XmXL7A/oNb:OjU3H/oapjdpYtqoTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702472779, "uuid": "10593a76-1531-4ba2-ad54-0db059ee5f5d", "value": 8459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702472779, "uuid": "0550fa88-424a-4281-86fe-96f4ac7b0903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472779, "uuid": "017ddb45-6271-45e3-9a21-e96d2eecd99e", "value": "96d98c83daf368066efe3dd41a0dc622.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ac7f96-9965-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1702437348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702437348, "uuid": "59fe0ba8-d648-4eec-9f40-1890c9cefbfc", "comment": "Malware payload (SnakeKeylogger)", "value": "66d02f025b9a9fd342b5ed709c309b0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702437348, "uuid": "66448f84-9fae-4ddd-a2ef-0064f41eb2fa", "comment": "Malware payload (SnakeKeylogger)", "value": "54c2f9f13b1dfcc142740e1839215c536f913a802681be17a38f47881057ebd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702437348, "uuid": "e329c7ab-f20c-4a81-ac86-bf1767563784", "comment": "Malware payload (SnakeKeylogger)", "value": "dda1e2898d3d0d3f5e152aaffbcd744e0e078c3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702437348, "uuid": "89885b28-d717-4d5f-a33c-8a6f2538da31", "comment": "Malware payload (SnakeKeylogger)", "value": "9f53444f71850cb2a40518c9634ae126e83b99b60325eb4030cbaadc133c15ca15502d2ea7daf2542046d8240b22b157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702437348, "uuid": "346a100d-da70-4df1-9262-d593d72459be", "value": "T1FCF4913D19F92227F075C7A6DFE0C527B260A5EBB152AC24D8D243960707A4B79C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702437348, "uuid": "c4dfb822-9678-41a5-bc2c-997f0d4c1919", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702437348, "uuid": "e4e98621-4a74-480b-8100-bfa3be322838", "value": "12288:RMTtemknXYxMBmjRHeWv6Dhusn8JX41KWqwgYv:RYt9Mi/FJuKWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702437348, "uuid": "17a51989-858d-49fb-96e6-ec26384fe8f2", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702437348, "uuid": "e226efd1-071b-4a38-82be-ee99a89acdc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702437348, "uuid": "a8d85569-70f9-4bf8-979e-8966b934b685", "value": "SecuriteInfo.com.Trojan.Inject4.59820.16180.17265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54615be8-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480906, "uuid": "70710d86-8ada-4c3e-b715-fe2cbf550e4a", "comment": "Malware payload", "value": "bdb967ae25f87ab4b1a776d1c1ce42ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480906, "uuid": "667fbb69-42aa-4dbc-9e66-a40e7faad3a2", "comment": "Malware payload", "value": "550441e9f4c3230f6ba6fe28149f2c96b1906882f3757d228eebb62a2a8eef8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480906, "uuid": "84b8cd80-9bc4-40d8-adfa-912c79e491d3", "comment": "Malware payload", "value": "de71af3b0829615c76d3bb1787d49e9761d9d389", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480906, "uuid": "81187417-2113-414a-b3f1-3beffdb3e570", "comment": "Malware payload", "value": "715a3c16bcc011a924b2f6e7f7ddc426c30070ff87dfa0fe3b7a59b9f1a6a0ad61413def5c77166cf738aaa321908153", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480906, "uuid": "d9b21022-12b5-45b9-a11a-8575bbd2c2b2", "value": "T1BE457B86FB4280E0C54724F11A63AF397E7496573A308FAB17A7DD786F22721BD27118", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480906, "uuid": "b5d63dc4-9b54-4f30-9113-5b25c26c3026", "value": "6144:d8mwP9NlwmBxEcl8TW+wkXJV6toBpEsmTBFZACFnf3rEUStyTD+QjVeBJv4EXySW:dMEX4tosR94tyTDLjQbBKoq2UPO4Ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480906, "uuid": "ca3c586b-e402-449a-bc64-46e5af1dc3de", "value": 1200128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480906, "uuid": "1f10d354-1e61-4222-b1c9-f943cfeed474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480906, "uuid": "a03fe21d-03b6-4a46-b06b-973e2c230ef0", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1FX883P.23882.25677", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb48642-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480919, "uuid": "397c31ee-e1fd-491d-8777-046cd4b4a274", "comment": "Malware payload", "value": "39396afaa066833586662903487761f2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480919, "uuid": "4062eb8b-9c10-4b80-90b7-d7aafbf6786b", "comment": "Malware payload", "value": "55a7d34967643cac705a6ad2f9e5d7f755bf4c5297cb0f360a8ff3b30bd2fd1d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480919, "uuid": "24a02941-e6ae-42bf-a36b-5fa252e4849d", "comment": "Malware payload", "value": "7d4f8dbe81498182a52c724c77b63e22f5edb657", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480919, "uuid": "cd2f5fe1-a362-4fb5-a36d-c53b64b1e44e", "comment": "Malware payload", "value": "6ec61bc30efd967318e1048896cefb05658566a9375bb016fa8842e45de8f0dc5a3c22fab28f934e4fd34463e4f7baf5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480919, "uuid": "8c107601-59cf-4166-b47f-e1a462811a9d", "value": "T18964029B3859C0AAC04746759704C773BF3D5E438166922712FAF25C0C39EE59B2ADCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480919, "uuid": "9d5bb91c-8eac-403f-b2a3-3061551282f4", "value": "6144:01kCiJBBUnKAFMZMzV2qVJx9Y3kBlBOz1hPkoVsdVhacijUK:06C4AuZMzQqVH9YUB+zLZydV7gZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480919, "uuid": "65176f2a-6571-4647-95d0-f819db8c58cd", "value": 331716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480919, "uuid": "d8443c42-e98a-45f1-9fd5-24eb15b04b59", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480919, "uuid": "ed54e9f7-3920-4cf3-a191-e1ddcb0c6872", "value": "SecuriteInfo.com.Java.Siggen.525.6092.9900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094e4808-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702470902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470902, "uuid": "c3b89a2b-bf23-4504-bd08-99330c3edc42", "comment": "Malware payload", "value": "e57eccea23815d1ebfa0d4d8a80751ec", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470902, "uuid": "35fee6a3-86c7-4a05-89d9-9efc00523d29", "comment": "Malware payload", "value": "569a5e3fabb16ca356041ce8262346a70812a93caf8b8850f261855680f0bbed", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470902, "uuid": "92953229-e59b-4e91-9f13-55317d66ccfe", "comment": "Malware payload", "value": "f37cfca77b4bc238de17a93253bb64a4bfdbf6d2", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470902, "uuid": "313ba957-8fdf-4bce-88a0-a809c515c085", "comment": "Malware payload", "value": "e489253ac8f33f0641ba774ba9df2f253447db9f92afd75b67dbe7fb066c8c089b49ec8d00bf961c85e0bb6003576fa4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470902, "uuid": "f479cd1a-ad52-483f-ba02-17038b6e8d91", "value": "T1D0D433402597DD2AC313D5D2289AB4A575F1F098AD8B4AC4909BEFD2117CBB8372DD0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470902, "uuid": "a1ec7ff1-6dd4-4626-89af-c251727c78ec", "value": "12288:Q3DHJrt4rgsPd0se/+dtfszZWj71R7tdFwdfCx/J70hL/Z61:oHpt48sPd0FEszZCwfsJIhLBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470902, "uuid": "f549d022-b656-4328-973f-8e1a37c07c78", "value": 618341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470902, "uuid": "b0d81a4c-08ad-4012-96d1-f9f9423ac472", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470902, "uuid": "665ce1aa-6d9a-46b7-8aa0-e4129d3f095f", "value": "New Order4891.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35f8d58-9968-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702438519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702438519, "uuid": "53382e68-9700-416b-9e06-5d3e67824f35", "comment": "Malware payload (LummaStealer)", "value": "fd04b19410db7662db23fc10fb0de618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702438519, "uuid": "97ac71ac-11b2-44d8-b07a-52380e9443cf", "comment": "Malware payload (LummaStealer)", "value": "56b8de1a461b0ad592384bef98aaa5637efae7c6aa118e0426080e13764cd12f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702438519, "uuid": "6de61666-85bc-4886-9e67-59d4c95e9a37", "comment": "Malware payload (LummaStealer)", "value": "c56627f8c63cc72b4c5d826f2592cac77763dcdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702438519, "uuid": "50336d4f-8c43-4292-9911-508d06d0dd93", "comment": "Malware payload (LummaStealer)", "value": "d230bb0c10a9c3957d6cc23ba2f1ba285e3d8012c4de496f7e1838c820f71b48d875502064341865cfb890073c676b75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702438519, "uuid": "19609ae7-3aa4-4f16-87a6-9976d9b73f43", "value": "T12B75239272E05531CCB42F3454F212A3173A7DB1E9F882AB7A54A81F18B35C4AD3676F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702438519, "uuid": "ce266db1-d5e5-4a73-97a4-7671618f93e1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702438519, "uuid": "39abd9d0-f315-4190-b642-e596df9e8e2b", "value": "24576:Ly2vUWNA6o4njyfXnV3hrc9qDz7eM6N3Eo7EZAUHXUA5GSZRlaGQ8ICXpOHlLOcM:+uUWNbnjy/nVWkDz756N3nE7HkA5GK6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702438519, "uuid": "cff91c4b-2670-4e92-8368-ae0200dbb6ea", "value": 1569792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702438519, "uuid": "d81fbd14-2a4a-4f40-ba2b-15f45e4ea60f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702438519, "uuid": "60dec394-3dba-4c6a-9f1f-96943fea7c13", "value": "fd04b19410db7662db23fc10fb0de618.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e080b8-9955-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702430181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702430181, "uuid": "32703847-9457-415a-9eb7-a46f9991b74e", "comment": "Malware payload (AgentTesla)", "value": "d39bc082d7c96e1f278218a4a928f135", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702430181, "uuid": "8d351d92-ff4c-4d66-b92b-ec3a7778ef92", "comment": "Malware payload (AgentTesla)", "value": "56c37c9c86a5ee6ee007a087502b7068ae2917f90bba5c0d6cd639087164da77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702430181, "uuid": "a066b079-5760-4a93-bd1b-179f80b8c6a5", "comment": "Malware payload (AgentTesla)", "value": "8246c4f087ed74204590c605225c6b041fadb92b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702430181, "uuid": "c4564aae-4e11-4b29-b31b-6832d13eb8d9", "comment": "Malware payload (AgentTesla)", "value": "f7bb8975d19ca7898984ee3ae8faadbace4452287442c3d4b9ecd18763868e6f18aace60258fd6626f5af9cea39407ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702430181, "uuid": "4ef7ce97-a0af-4a23-aeef-d8d699d5eed4", "value": "T104E4E00433AA6AA7D73904F90C0160510BF225DBEDDEE7F94DC6B0D79EE5BC5698082B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702430181, "uuid": "2f9d1cda-3e93-477d-bc29-04e14d8dc946", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702430181, "uuid": "37b19ca2-d49d-4612-9928-d15be05249e7", "value": "12288:AMCAr4SFhIZwVAuPhthmjFtft5tYbDgdzvcHrr3eg4Etwk2B4qcYE/66KXaCVUaK:LH9hta/+bcd7aOLDk2BX+hKXaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702430181, "uuid": "a75a206a-206a-442f-bc8a-7d858c010606", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702430181, "uuid": "cb3a57f2-95d7-4ddd-baba-e8445fae5543", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702430181, "uuid": "1c9a734d-ecff-4893-bee9-86f1e00811fb", "value": "SecuriteInfo.com.Win32.PWSX-gen.15152.2326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d2fa25-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480852, "uuid": "85799d03-3e30-40d0-bf67-d6593b1d6928", "comment": "Malware payload", "value": "83e9ea20a4fe92bc0a48614c8cae804d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480852, "uuid": "bcc5e6d9-8a06-4dea-bac7-45c28facdc95", "comment": "Malware payload", "value": "588dc0164ade065a35155b46a8dba4404bcf40a0616388656b87ef840b36c707", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480852, "uuid": "4446aa0d-bdee-4981-ac45-361337769e42", "comment": "Malware payload", "value": "f65f06a2578edfa8d493f2852b079421c57c6256", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480852, "uuid": "4b62c8b0-d9c8-472f-a818-51c89905a3a8", "comment": "Malware payload", "value": "9350ec6648070fc6b8431e1a1f13c17d87b2c4a444cfce9e84c22348ec5b548422b478a690f9e1064262cf91cb73e81f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480852, "uuid": "a901af1f-85e4-46d6-ba6e-bcf40ffcade8", "value": "T16C469D379E1D5CCDE90124719C568FDA2964AC20B5086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480852, "uuid": "a0724faa-c452-4b67-9607-25dd66878c68", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480852, "uuid": "1c6f4a1b-06da-484a-b5a9-651e82527cc8", "value": "98304:uhwa9gabfe9p0jwEW5gflchuqT3FOQxdp+mgulfa2FMIRavYBJS:uB9gCW9+5Wqflqu+Xxdp+mgulfa2FMIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480852, "uuid": "f977c4e7-3505-49e4-93fc-aea553909fdb", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480852, "uuid": "1b8a9b0d-c0a8-4c3a-9949-1effa19eff3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480852, "uuid": "b99a1e47-4d1c-4a7c-9349-51407b4c1253", "value": "SecuriteInfo.com.Trojan.Crypt.6871.4891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7dc063a-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702471275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471275, "uuid": "dfdc3204-af4c-4249-b249-e37df4ab0de5", "comment": "Malware payload", "value": "4738c178d867a9733ce6892a630b047c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471275, "uuid": "9f3a528c-0efe-46b0-b0cf-04ebcd12ec1d", "comment": "Malware payload", "value": "59f151f62d6f75257308ec5d55282909ae6a743552fefc9d35f0eecca4aff934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471275, "uuid": "642f63e4-24e6-4414-986c-0e192752f9fb", "comment": "Malware payload", "value": "6d1e23f12a3482a173f0b6ed8c4216e29b11e3ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471275, "uuid": "d7c04e05-2573-4e34-86df-1d7dc2149ea3", "comment": "Malware payload", "value": "054302a7305d759f1ef089ec5a137884c022890408b3d0a78ab4f03b7df7ac8b203d61e2426f12ddcbec5be3b3f7549e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471275, "uuid": "e7193426-b477-4c0d-9918-62861a19dd8f", "value": "T10B83AF499B1E84D2DDD96ABCD877AF260F52ED239063C9CA614432278D22353403FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471275, "uuid": "fb17b3df-baae-4fee-95bf-3782971e59d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471275, "uuid": "b695ef7c-bc91-401e-8289-ee5821fb069a", "value": "1536:bsN4X//4ugmZbLH45oJA+XiPFM3CEF/7GmqbMY7usiY9hka:u4X//4ALe3C7GmCMY7pdka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471275, "uuid": "1a6f58e7-8a1c-403f-a549-a7dee2d6e9b1", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471275, "uuid": "cdc980ac-6b2b-402f-8410-114583e5640d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471275, "uuid": "79246828-8583-4f7e-bc8f-79ed09f74f34", "value": "MKN09998.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03878a43-99b9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702473040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702473040, "uuid": "5b37e7ed-c11e-4c36-9592-81dfeb390e81", "comment": "Malware payload (AgentTesla)", "value": "6c749152462833fef098eb249c05abbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702473040, "uuid": "76e0c46d-1007-452c-833b-05c47bc40c80", "comment": "Malware payload (AgentTesla)", "value": "5c3a1a44e8f69e87acc9b95aa6798fcecbc33dc8f11a96b89bea796236887f92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702473040, "uuid": "5a714f32-09a4-4ead-bdfa-690f472ce071", "comment": "Malware payload (AgentTesla)", "value": "e18a6ffd6b6b3a5b9feb697a553d28726651916b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702473040, "uuid": "943549a7-70e8-4568-9c11-a156f6871843", "comment": "Malware payload (AgentTesla)", "value": "7c4235946a76553e853ffa4cf277258e65be7800868c0b4961c0a9317b0323c1e77e9e0259ca8c88ed8492eebb424c78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702473040, "uuid": "94dcf1e9-4cf1-4577-b910-66077c8cc3b5", "value": "T16015B23D19F92227F175C3A6DFE0C527B260A5EBB052AC24D8D243964707A4B79C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702473040, "uuid": "7545eba8-cbcb-476f-8d47-7ce0ec397237", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702473040, "uuid": "dc3857e1-6e72-4004-a390-e2d537bcb809", "value": "12288:RRnpttUALzX6E86DAT0Ys8JcyeP3XqboXx5NJAs9KyZcpZRh6+OKvu:RXttUAqX6DATkucKUlJ99KyMh6Ou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702473040, "uuid": "9596834b-8c31-4954-ad9a-f8b94c1c01e6", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702473040, "uuid": "2dac0867-bb7f-423d-9253-772cb947546b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702473040, "uuid": "2b7cd615-a49d-40c7-8833-015f07234ba2", "value": "Order 20200703 & 20200704.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4723fb5-99b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702469874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469874, "uuid": "305d8fa0-a236-406a-bcee-3a87ff96dce8", "comment": "Malware payload", "value": "147b2c81dfb73be4a6b2d6776413ec60", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469874, "uuid": "be4cf9a3-7763-4978-a132-24dc339846e6", "comment": "Malware payload", "value": "5e003b2fed76dc08838f58d7c8e92fa998bc2ab2836e652e3a7ef60a549961b9", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469874, "uuid": "a95290cf-695c-4fb2-93c1-fd5de7c3ae9a", "comment": "Malware payload", "value": "5f906c6aec5fa34daee3ec60af673c8e7078a59d", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469874, "uuid": "9dbc9799-339e-4f25-ada4-5b31498307bb", "comment": "Malware payload", "value": "c6d0b77be0c8ee4e42159eb84a4db2a469386cdba01772e52bcdb358b03b5d732dd3b482d50408c4622ed867767dcfcc", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469874, "uuid": "0565645e-0f9e-451f-8fe8-94c40f2ad966", "value": "T1F1D41201B195ED1FCD2B9874889FB4EA521EEC895F08C38771DA374E40716F2826B7E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469874, "uuid": "af092ed4-8b7c-4c87-99ee-67fba14b27c9", "value": "12288:fMe0yk3GLXJz8Jn6pa/SHEIR01GjKRdUFC7Pz28c0sJIs:fMeoeXJAJ6pa/SvR2GjouF8hcxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469874, "uuid": "476e9b64-5191-4212-82bb-ef45bd172e05", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469874, "uuid": "7550667e-76b0-4d76-bd09-382dd5e2f24c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469874, "uuid": "5acc26bf-70c9-45eb-9641-572267bb35c1", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48554096-99ec-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702495059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495059, "uuid": "f8ad5b44-da75-4e26-ab29-80409e8e83be", "comment": "Malware payload (Mirai)", "value": "abfd9e9d8d9d75312d844955bb034936", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495059, "uuid": "98562d7c-f67c-424a-baca-a2e5975905a0", "comment": "Malware payload (Mirai)", "value": "5e761856ed27cf2a240d4725d4231d945d4101e328351e7e5f2251157ecb4f69", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495059, "uuid": "cc9329aa-a2af-4533-b157-b2bc94149cc4", "comment": "Malware payload (Mirai)", "value": "2f6c1b0b9768d3de10088c0113f4e274c51eb3e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495059, "uuid": "6b2fc25e-bd89-4d72-8701-332d7e65e32b", "comment": "Malware payload (Mirai)", "value": "313c89ba9582470352e3f7b08becb8dbb43e468d99ea9ad304be809b26d79792f35b2792e66f20090cfcd3b1cd711662", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495059, "uuid": "e21abce7-862c-4243-b073-fe3f3cbfc516", "value": "T171632885BC819613C6D4527BFB6E028D372613A8D2EE3203DD266F1037CA96F0E77656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495059, "uuid": "82af8630-ea29-44f9-b6b2-f8248ed4dba7", "value": "1536:u3rbwdgSXI0IoicmSU3OhyvJW5oF2cFvXal:4rE/+N3Ohyv3nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702495059, "uuid": "706b90b6-4761-46e5-845a-c6c1d41b0775", "value": 70992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702495059, "uuid": "26b7c1c2-a645-4e08-af2c-dc8186cfeb8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495059, "uuid": "16426256-7a02-47f3-9680-4c9a221de9fd", "value": "arm4-20231213-1917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd80c9b3-9961-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702435556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435556, "uuid": "3c6d2e8d-6dc9-4d02-8cc2-a46c1aeafd2e", "comment": "Malware payload (Mirai)", "value": "2c3dd34950dfa7c22c7ef192ce363d30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435556, "uuid": "a80dad4d-36e8-4453-a89f-4d8c87e08d1d", "comment": "Malware payload (Mirai)", "value": "5ebd43fab96aa2e7cf76e201d8a33ccded8044e63c21c984eee6f7ea49cfbc25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435556, "uuid": "c92b5431-e725-4e00-9356-b251d71b688f", "comment": "Malware payload (Mirai)", "value": "aa0e674e60517f7a8c233284d36ae46b65b06b0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435556, "uuid": "cce19a2c-8386-457c-8b8b-7f4db0fd5240", "comment": "Malware payload (Mirai)", "value": "896b653dbbfc0f169d67b18c8d662227b27e9b304db6ebfb81d55c5365815301831b8f81644f23f7e953fb1a6c5cc730", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435556, "uuid": "9d1c8c73-38ab-484a-96cb-6f28c4a7f420", "value": "T12FC35D46EB408E13C4D51775BA9F424A3323E755E3DB33068918AFB43F86BAE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435556, "uuid": "47ae1646-1590-47b3-bd2e-5ec85e72651d", "value": "3072:ZyxVZcrPR3bTnle1cJwmalEbr+eL4M/9naz:ZyxwrJ3bjle1cJwdlu+e8M/9az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702435556, "uuid": "4a8a66dd-f41f-46e9-9e95-81f13e45f0fc", "value": 125738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702435556, "uuid": "43af3235-adc2-4ab6-bb82-43b8935ad5a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435556, "uuid": "b01e327e-bb88-4335-a196-3c66633a8cab", "value": "2c3dd34950dfa7c22c7ef192ce363d30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a4aede-99c2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702477061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702477061, "uuid": "78da3e6d-2be8-4e1b-8fc7-8c269991a4f5", "comment": "Malware payload (Formbook)", "value": "abc65b295d5f93f85bd82039c07612ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702477061, "uuid": "732266f6-e734-46b0-b6d0-834d90482557", "comment": "Malware payload (Formbook)", "value": "5f57b5c744e41b5c38156bf87ee5fe41aa73428412e336930aab45c463164e73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702477061, "uuid": "cf3ad65d-993b-4d3f-8e35-a7e24c53fa9c", "comment": "Malware payload (Formbook)", "value": "bc6e2231362e6762dec1abc43f6bfb53f500a923", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702477061, "uuid": "2fab38cd-f490-4e79-8198-9cd885649011", "comment": "Malware payload (Formbook)", "value": "5dab7f4541460d30ccb58455539552a2599fc58ed11639c104a286530c59485a7596cbf0478e211426acc9052a5c15a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702477061, "uuid": "5d0b4502-d4f8-4494-9dcf-ab7c1cf807ad", "value": "T118A37B137AD2C475E4A347360DA88A100A3FFD625EB08D9B77C8168E2E742D05E76B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702477061, "uuid": "59bcfc6f-fc77-4596-b2bb-beb62644fc8c", "value": "a2b237a3d4044533f93cc953b769baf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702477061, "uuid": "0b35c1c1-4db9-4498-85b0-953dad1bd2f0", "value": "1536:FIn8rnqpsh5MhzF/e36c+1coOXKPzKs8jcdsqVsOVijduPy0WnUbXQ+EA8Y2HwOW:qnOGsTyFc+ROXKPzPsqVssUuK9ON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702477061, "uuid": "eb271542-3bed-4277-a181-24905c7f027c", "value": 100864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702477061, "uuid": "d8a15b56-41ce-4f00-9873-7c2ba3b9b6d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702477061, "uuid": "4ce04ac2-db22-4248-8381-e67ba4d8138b", "value": "SecuriteInfo.com.Win32.TrojanX-gen.12307.30346", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6801f09-9998-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702459220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702459220, "uuid": "9dc71611-cef6-4805-88b2-65929635d486", "comment": "Malware payload (LummaStealer)", "value": "6163b5954dc5244d55d0036e6038b59e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702459220, "uuid": "770e36f9-1a0a-471c-91cc-08791af4c029", "comment": "Malware payload (LummaStealer)", "value": "5f57e85e2eba8616976591ec6e3a4db172c1687a2c875c5b3ae10067867fbcbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702459220, "uuid": "9ef29242-5e01-42aa-b487-f0a6ea935474", "comment": "Malware payload (LummaStealer)", "value": "9eee6174fa8c2b7c1e8793ff521154183a3fa7ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702459220, "uuid": "6b77f3a9-cc66-49ed-89e3-52d932e15cee", "comment": "Malware payload (LummaStealer)", "value": "9e3bf3942165c42a4e3273bd9641e0ffb173b74be6efb2e2133a1f342e7f3008c2e1057604689588112ccd5a315b9717", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702459220, "uuid": "5fef76a4-314d-4aee-8224-e70933687090", "value": "T17E75230273F8417BCCB62FB158F712C34A3ABD688AB847AF2256944A44A35C47D7179F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702459220, "uuid": "fabfb4fc-c52d-49ef-b361-3a95a66f2a2f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702459220, "uuid": "ec4d8ebf-e0b9-4076-80d6-017d517d61a1", "value": "24576:eyvxfvNpxKdfTnV3vrc9vUTbPc1DBCW7NkXDEHEEUdKRlENB4qDyDKTfFL0:tZfvNpxKd7nVQNUTbPcVBCW7NysUdK2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702459220, "uuid": "8405cf35-3102-4fb0-b618-09effda412b1", "value": 1571328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702459220, "uuid": "4556b4e0-a754-46fd-9071-adca285fe923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702459220, "uuid": "15b57052-e489-451b-89fc-dfb450a2d8a8", "value": "6163b5954dc5244d55d0036e6038b59e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa35741-99c8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702479529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479529, "uuid": "345137ff-7950-4b0f-8f83-3dd9eb24a353", "comment": "Malware payload", "value": "f5f38933d5da3d248117d14fa068c3c0", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479529, "uuid": "7ce0dada-840c-4cf2-99cf-0faabd75d733", "comment": "Malware payload", "value": "5fa94e852853df80edbfeb591125f17e8c94930e0e702afd16d71be03a6c773b", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479529, "uuid": "3cc127ee-3a76-497c-b319-42062078f0b6", "comment": "Malware payload", "value": "3c65ff0e1fc078bc0bb94b1720890821c0277ff3", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479529, "uuid": "f2474ff7-dc1e-4ade-b7bb-46d46ecdb354", "comment": "Malware payload", "value": "d7cd3e387c5fd4802d5eff9fd3b8db37b905d76abf5cd178ed03c0ec3a5dba31e95a0e70bca2bdaec2ccd6a99983f84a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479529, "uuid": "145d01e7-48dc-43d5-9a90-916f16a15b5d", "value": "T1E0B48E19B7AC42B4E167E178C887464BE7B1785A1361978F43F186BA1F377B11A3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479529, "uuid": "6b21ad62-b1a8-472f-8b9c-2a7189d52fe2", "value": "933845791298c9d8ede1aea51727ac24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479529, "uuid": "0e57ef64-86da-4a49-83f9-e66ffa73cbdf", "value": "12288:6FVVFudNrPZKRJSvhi8K8vOIBO4PPORqobPZHTVABP:qxuZKcK8vu4PPORqsRVSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702479529, "uuid": "5060977a-ef78-4631-aa6e-e25ca20a50e1", "value": 496640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702479529, "uuid": "03257e8f-a8b1-48c6-a533-deae769ec6d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479529, "uuid": "09f5d3cc-e6bf-460a-a377-10f6a9528836", "value": "legacy_l1.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebfd855f-99ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1702468705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468705, "uuid": "89e802d2-6669-4655-8794-dc90d3182822", "comment": "Malware payload (AZORult)", "value": "cd96e917be091bfbed93e39256bfa4b2", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468705, "uuid": "fd85a523-734b-467b-8df3-8a14862f531c", "comment": "Malware payload (AZORult)", "value": "5fd1de4469b00be105721b7283d0782ed421d32c27a68b9d5f6964a76d7d14a3", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468705, "uuid": "45233c4b-84b1-40ae-9b51-81810b5753e6", "comment": "Malware payload (AZORult)", "value": "554a11b45bb61b9e2ddfaea6acca9eccbeef1f7d", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468705, "uuid": "2dd47ab1-c083-46b6-a538-4ff68821f358", "comment": "Malware payload (AZORult)", "value": "5b798d9d6847be3644ccec7fd0f74602994d2cb8f3f393db515879c2ab47b8b0ad4c6bf88809f72731dc222e5a874ad4", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468705, "uuid": "c20c1cdc-cfbb-402a-9f5b-3c43a5e3839e", "value": "T1451533A09F50B27BD673473C4C72BA674EA98B40D4364E7A13A5B838348EB55E71F243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468705, "uuid": "ddd915d1-28ef-4541-a7d8-43c7f1ea058a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468705, "uuid": "ad32961a-6c08-4cd7-8405-94a53abcda55", "value": "12288:s7cRm/LNNp0OUsU8FczchdrDFTEyIlDRhXTOfXs7hOJvZFq7FDdTNF0x/YeGM+4D:s7xNNp0O3hIbhDjoJfMpxXM+u7vR/k4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702468705, "uuid": "645c92fb-cf2f-46ce-bcdd-bf438ac97bec", "value": 892992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702468705, "uuid": "97f7af73-6be6-400a-8d70-cda92c1bbd42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468705, "uuid": "040fb012-2827-4d23-a995-94ed69ebeb93", "value": "2023 Ekstreniz.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86053e5-9991-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702456217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702456217, "uuid": "859715c0-9ade-4e15-a2ee-3383f276ba28", "comment": "Malware payload (LummaStealer)", "value": "18e049c5a3c8ce90ffb6eab02088359b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702456217, "uuid": "05d580be-400d-48c8-882f-9f43e6756481", "comment": "Malware payload (LummaStealer)", "value": "60b2187fb7db90cc596f9ab3eb852ef99e5d8a53467b552440282d02df5b18b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702456217, "uuid": "aefeb360-639f-4ecf-ab57-4cd1d130feab", "comment": "Malware payload (LummaStealer)", "value": "1fc18ab2c6006441e551f635d42e884e02f6c7a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702456217, "uuid": "82e5e8fd-31bb-4f43-b917-0d3471cdbbc5", "comment": "Malware payload (LummaStealer)", "value": "4784abf22c09818969beb53cf09aedb28b2eee7ce7c2ed78ffe11535bba154c799875720e5dfe548e1cee3fb34e21268", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702456217, "uuid": "3f3dd6c8-e14f-44d6-b2c3-4f3dc1622221", "value": "T15D752383F9D8EA75CCB6AF7148FA13431A31BFA18D70436B759A449648B3980BD30767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702456217, "uuid": "d0ed21ef-85b6-4397-ab34-fd31c28d1579", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702456217, "uuid": "c4a5a25d-4de6-443d-aa94-292eba3da558", "value": "24576:LyWCwmS2ffnV3Zrc93vX+cTsOFCeMiNv7uFAdKjHymHCjvPF:+nw+HnVOdvXXTs2DMi18FHymij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702456217, "uuid": "9b738314-644e-4c5f-b833-a69db6851e8e", "value": 1571840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702456217, "uuid": "c5cefc17-0336-40d0-bb75-d313c33407f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702456217, "uuid": "a84a35b9-b532-44a6-bf27-3579b9337064", "value": "18e049c5a3c8ce90ffb6eab02088359b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e5b7b3-9961-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702435542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435542, "uuid": "0da16d6f-33b8-4b93-add0-ea57a78f8673", "comment": "Malware payload (Mirai)", "value": "a0e41935e4d788e8120b7d645ceb4449", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435542, "uuid": "46e778cc-999c-4ca6-a317-9a2df068f1be", "comment": "Malware payload (Mirai)", "value": "60f339960e259c7b426ecf3cfd61d53b289db123a20b6d01071edc662a09505c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435542, "uuid": "820739cf-e9da-4746-b281-ca892fc82ae8", "comment": "Malware payload (Mirai)", "value": "8d7598aa523e75e6206cc12fad0a46f91e135da4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435542, "uuid": "7a5eb943-720e-4060-9b36-3880b4e18a83", "comment": "Malware payload (Mirai)", "value": "7fb74f8f66f764c0b406a35072c01b780b56478ced15289af5d2d573995ee6d88f6e31dadc5da35cb1cc03ac1f70a651", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435542, "uuid": "0f11f435-3832-4c7d-89a5-8fdd3867aaa1", "value": "T1BB235CC9A587D9F8FC060A742172EF326B76F93F1018EE87C7959933D942702E10A5AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435542, "uuid": "0c7a195c-6ce8-46cd-a149-65e3408b05f4", "value": "768:53sPWVrWy7PBIedilokjF3dMh80otXz9lxKU1dE1AaIKNFYim6GlM:/D9I8ilokjF3dMu0i9LKgdESDKrrm6CM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702435542, "uuid": "081fcebf-e971-43db-b5fb-872dc9a528a6", "value": 47024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702435542, "uuid": "353637b0-3cd4-49c1-90ea-d0f18a66248e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435542, "uuid": "fe5181dc-58db-4fe2-8ffb-31e347fa6e95", "value": "a0e41935e4d788e8120b7d645ceb4449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2d2ddd-99aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702466724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466724, "uuid": "b89272d1-4e50-4c54-b357-0ee2e1a449cd", "comment": "Malware payload (RemcosRAT)", "value": "e05fb8774765ed36cf42c340e52e23da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466724, "uuid": "843c81a3-7a8b-4ae7-ba46-3ad161a7e53c", "comment": "Malware payload (RemcosRAT)", "value": "61ab894e68dcc97a0625f69f6f70305a57d653f9cad34b9ed2c3d206b9a345c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466724, "uuid": "25c82772-1f74-4ec7-9e4c-0e6bb25bddfa", "comment": "Malware payload (RemcosRAT)", "value": "703d9908a0b2784ba6e8875bfb010d52e19b4ef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466724, "uuid": "912954ff-202c-4ba6-bb08-cbebcc157033", "comment": "Malware payload (RemcosRAT)", "value": "53a9b85763acf19a0bd0522af34e54bc8c812760879d4025504814c6d41f6f04e34edb574cef4536653e65ff1ff872f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466724, "uuid": "0f828ba2-a97f-4501-8029-95a556c697e3", "value": "T13535D003B77249A2D7865736D6A746440372F5EA52DBD70F72CB263B210B3ABDE91203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466724, "uuid": "60ea9996-0bf4-4925-9299-5f32e6ac9d41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466724, "uuid": "5e0700fe-bbbd-4124-8ff9-d33ef11b8a4d", "value": "24576:UJJAAZhc5ff9bNSNLvn6x1ohhERWY+YQnIHNc:qnZSF8NbONRN+YQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702466724, "uuid": "38f28b53-eca3-4037-9647-2d3cc15f9471", "value": 1079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702466724, "uuid": "2a234adc-0dbd-445d-919f-48a3a8d1a851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466724, "uuid": "997730ee-e09f-4dd7-ac60-f9de0478b8ae", "value": "Invoice_891979.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249bff7e-99fb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702501442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702501442, "uuid": "ac74d62a-1010-4abd-93e1-e255cc94d4d3", "comment": "Malware payload", "value": "98a082e95628b51307343581cfb7eac7", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702501442, "uuid": "7a0c6e77-895e-4bc6-baa5-97bdf667d4a1", "comment": "Malware payload", "value": "620d2bf14fe345eef618fdd1dac242b3a0bb65ccb75699fe00f7c671f2c1d869", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702501442, "uuid": "203a4d48-cfbe-4c06-b44f-25e3ae86bb6b", "comment": "Malware payload", "value": "d4411f70e0dcc2f88d74ae7251d51c6676075f6f", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702501442, "uuid": "eb8d301c-d852-43f9-8dd3-d9a13b7a5c5d", "comment": "Malware payload", "value": "d97cdc87deceb33fd7c792d12cbe4af1b28fa3b435f253b044bf5b762d67dc6bd919dbbf5b9eb78890f0a5711871f154", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702501442, "uuid": "97034065-f963-45e9-9578-f23d9742d9ad", "value": "T1FC3523E3629CC2FCDA0E92B3E411B06BF4B5B527E8D785D7836A030627709E4D7B6905", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702501442, "uuid": "342ee97a-680e-44d8-ab53-86e83f622694", "value": "d8a29983f144db73ef49e8715fd18c7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702501442, "uuid": "658d3675-2e40-4406-948c-ac4c6363fb6f", "value": "24576:J5nPhOKYC39U8ZZHgMQZP7TQVtCqKWLyVtpMQvG20gF:JpJOe283wP7UnCqKhYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702501442, "uuid": "8bc21b73-6138-4114-8a67-a7391a89bdc1", "value": 1125888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702501442, "uuid": "87fd3048-83e8-4ee4-8c59-65c16b955a88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702501442, "uuid": "52c70952-6684-4410-9be7-d7b5259914e6", "value": "WinHandleMemory.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49657b6c-99ed-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702495491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495491, "uuid": "8e1115ae-2b43-4f41-9dc1-131e0e8c99c9", "comment": "Malware payload (Mirai)", "value": "861d03dd18c8b48ee46b54bb9854e977", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495491, "uuid": "9f414066-9631-4e41-9fb9-fb6c2ea1953e", "comment": "Malware payload (Mirai)", "value": "63d65f0f43c289ec69b62f6dda73001e10850fa44f0826ef9fa4576df013e7a4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495491, "uuid": "08350e86-8320-4bcc-81ba-49534d76770b", "comment": "Malware payload (Mirai)", "value": "45f16165c0c6cceb229d69711974821f782ed4ab", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495491, "uuid": "6d5f8987-0409-4be7-9ed0-d86167af86fd", "comment": "Malware payload (Mirai)", "value": "67c59790b596eeb308e82ad2ed02a1c44e74d50f284b1cd739d7690cf4b92e148b9cb89d982e46a21bfe22cd099b6c67", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495491, "uuid": "0d5d1dc8-5218-4ddd-9bd7-16b2ac2c1057", "value": "T174E33A56EA414B13C0D61779BAEF42453323A7A493DB730699287FF43F8279E0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495491, "uuid": "d721ce34-1309-43b3-b57e-aaf695b4f5b2", "value": "3072:emAu6aN0u5r0uB4XfShF6M1J+H0mM/9jLrMG:em6aN0u5r0uSXIf1J+HJM/9HrMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702495491, "uuid": "a088c03a-6274-4705-852f-cdd329e62395", "value": 143236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702495491, "uuid": "88c06dda-8489-40fa-931c-ebf860b5facf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495491, "uuid": "9d972aa1-344f-4d93-8920-bb2bf76bfcf4", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2620f2b4-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480829, "uuid": "4fd7b1cc-a416-4251-9e3f-544594165a8b", "comment": "Malware payload", "value": "05270bd9949b18712bc6cb6764b8f812", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480829, "uuid": "50319d30-64fc-4013-bcca-d3196a643201", "comment": "Malware payload", "value": "6405aaee8097366c8fa43d3a6cb4401e9b94590421adcafce523fbec45846fcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480829, "uuid": "9932eb7d-b88d-406c-8af2-457593d160ea", "comment": "Malware payload", "value": "eba3282480e93d16414f30422fbe7bc0518683a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480829, "uuid": "b21761a3-c75c-49bd-9cf3-4b8960f89874", "comment": "Malware payload", "value": "7cacb510bab258650c288169142cd262706bc0927f2d7391a9074b642471f30ea7cbc05b8e2f013d4b71b816ae4a1159", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480829, "uuid": "ef78eedd-b25f-424a-908f-2fb35d7ac62d", "value": "T1DA257E02FE9380F6C278223325A6777ABA71DB491E148FD3D3A4DE7D6C325505A3721A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480829, "uuid": "ade91349-0da0-4d6f-a8cf-ac28bfb18069", "value": "12288:VqQKCjpugMW/NXzcX5+KYAH0vfuRIMcsEcbLm2L:VqQKspugMNoKvH03uRIPsZLm2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480829, "uuid": "f17ee9e3-7476-492f-ac51-04da6792ec7e", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480829, "uuid": "b5c91d56-1817-4d75-b8bf-f89143e02819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480829, "uuid": "eec9a4a7-c17c-4dfd-a70c-331bcdd2e816", "value": "SecuriteInfo.com.Variant.Adware.Symmi.11285.15351.26080", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4926ea7b-99aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702466714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466714, "uuid": "a9213383-fb9d-4c6f-8fbe-760a3afc5c83", "comment": "Malware payload (Formbook)", "value": "5862139d33ed1b410a121a0d659a953e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466714, "uuid": "0d3f9191-20ac-40a1-bfde-9f1e569a5b67", "comment": "Malware payload (Formbook)", "value": "659278631baad8629c38cb213bf64ab7aee1db70f22ca5c94457379fbe57211e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466714, "uuid": "2277bd88-e22c-43b4-943e-23865533ad40", "comment": "Malware payload (Formbook)", "value": "dead253fb3f998ed24829260bf8095e9998c98b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466714, "uuid": "4a362ed2-da73-4669-bb62-2c96ac777f3b", "comment": "Malware payload (Formbook)", "value": "dac5b191a9b1ac2900243ec31f695ff3a00ba5cb7e7dc9999ebd97c9270ba112a382b5cac8d7f98b23c6a936ad439560", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466714, "uuid": "2a716876-e451-441d-a713-f09a15fc8ead", "value": "T185E423003765710FDD7A16F68822726913B07E2956B7FBDCDDC2B1D902E6B904B832A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466714, "uuid": "f74950e6-2d5c-4594-884a-f804ee6c35b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466714, "uuid": "5b46ab6c-f232-4281-bd08-ced304684e96", "value": "12288:wk2+4WpAE+y7D+5Jm0Qk+p3iKALi7iof+26KhSZMesSrwhp1QFxjVmOPJ+:XpAEJ+z4kWuroGv5nwhnExjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702466714, "uuid": "1cb4b487-3ec9-4f33-864f-55bd14fa7f4b", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702466714, "uuid": "bdf55dcd-8d26-4c1e-a58d-74942e9fbe3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466714, "uuid": "fc162cdf-af66-4b86-95b1-c9013eef5026", "value": "CamScanner 12-12-2023 01.03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fb4afc-99aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702466739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466739, "uuid": "a7a7b046-37b1-49d5-8f0c-bc6a54fd0a1a", "comment": "Malware payload (AgentTesla)", "value": "c87f919f5ed76f758b5fb9f0ec5afb9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466739, "uuid": "48f0ec18-e034-4563-b7c3-275240ef6a0f", "comment": "Malware payload (AgentTesla)", "value": "6681d801b6a2b724e2fc31cef99d83bc1f594598dcc9345f219253be5be9d337", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466739, "uuid": "fda85068-31a7-49ea-9efc-882d9fb2d736", "comment": "Malware payload (AgentTesla)", "value": "85026bfb922b490010c88a7784d123dc058c6b88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466739, "uuid": "839d9a17-5601-45fc-896c-2278f7d5537a", "comment": "Malware payload (AgentTesla)", "value": "07ee12d860739c110e7849522fff38d76c057c0831e11987b233b48de40bffc906ef31cd40b8b0cb539ca3d485ce0671", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466739, "uuid": "9aae8026-0b3a-4688-a425-59e0445082fb", "value": "T150E42314732A861FF9BB037280A94B1527B8BC18B567F7DDBCD061DE2AD671247A2133", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466739, "uuid": "cb9e70ca-f739-481f-9c3b-5f2ba1cf7286", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466739, "uuid": "0cdb1c4a-846f-47a9-a74e-d1022d9641b0", "value": "12288:9hV4+4WpAEvyHhVs3MyB2F0h+qliU2H/IlRaQSUcZPaFv1XSBnt5FmuOgbzliXC+:vpAEU03MGlliU2QZSfZPKFE0uN/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702466739, "uuid": "b643c1e5-cd4c-4bb4-9e4c-5fc4fac9f7f0", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702466739, "uuid": "d65ef98b-afa1-49ae-818f-8139e8447271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466739, "uuid": "855109df-cc01-4e20-b8f4-01b7f18202ee", "value": "ORS16F7362A 8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab727d30-9961-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702435526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435526, "uuid": "06b6a73c-dc61-4b47-a6a0-17af874af9d4", "comment": "Malware payload (LummaStealer)", "value": "4f19dad06ea3f38e405559a2f7a7f7a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435526, "uuid": "59e773e2-68cd-44c6-a20b-fcdbb13f02d6", "comment": "Malware payload (LummaStealer)", "value": "67f6aa5c680b96907b75de39219afb903d747e4bb04ccb0667294f4f33722fc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435526, "uuid": "4e8e8d91-3b79-451f-92e1-2513bd6142c8", "comment": "Malware payload (LummaStealer)", "value": "297dbfa01b0bccfc1126d1690fab3bcd45fc6f25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435526, "uuid": "94cd0654-d17f-4898-8a19-80523678b616", "comment": "Malware payload (LummaStealer)", "value": "af8e34a4a6f617a2e3f56ef902ad51c5dc47129c0ec7d6a1dd3a71b05535e964e3ed7a41b75c99a8616be9beda41649f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435526, "uuid": "573cbd93-2a9d-4b0b-86de-1840acdce94a", "value": "T13E75234373D84072DC796B7A48B7278716727C52C8F053AB6A568D8E08339D8BE76327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435526, "uuid": "aa2e758e-8a7f-4caf-9d5a-d120d81d960c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435526, "uuid": "1b9ed5f0-9faa-434d-8a0b-454bab8a056f", "value": "24576:YyNNL2I+EufvnV3frc98G6pKMsVY58IiXaDyNNOL4LDuuDS8VawqFy4rXfk0S:fNN7+Eu3nVAuG6gM8Y5fiXZS4LLgy4rL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702435526, "uuid": "a3ead129-70fe-441b-b8ed-c2c1d0d25789", "value": 1568768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702435526, "uuid": "27158d31-1fdc-47c8-8fcf-63602c2227ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435526, "uuid": "270406c8-bf3e-4b00-85a0-328d3b9e2a77", "value": "4f19dad06ea3f38e405559a2f7a7f7a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4908196f-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480887, "uuid": "e6c2edb7-4a8d-469f-bec6-c437bbade8eb", "comment": "Malware payload", "value": "3338d3707710d2818de73577f1520287", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480887, "uuid": "c82a7295-8024-479d-90ca-458cad069a30", "comment": "Malware payload", "value": "680c26b8570a87add8062b0f37f6226effb2521470b89d7cceaaf4e3226b8ec2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480887, "uuid": "bfbcfe93-493c-41b6-905f-0e70e6a1d804", "comment": "Malware payload", "value": "8cf347c36c780721d73a32c1f819118fca055f04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480887, "uuid": "e7c1ec5d-eaf4-49ae-8265-5fb1adaf2490", "comment": "Malware payload", "value": "35eb85b31413dd7902c9edc5560402d4b8c51063460b2df07bd65bb721aec73d89c07b9db8a5c007758143d586381d53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480887, "uuid": "6b772086-2bd8-45d8-81db-6e9b401a2d5c", "value": "T1B0469C379E1D5CC9F80164719C1A8FDA2954AC21B5086B9B76C1B96DCCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480887, "uuid": "891ec3ae-e449-4784-a62e-0e3d2c125c4b", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480887, "uuid": "d2444545-6165-4d53-a8d1-f5e84ce7bd4f", "value": "98304:1A48b4Rjch4FzYPuzhge5shUqTg0OTM65eGwzVXq590IjPtGBkBi:10b4hK4dTzCe56Uh7M65eGwzVXq590Io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480887, "uuid": "f64937fb-06b1-420f-aa6b-55f1a2dcb69c", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480887, "uuid": "76e9972d-9796-44a9-aafa-47bb60a03bbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480887, "uuid": "6703c9f8-6a66-422d-b9fb-412b303a0943", "value": "SecuriteInfo.com.Trojan.Crypt.12943.3384", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ec40ce-99b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Sliver)", "timestamp": 1702470874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470874, "uuid": "7bf6ed8a-8c17-488f-bd44-df0bedca80fe", "comment": "Malware payload (Sliver)", "value": "a9c8d788fd8685970a386181c7982db0", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470874, "uuid": "80638132-5219-4844-9de2-8fd252e176fe", "comment": "Malware payload (Sliver)", "value": "688cae52f548ddba0e77ba67a08b76cccedd19fd0d841d55902d94130253b909", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470874, "uuid": "decce8de-bf0b-47ba-a75d-679b2ea7a791", "comment": "Malware payload (Sliver)", "value": "8565ecce87a859775b197f88f6bc7908177f03d4", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470874, "uuid": "f35290af-a44f-4624-8981-f5425cca94dc", "comment": "Malware payload (Sliver)", "value": "f461031d8d403200b67b4cb5aa6823a6a5ef0b22b0cd1ca73cd49df6fa3851ff3c5137a0ff96b0ec1765454e44c7c994", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470874, "uuid": "56ccff6f-54ba-4ab2-ad34-3a3083069ee9", "value": "T179C6AD09EEC5BF5BCD41A4FAD9A79166C78ED80A0780C753870DF6B339647280ADB6D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470874, "uuid": "939cf2ee-0b04-4358-92d5-f2dc61ec3371", "value": "bbf9e0f9f9900f01757b6fc0a21156c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470874, "uuid": "04d8d9d9-6af0-4a95-90ee-0b06a0d9bb48", "value": "196608:ugnEGYAXzuW1TWSUHmdVFoP+dtM9xW5qMOyBhMg7oSXaZ:XbzhTHiQtYoqLghtF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470874, "uuid": "6ef358ba-79b1-4571-ba3d-10ed165c51e4", "value": 12517888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470874, "uuid": "3fb539a8-4a8b-4258-ac4d-737ce048cbed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470874, "uuid": "a2291927-e5d1-47ed-a94d-c8668bfcc581", "value": "explorer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f072db-996a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702439489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702439489, "uuid": "a6ec1b1f-dabe-48b0-9548-733708b53464", "comment": "Malware payload", "value": "a02a654d51d21da6cee86f96d8384376", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "nigalulli", "colour": "#BE9758", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702439489, "uuid": "cc2e5724-0068-4a1e-b0b4-b4020b3b0c2e", "comment": "Malware payload", "value": "68cd6e1bf3b4d44f01ae112200f99273394ae0fc59dc6e48ef6e18ac8322e735", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "nigalulli", "colour": "#BE9758", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702439489, "uuid": "4d9a1bac-63cb-4761-8f20-cfe39a1a9eb9", "comment": "Malware payload", "value": "65aa9c1bf258ba6be796f34db18be64723081a09", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "nigalulli", "colour": "#BE9758", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702439489, "uuid": "3592d84c-e149-469b-9389-d6175877b4e1", "comment": "Malware payload", "value": "117db13de67413c6d75b3415c97c3f20e0f8dd088d9a577fbc4538df9538e83943ca9e13677eb96f32ead47ccd789abc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "nigalulli", "colour": "#BE9758", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702439489, "uuid": "da0e13ac-678b-4e74-a420-c5d8fc9a66e4", "value": "T18073225E43612E2E5926098C685EE3086B90CE029DF3E4F1F1E9BD6B6006B37536714A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702439489, "uuid": "73b6c958-0416-4f62-bf7c-730e3b418c81", "value": "48:DdZMUnNfJVaGfXm+cgmFL3MuV9IiTposHgqk+QKRaSoTo:Z+UnNfJVaImvgoV9DCrcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702439489, "uuid": "50a46fad-d273-406e-a98a-07d4d5a8c5b3", "value": 77118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702439489, "uuid": "1da528bc-8581-4bfe-9cf0-d52dab0cd170", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702439489, "uuid": "da7a14c1-a123-4eb3-9086-88867c729277", "value": "lnvoice-1578246817.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc9e7a3-9987-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702451715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702451715, "uuid": "e4315ae2-c364-459b-bf68-803e9b065049", "comment": "Malware payload (Formbook)", "value": "7152806fb5061ac726488d69a4428d60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702451715, "uuid": "e1ef6d85-cf5f-41c5-ac32-8a7f9cb3e658", "comment": "Malware payload (Formbook)", "value": "6a08b0d216b12a127efa4317db2c9a1f1d6c3826c58f0b6a949285d3c12af8e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702451715, "uuid": "9af6ace0-95e7-436c-a7a8-93a5e6d53c79", "comment": "Malware payload (Formbook)", "value": "44e1da98e0a0f90d2a52ae54192783b9281a4494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702451715, "uuid": "aa80e467-d081-4541-9d34-d4df0fe5dbbf", "comment": "Malware payload (Formbook)", "value": "54188461c8a7208577341c06b9a8f6401c4d76ee3397674bca1a7249c079473b0e2ec2f5b46461b5746db785064595a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702451715, "uuid": "804c3dbc-0a9b-4719-bad7-63d4f64192fb", "value": "T1C4835B1374D28872E47219351864E9A08E2FBD120FA59E7B778416BE0F702D1DE39F7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702451715, "uuid": "2d1c223b-e5e3-4e37-a407-13881c4a2b5e", "value": "4b80b8448d90596b04f192e77824d47f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702451715, "uuid": "690a7b75-39bd-4d09-92ca-b823874742b8", "value": "1536:gvsQS9qdWmgeUJ6HatejJXHWIuXNBAFi2XxB9vtnQt0ZGqXwsWZcdS8zMRrEytbA:gvA9qtgeUJ6HatejJX07AFi2XxB9vtFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702451715, "uuid": "4af2e344-9911-45f1-8e38-764fe3863674", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702451715, "uuid": "b45a71b5-a541-4f38-b290-afdf0616460c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702451715, "uuid": "7b1d9e16-db6b-4ba3-a701-4e88f1db9968", "value": "SecuriteInfo.com.Win32.PWSX-gen.15083.27073", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53565bea-99ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702468449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468449, "uuid": "791591b5-07ef-4d53-bc95-e733813c1586", "comment": "Malware payload (AgentTesla)", "value": "e206e384b85cb3b7839451e1375de074", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468449, "uuid": "15f025ea-9504-4a80-bc80-ddd9b37cecbf", "comment": "Malware payload (AgentTesla)", "value": "6ba417615f436a2c4c3789db4e142e1dca621721b1627788aa3a72cdfd514e58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468449, "uuid": "3f04b977-dd9e-4171-8352-1ab38c218d0f", "comment": "Malware payload (AgentTesla)", "value": "548f1e41f63c04f4993483c4710459ae9875b507", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468449, "uuid": "584e6c37-6499-46d2-84fd-c8840d82c244", "comment": "Malware payload (AgentTesla)", "value": "0fc053356f2ad7618f746b3db3b79ba31647921efee74df8cf5b46d52d7d6dcdf42604d9e64e34b20de78d99c47e0f3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468449, "uuid": "78bfa113-0782-44b1-917c-2a62ff6757ea", "value": "T19D9423823730C01BFEE30B73297966675EF3F14504E4EA4F03A09E68BD56A46AD1B712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468449, "uuid": "e0d9b3d6-e44f-41e1-9ebc-1756fb80413e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468449, "uuid": "301847b4-6a5e-438e-96d4-c3bfb216ae6f", "value": "6144:bNeZOQLLGui7G1Z4AL7Igifp6hiSmfu7DCCN4EVUjKcnwTt1am3g/cDoX5P:bNNuq7cifpRZTCVUTnwTd3ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702468449, "uuid": "89dce476-096b-480d-8720-5a9b8bbca582", "value": 414424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702468449, "uuid": "aea82e89-6310-4d4b-866e-f0bda66f8f20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468449, "uuid": "4966be84-02f0-4889-9122-8a60f995871c", "value": "AN\u00c1LISIS DEL CONTRATO-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c084f605-99cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702481947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481947, "uuid": "89f8ceb7-b442-43dc-918a-df85825f8509", "comment": "Malware payload", "value": "50239a121417cf5b97cda8ed60bf6459", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481947, "uuid": "6d0aa075-761d-4010-aa58-90743283fa47", "comment": "Malware payload", "value": "6bcbb6a6115fcc4161031f2acd33e0cf4dcc0dda09949ea1d70034067e37fcba", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481947, "uuid": "975884e8-d884-43cc-a0e9-dfbdcdb9ea71", "comment": "Malware payload", "value": "93c164db99b94afd02856fbf05f5b835fbd82a70", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481947, "uuid": "66a3e86a-3e4b-4d6f-818e-29fb6b28d3ac", "comment": "Malware payload", "value": "f1167748893a7dfcb6b640ce4a3961ec42ad9c7026b715aade6fd522e7805dca2df0d7d90de3da71a95f5c3e7575db93", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481947, "uuid": "9d833f42-05d7-4b05-bad7-c0ebffeedfca", "value": "T163631261C9231F80EB1B225F340FF091906B9687D6D2B5DA10F63E81767B5AF0378D8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481947, "uuid": "c23bffdc-6519-4202-837d-4979f35e0049", "value": "1536:sOJgb01Df0ECbUrJdCf6l+XW6xoPInH1vCMx:t7f0XsE6i3nHki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702481947, "uuid": "8eb95987-5e9d-491a-b4b4-8ab133d022a4", "value": 72360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702481947, "uuid": "7bb4b504-89ab-438f-b8e9-22186d1045a7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481947, "uuid": "4d12538f-e4ee-40e5-aa33-2442e03d787a", "value": "COSDT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d154b15a-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1702471238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471238, "uuid": "d1f8ab61-e890-4dbe-8683-9244a4881ced", "comment": "Malware payload (DarkCloud)", "value": "f3cc3dd61488fdc018c630c41decbae2", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471238, "uuid": "d03c6598-d184-4339-8b6d-5d0c415f51cf", "comment": "Malware payload (DarkCloud)", "value": "6c3c11a09226e321821ab159686fe4df8df6aeb64504ff2dce52313dfe9131d3", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471238, "uuid": "ec370516-87c5-4418-af9a-803ee8b34377", "comment": "Malware payload (DarkCloud)", "value": "9c4b560de8af3109b7c79b5405654d064e3cbdc2", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471238, "uuid": "65b43813-b12e-4bb8-9958-ea9a5cf19477", "comment": "Malware payload (DarkCloud)", "value": "3ba78fef133f0069bb2eb63945c50d8037af8db4b744ce3e4766727d6a7a25e1eb1b4793a9adaf9d44780dd75cbf5c10", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471238, "uuid": "217138f3-4935-4884-ab5f-358e835bb426", "value": "T14D4523487BE34892C869E739D9A74649177AEF42BE134B543614B37C8E933D72C0A84B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471238, "uuid": "45d40b88-40be-456c-a49d-92134932d9d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471238, "uuid": "cd46dd81-737b-4871-a93a-32bcbc17cdd4", "value": "24576:xMsWI7DG2BMNcHwN96WjPYqhwcBbKZQleOx37xgAM6VkpX5:xMWnhBMNNTPz0ZaeU3lg76mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471238, "uuid": "7d2485be-2e5b-42fd-9646-1134cefb4efa", "value": 1269248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471238, "uuid": "eb647249-2263-4db7-a128-7365e8dc8c99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471238, "uuid": "8c395db7-5acf-412c-ab50-0f5a71f608aa", "value": "Order Proposal- RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2bb88ca-99aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1702466891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466891, "uuid": "ebed2f3f-01f3-49d0-9c27-6316f065c60a", "comment": "Malware payload (Gafgyt)", "value": "d65ad3be168677d549743d22c3c31e39", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466891, "uuid": "72bfe574-4dc5-40e8-b147-0a1ed8ac0dd4", "comment": "Malware payload (Gafgyt)", "value": "6f8ff364f201598c18c7cda478026cd570e08a3fc9dcc15547283472a59ea10f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466891, "uuid": "94571a47-157f-402a-a027-2ec1a09ff6f8", "comment": "Malware payload (Gafgyt)", "value": "58282630ca163574fd2bc6b771d181b29d2fe750", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466891, "uuid": "05043ac5-2b04-4e25-acfa-70e6097a4604", "comment": "Malware payload (Gafgyt)", "value": "1aa12f5cf25e924dc60a6f73f8bff7b67c94d94850de01c6fd234d9afc56b5b2e2a88c813df0bc07dc09f1c466fb9e5b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466891, "uuid": "47f79ac6-1f50-4d8f-9bab-3ce214165b3d", "value": "T124935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466891, "uuid": "5b6d427b-c754-4156-bdad-d8006350570a", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3uyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjKeifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702466891, "uuid": "06b083d9-1117-4c15-8fc7-b604a54c255f", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702466891, "uuid": "96d14928-a8b5-452f-85c0-ada0617416a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466891, "uuid": "9570d169-47ee-4105-84e1-d205c9ac6bcf", "value": "d65ad3be168677d549743d22c3c31e39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6678f473-99ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702468481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468481, "uuid": "01d970da-b03d-4809-9048-cd7a450c06a1", "comment": "Malware payload (AgentTesla)", "value": "60a1594ecd614b65d24dd5cb8faae348", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468481, "uuid": "044871c3-d660-4e9c-bef6-aa1da59bba60", "comment": "Malware payload (AgentTesla)", "value": "70171fc7451e2679f6d05cf1c08264a41b9260d5b2cf13745ab414b33f6cd361", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468481, "uuid": "6e0388d4-84d2-401f-b302-19120a7cee2b", "comment": "Malware payload (AgentTesla)", "value": "63e029890cd3493c047dc91d35206d319df58cc4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468481, "uuid": "62f9c968-ced1-4729-b1c1-28c7bc263104", "comment": "Malware payload (AgentTesla)", "value": "610ab4281b14397a89744ee6d53c5e77f1cc0c2f5de85db93d02c581c18c410d24818c0f220d97722c9a2fd79df73ef2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468481, "uuid": "568c9ec3-1c9b-4306-a222-8d267f12d408", "value": "T1B884239B5779C407FDE30A32593593AB4ED7E7267271A38F232895837D377028909B28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468481, "uuid": "c2013bc8-f67b-4476-b407-d8b57421cafd", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468481, "uuid": "62596451-524d-4adf-b885-74b63cb78bc9", "value": "6144:HNeZOTDzlz5wBOldA7ZaswqTSMdRStZGVuFr7iBrh+02Rzonc8xoO1am3g/cDoXS:HNNj1VdEZaswoS8RSjOuMX+JRzOh3NDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702468481, "uuid": "3039a36f-6bc4-4036-a120-0b92d19afee3", "value": 406592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702468481, "uuid": "ae9b8308-df50-48c4-82b6-01e60da736e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468481, "uuid": "9e219a53-21d2-4d9f-9a44-e258c9c23811", "value": "CONTRACT-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3f27161-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702471188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471188, "uuid": "8624c239-ccb9-46c6-b2a9-d4c503b362d3", "comment": "Malware payload (AgentTesla)", "value": "afa722a5695289a5da9811ecfbbada69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471188, "uuid": "234de1d1-39ea-4802-95ca-cabdc4bdbbf6", "comment": "Malware payload (AgentTesla)", "value": "70bb422c14c0a6b025b134c2f1a49c3e6c1ba206ab844f314a76dfeb308669f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471188, "uuid": "11fc815a-07c3-453a-8418-723544b9ba33", "comment": "Malware payload (AgentTesla)", "value": "dbef7c34c4d51bc17f64d5ffbd666aa516de74b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471188, "uuid": "c896fa66-0f41-42b9-a2c7-3d580ed905c2", "comment": "Malware payload (AgentTesla)", "value": "97b93169d1aab3833a9ef68ff0dc9f9f810e219a3e9e1d5433cad556d48d61b13b2c8ae344d9fd961a7c5ddda5a1e782", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471188, "uuid": "11c82b89-43e6-4c44-ba1a-d937ee095805", "value": "T1DEE4232A57C5C2EBC6B91778387313520EB5DE932027DB5B25B734EC4A7B39817A1A30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471188, "uuid": "43c00f41-036c-4d5f-a9af-ffc47288a527", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471188, "uuid": "a8dc5b68-4e9c-41a2-9003-8136be28f2cb", "value": "12288:hEfeInGy+YYUBYH2cEGHYNlOq9lUpnbiwogw+aQ0ak+WdI/IVKtYMnUNJW/jLY75:pdYnCOQYNlOqvUpnogdSa7NgVKt6+jsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471188, "uuid": "44833c78-6ed7-4300-a83a-0b748c2e3f31", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471188, "uuid": "81cd4b77-0a79-4ee6-a52f-227a9b5b6eaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471188, "uuid": "54bee94a-a0b2-4f60-aad0-eef73a0c69c7", "value": "Teksan Fiyat teklifi Istegi 23070 PER 200 Adet \u2026scanneed 00101.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503d317a-99aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702466726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466726, "uuid": "0abc0824-07f0-45ba-b97f-6cb39a381cb8", "comment": "Malware payload (AgentTesla)", "value": "dab632ecb4c9bdbf83da8865e08579ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466726, "uuid": "66c502c0-7679-4f1c-a473-92fb90b03b64", "comment": "Malware payload (AgentTesla)", "value": "7499ea0523bd072c10a0e70e1888c25996a26aa04ea89c016258a0c5b320bdd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466726, "uuid": "e2f033d7-189e-47b9-b99a-fbbecc3c9690", "comment": "Malware payload (AgentTesla)", "value": "6d4c9a38c17810ffdd91c8326187d39d3caf26ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466726, "uuid": "86d778ce-18fc-4659-8149-d83fef0b163d", "comment": "Malware payload (AgentTesla)", "value": "46f6ac81853a98cfa460fe80b78c9a20b1c5540846d9b67ce0063dcd5c93b7b9297363f0340fa9020a51653a08cbf1e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466726, "uuid": "bf394e32-2b0c-4a21-b28c-2f821f88f5b8", "value": "T115E42304773A494FEAF607F6909A100147B1BD06AAB3F2CCBCE061ED92F67615F90697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466726, "uuid": "adc666cb-a958-41fe-a900-b213ce0628e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466726, "uuid": "0be4aebc-34d4-4862-93bf-1e72c0b9a8ff", "value": "12288:4nS+4WpAE6y8EUmgTWQ2HiEbugZ6Oq+0gIFkvrqU8S386QUBH5Kq3ZcNNQy6f+:4pAEWmgKXbuQ6hmIiDZfZKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702466726, "uuid": "a51052f5-969c-4ae0-895f-a68381349cff", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702466726, "uuid": "eee9490d-2243-4f67-a8ae-b02e9618d497", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466726, "uuid": "c44eb259-f411-46c6-b424-9f6901bbc4b4", "value": "TEKL\u0130F TALEP VE F\u0130YAT TEKL\u0130F\u0130_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d36cfc0a-99e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702491427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702491427, "uuid": "0296b256-c49f-4ee0-ab46-f1b0787e075e", "comment": "Malware payload", "value": "d6d8b39076dcc05a1cd5c7cc2a349ec4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702491427, "uuid": "75432e88-0770-419b-aa14-8a22e9b7bf17", "comment": "Malware payload", "value": "74c01662380467969a4b88183a81e8b9a616d28360a2bc084e8cf86aa6ba96dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702491427, "uuid": "e8a880c4-2c98-4c32-8c1e-150f6e4012ae", "comment": "Malware payload", "value": "d0e087ba38c45367f5f1a4e55febb37cef9e7762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702491427, "uuid": "9ea76904-201f-490e-97a2-ccc76d94e6a1", "comment": "Malware payload", "value": "c1e5a3a1d721d22bff8d98cc08dc684472560c32f79276f5521a1371299b17578235fdd1a6e33fdc0dbdf24f138d598a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702491427, "uuid": "a35726b1-cffd-4909-b2a1-2d081f448f50", "value": "T1E0B450063384CF66D12F51B5C8A386F85327BE00DD449BDB26C4BE1A3EB33A65D25693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702491427, "uuid": "a57b80da-424a-403d-8b72-c11296b36efe", "value": "2e065141377c7681c15aa62be2191a33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702491427, "uuid": "6e8c98d0-5dab-4340-bd2c-c3d6b503d785", "value": "3072:2X98f547Mp2BKrT6t0aCiKmrWfRGlC7PWu5FP:C9E54Yp9T6mD5G4PJFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702491427, "uuid": "b44d6a54-b9e9-43f0-8333-51beb0775627", "value": 506552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702491427, "uuid": "96d19a34-90cf-4a00-a083-be85e89ff77a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702491427, "uuid": "481ecebf-6f02-4e63-a0fe-caaaf86a30c4", "value": "SecuriteInfo.com.Win64.MalwareX-gen.20867.3208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71c8bc1-996e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702441182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441182, "uuid": "76f2a48e-51cb-454e-ade9-8b64b6a2ad3a", "comment": "Malware payload (AgentTesla)", "value": "c98e3e9eb2976b634f5c8b056b77ce2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441182, "uuid": "1fbfc181-7501-4ca7-a533-59e685849fa8", "comment": "Malware payload (AgentTesla)", "value": "760870faeb6c745b911d6a40a785ca0f42f15d6e454899afd40ecc64c5d6522b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441182, "uuid": "fc81e7b6-b0b3-4dab-9014-af50f6b64403", "comment": "Malware payload (AgentTesla)", "value": "4a2cf6c032b526dc2998ed00a3d7517512a15aab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441182, "uuid": "18aee03d-5ff6-4667-8407-79079fd75eec", "comment": "Malware payload (AgentTesla)", "value": "b0043e1e162d45519dd2eeb90ca97c13fd09857d9870407c8b1c5a613c83057802972313a02c8f180e8ef8a96ee77c34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441182, "uuid": "43170474-d20d-4886-b5e0-8959bbcb3dc2", "value": "T12715C33D19F92223F075C7A6DFE4C527B260A5EBB052AD24D8D243964307A4B79C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441182, "uuid": "1c337d57-edb1-4616-b66b-dbb3289c0599", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441182, "uuid": "7536cf27-0dc4-405b-82c5-cb20032f3687", "value": "12288:sgLtOinUADClesz2PB4Ch1dNiK8dAPznxTfgEBu8FZTLP6493vibu:s4tEcCwzPnliK8dAP2Eg2TrppvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702441182, "uuid": "6eb718a2-dbce-406f-acb5-8e537732c1ea", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702441182, "uuid": "93a3bd80-252b-415a-8d60-4dd32fdbe80b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441182, "uuid": "28e95f98-07d4-4fcb-9ac3-fa76bfb762da", "value": "SecuriteInfo.com.Win32.RATX-gen.20501.5539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658a2bea-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702480935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480935, "uuid": "5e579160-b25d-46aa-af98-284b149dd3ef", "comment": "Malware payload (AgentTesla)", "value": "b1a3230b9ad2b82e3c99dc4f6f9b0efd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480935, "uuid": "c132a5bb-da5c-4154-8897-4e716ccfb39b", "comment": "Malware payload (AgentTesla)", "value": "78adf9dab234e98f3fca7b3276602c128633f1c6b04ad7b07ae860fd0bce69fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480935, "uuid": "98d12855-ebce-4e55-8b12-e98e6fd4ba0e", "comment": "Malware payload (AgentTesla)", "value": "9a795873f4402f71f99841249809129c9edc887c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480935, "uuid": "5821c88d-1ffd-41c5-96de-4174af6d3e64", "comment": "Malware payload (AgentTesla)", "value": "59835bee6dfea4f66325ff1afeef008789ad2db56e3041a96ab5d4f452bb9ead51a5a8c44da61246c6557de466d60eb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480935, "uuid": "e171e2ef-29a4-4f01-b62f-b6b26d71b755", "value": "T1A73517927B44CF43C79F65B7C4A286F1826B5EA1DE4693CB6880FE583CF73955A10283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480935, "uuid": "12641161-dcea-4bff-9db3-159a3dab4c9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480935, "uuid": "f6a8ea53-c765-4140-a684-fa5d99ce2061", "value": "12288:aPIFiFdAgzGZq58rFamORuzyTq6J33a33S333333YMfZ:abzGI8JrORA2q64kZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480935, "uuid": "5ad6254e-b9d2-4e88-b353-7ae2fdffd522", "value": 1084928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480935, "uuid": "2f599275-726a-425e-98c8-6a3502103a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480935, "uuid": "16bcebfa-65c9-4b3b-985d-f4f8d7c09eb2", "value": "QUOTATION_DECQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ddc769e-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480895, "uuid": "2e64112a-9447-41e6-ab75-0137c7f18315", "comment": "Malware payload", "value": "9e2cb9f954e1326793635e61c7b31185", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480895, "uuid": "b808258f-065c-4551-9708-ce4d4305f071", "comment": "Malware payload", "value": "78f38d0bf5be9d42176719678d4dd1ae0884b6334c49ec412284c2383e05f65e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480895, "uuid": "06174d8b-9f72-40a8-b586-702662f1db05", "comment": "Malware payload", "value": "8dcbedf937aefa34985e25da666a4d2f976ee173", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480895, "uuid": "d157c834-930e-4c51-ae13-6a4febf33cf3", "comment": "Malware payload", "value": "1cc648fb593d25fef215cde8f699c1fda74f1382afc477e66c40cb62511289df747c260929a2ec9b6e8a07b4927e66d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480895, "uuid": "9ef0075e-33a5-41df-bce7-71548cb52836", "value": "T1EE74F23A5D6CECE5D1414A70CDA6CE650296BEA0BD259B53F8C8BD9F3C397423CC0A18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480895, "uuid": "68087064-7458-4e50-862a-9d05a78a236b", "value": "35684e90f9d317def018b3caadaee242", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480895, "uuid": "229273ff-2b9f-4adc-ad52-701c6ee563df", "value": "6144:kQQ9/Hu1l4kd2nQQ9/Hu1l4eVL9/Hu1lLw:glOL5dClOLZFlOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480895, "uuid": "0d74e508-4203-4430-9da7-a3e77a9dbb59", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480895, "uuid": "3a130dca-b2b0-4042-ba33-5416e82b7d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480895, "uuid": "d17e476c-eedb-4102-8f28-a41dd4f9cfdf", "value": "SecuriteInfo.com.FileRepMalware.29488.20932", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ff6f88-99c4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702478168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478168, "uuid": "32b8d790-abaa-431e-92ef-35f4071cea29", "comment": "Malware payload (Formbook)", "value": "43750f4ba0e878eec062bc5417c02021", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478168, "uuid": "82680a70-89e8-4025-a8b0-fe54e390158a", "comment": "Malware payload (Formbook)", "value": "7a431d0e83e33e7d260ddac71c4d85018654e7484918e9466361e76d0072daa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478168, "uuid": "fd4d0c84-41e9-4db4-85c9-76247d5bd9bd", "comment": "Malware payload (Formbook)", "value": "d5ce34f06be398dce7a6262d9d778bb7676ce338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478168, "uuid": "9314ec7f-09eb-445c-86f3-85947bbe9582", "comment": "Malware payload (Formbook)", "value": "dec03b5ae7988e706a798e33fc8a3af206e22a271e8b400a6b082ab8bae72a0b571cb13477ed7a36c8b71434f5dfbc18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478168, "uuid": "010decdd-61a8-484c-8079-4f81bd6d121e", "value": "T1E874224137C185BFCEA712B18CF6B724E67AEA606166679B0BD55D3F68202C35F0D183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478168, "uuid": "2fe6fdb0-264b-4ed9-bd98-1673d72d74d9", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478168, "uuid": "07a62f48-1701-4124-9cdc-90fed6dc509b", "value": "6144:KBlL/X8Pjc7dhWVN8ow2cgYCCP8KkHA9HeQVBaABuN5gG/r3pWEesCYrMm5+STC:wRgwdgVNlcGCPQKTVlBE5jZKA1+STC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702478168, "uuid": "6166f334-03b4-4ac6-9482-87597870117a", "value": 344774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702478168, "uuid": "a7fa51ee-0053-48e0-a508-94193fa1e4df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478168, "uuid": "eef99dc4-33e8-4bdf-bd04-953be3a6f1b7", "value": "RFQ DATA ALL REQUIREMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e32b86a-999d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1702461220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461220, "uuid": "aa1facf5-05d9-44a8-919c-456d162551b0", "comment": "Malware payload (Gafgyt)", "value": "f0533f3e7c9d45236b13d0fcd6a68190", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461220, "uuid": "ce9268bf-5e1a-42b6-a553-19c940d0494d", "comment": "Malware payload (Gafgyt)", "value": "7a4437b653591f820f2184cbbecf3cba33d33916a34bb0d42eca80a9407932ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461220, "uuid": "5e7380a6-312c-4bb7-ad77-ed5f06b8d800", "comment": "Malware payload (Gafgyt)", "value": "3e78a71f338fe002c6c8edc54644322e2acfdd80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461220, "uuid": "de754777-48f7-458d-897a-351514d126d4", "comment": "Malware payload (Gafgyt)", "value": "9282da8c3c9c9ec99e836b473a28ceb902090be602930cdd010b28a0c9896d235c185db4cb3a46d88c534d0a434da399", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461220, "uuid": "86cf47da-2a8e-4cd4-b848-3b56fc6421ca", "value": "T1A3B31845F8408727C2D327BAE78F479D3B36579467DB33116A38BEB42BC17892A29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461220, "uuid": "2415f601-37dc-4317-8912-5583229f2263", "value": "3072:MSY+46m1qOzssrFPPKNy+AmkZrQAhPDCXFke:06mgOzJrFPzmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702461220, "uuid": "26ce7708-2c78-464e-b208-f1b8df9196f5", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702461220, "uuid": "03ca3d70-3b13-44d6-bdb6-c7962d29c2c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461220, "uuid": "2e9bf9e0-7128-46b7-8e79-e621663e4a69", "value": "f0533f3e7c9d45236b13d0fcd6a68190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb10f52e-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702471281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471281, "uuid": "007a1838-a835-4fab-bf15-8e0c0a5dc305", "comment": "Malware payload", "value": "5e4ce38c0784f2b12c33f9ba19aa53d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471281, "uuid": "e7e0cdc9-afd5-4821-821c-dcaf5315cc66", "comment": "Malware payload", "value": "7b22169c5dc14a492fc7242c45c8335567e58864a08088ff9bfb748d2ac29036", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471281, "uuid": "d1d8bf5e-f8cf-40bc-b697-56fad522c96d", "comment": "Malware payload", "value": "3f981996f91877c36195eaf6d468de013795a836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471281, "uuid": "a5788bbd-efb1-4e3b-ae65-1a7c25943ae2", "comment": "Malware payload", "value": "98ffe979208e7b9067a4f0aff95fc039d0dcebc2609ef3f3065da8f35767359bd68d80769933f0e2ad30a67196b67236", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471281, "uuid": "a2dcd642-925a-4ec5-b5b8-23604491c7ad", "value": "T16A84F19DB62035EECC43C8719AA96D78AF607977831B4183A117226EDD1C687CF290F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471281, "uuid": "25b0dd9b-899e-4345-aec4-0187ab30a083", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471281, "uuid": "83a03310-981f-41b5-9066-f11274826e0f", "value": "6144:sDYPvT9Tq/UUJDTztYsCuXSYOZNMMbmQSfyXPklP3u6HJd+SPXBJ8cBdcTqAJ:smTIcscPYPMbmQGyclPz/mcBdEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471281, "uuid": "e305fae6-afed-40b5-9847-e697cf8c0705", "value": 379976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471281, "uuid": "e54371e9-274e-4357-b33a-6991c533aac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471281, "uuid": "28b4396f-0e42-4173-b8da-7bcaa4ee8714", "value": "PVT MNDREQUEST FOR QOUTATION 07964766IKJGDS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaaef2fe-99b9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702473320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702473320, "uuid": "14482f2b-3e2c-45ec-8032-08b67880947a", "comment": "Malware payload (LummaStealer)", "value": "5f0a1f0b37ad8bf010a90b2604bee42f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702473320, "uuid": "e7970f64-380f-4ed7-86b3-220319e6356a", "comment": "Malware payload (LummaStealer)", "value": "7da7d8176b9c386e2102b47341b29817c3ac5f2fb4f27a26ec70b3a00c900019", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702473320, "uuid": "1be0e5fd-936b-4380-b27a-084c1650f66b", "comment": "Malware payload (LummaStealer)", "value": "1432b411b797a969a28d64afc56d08b8629e359a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702473320, "uuid": "0b10cbe3-2411-4dff-9424-8c177f395eee", "comment": "Malware payload (LummaStealer)", "value": "6844808c88052b81a17b659569444c63a59d1a19f39cc3ee16d9ec59d0a3d3afe9d4dc9b80a5553667c0d53c257fd799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702473320, "uuid": "ae9eb411-ad3b-445e-817f-0c8d9e6735b0", "value": "T1DC75234472F86471CCB73B3054F66BB33B3B7D159AB9626B268998090CF38C0E5B5726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702473320, "uuid": "3f1216ae-4d93-482c-bfff-a00d7a991fd8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702473320, "uuid": "80eb70ef-cb94-4e8a-918f-7bb76b7d6827", "value": "24576:ayUa4xJhcPfpnV3Hrc9NvOZ8euCRyeuumrGqGfkZFrQ4BOXwMR053exymFCKKs4:hUa4+PhnVITGZ88yeuuCGqSk0bvuYxy2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702473320, "uuid": "f29521c4-9cef-438d-b182-59fac402c700", "value": 1571840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702473320, "uuid": "3fb6d00a-dd6a-4cd5-ac4d-2068d88154c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702473320, "uuid": "e1344ef4-91df-4c2d-bfbd-30f47634c0c3", "value": "5f0a1f0b37ad8bf010a90b2604bee42f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1c4878-99cc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702481429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481429, "uuid": "15637a75-c904-4567-8b8e-cb304416f7b7", "comment": "Malware payload", "value": "4d5313f085a7c1e1c05b93fc4bd828e3", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481429, "uuid": "58b8adfc-a5cb-4eba-a957-f39a2058c494", "comment": "Malware payload", "value": "7e11de56f0c578cd05f498f7dada628c82e5d588f2b0d3088b2ba80a51253d03", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481429, "uuid": "80d85250-97a3-4ddf-9473-1e4cc823654c", "comment": "Malware payload", "value": "c0822cb62a222dfde28777608a05894f5da94756", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702481429, "uuid": "4e9dc474-e9ab-4cc9-b561-f4a4cb4552af", "comment": "Malware payload", "value": "261274e7acec6d883ef14f3c156200a1ac2de7979b1d38b9b46355d094ec900344abfb59834ff8a25681d337b3fb25f5", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481429, "uuid": "cd41a839-3baa-4a28-b8fb-23af8989b857", "value": "T1D3D3F18CD5D9CB1E85B884B692690DD631D2C14B4C85B8B548FBF602BEC3A48E7F1D93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481429, "uuid": "ec858364-223a-4f00-b98f-32bd6fc5e422", "value": "3072:vTeIv4WIhwFlN2gnLR6JFu/dEYhHWxlM2qlCnrBjr8mOg7GmL39Mgbm3L:bH4Bw3o0LQFyTolM3lCtjnSk3Nm3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702481429, "uuid": "19acdb92-bd58-4d4c-b5f3-6c35695f51d1", "value": 142932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702481429, "uuid": "36566c79-cae4-4a4e-b4a7-a01736d58a6c", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702481429, "uuid": "f051054f-d5bf-4cea-99ee-0718b8f78245", "value": "SOLUTAS4.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e31f7ab-998c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702453864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702453864, "uuid": "58d8da0d-e96c-4c70-9f94-2ccbf7760160", "comment": "Malware payload", "value": "7e1199ffdc76ca53190a76a03933ab7c", "object_relation": "md5", "Tag": [ { "name": "pw-2288", "colour": "#E5F06C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702453864, "uuid": "05c19da1-67ad-41d6-afbd-a5518e64169c", "comment": "Malware payload", "value": "7e877c5998c7709d145df2a0270822f5346f46f5a421a14b0a8805eea4b4734b", "object_relation": "sha256", "Tag": [ { "name": "pw-2288", "colour": "#E5F06C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702453864, "uuid": "c5ed8eb6-2034-4548-a2e4-195202708aa2", "comment": "Malware payload", "value": "31aaae1c9eaa6e8d9bb5610ed2c36080b8d84ccc", "object_relation": "sha1", "Tag": [ { "name": "pw-2288", "colour": "#E5F06C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702453864, "uuid": "2e42195e-4a4c-44b8-8a8d-58a748378b73", "comment": "Malware payload", "value": "bf555e938a441ea4e076c1dc3c595d44f91e7d47f331151a5450790a73684cc99117d3140b1a683de11b22bd33509a4d", "object_relation": "sha3-384", "Tag": [ { "name": "pw-2288", "colour": "#E5F06C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702453864, "uuid": "295187cc-4851-44a8-8ded-ce8f49ee1610", "value": "T1CB2533E5EDE4DA01F92ABD02F2A78255F406B63FE10DA0F38167D4AA77190A612F0F15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702453864, "uuid": "1eacd71b-ab38-4a64-be10-d6d12d2d0a4b", "value": "24576:/wNuXZfMQiiXNUoMQmSen8z9jzoIKIbugsCEJqMnO1r:/3xMQiiXeWeOVJfb5ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702453864, "uuid": "8b3e4d5a-36df-47c7-b9aa-198e460a60d9", "value": 1018330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702453864, "uuid": "fe4027d9-eef2-4e48-bc45-a94a07f162f1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702453864, "uuid": "32abe00e-a5f7-46c3-a308-e9e1562ac62d", "value": "Gemini AI official version v1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1315d67-99b5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1702471667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471667, "uuid": "82b8afd1-49d9-48d5-b20a-b16b99d030e5", "comment": "Malware payload (zgRAT)", "value": "8652b1a2fe37ec2fc93ed5e131a64b8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471667, "uuid": "afc28d7d-b89f-4b35-83d2-c5f1a2b8ce29", "comment": "Malware payload (zgRAT)", "value": "7e8b6d72b9f5e62dee5566641291d9d2a9ec6eb965da7cdb35b3aa6001aec2a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471667, "uuid": "5466d5f7-511c-4bcc-883b-777ec8106dd4", "comment": "Malware payload (zgRAT)", "value": "11a0983fc8ba6ac6dfbe45e5b5a70e9acb3d182b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471667, "uuid": "fdc49c32-879c-444f-b5e3-6cfb88c93c5d", "comment": "Malware payload (zgRAT)", "value": "f2ea4a0887758e9670e68087d4334d1f7917422f1d57831495e9019fce00af8d83f29b9d3484bf30c7237236f71b9434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471667, "uuid": "018d9b5b-ce2d-4add-9ff0-24a73a1315b7", "value": "T10B05E0B532234E16CBA2A7B58A73A7020950FD3B9466D307E3C4717F602B1AF5BA1747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471667, "uuid": "b8423700-f2f9-4d32-8b8f-c6c98a5e2905", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471667, "uuid": "ae431699-0a37-4ca1-82df-48192a903ad3", "value": "24576:tgaXSSFOEm4h3Kriv59FhfOmqcY1awr8T0aonMGyS:qaXSSzmy6EvfOmrMawr8Ia0MGyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471667, "uuid": "f15e4d45-6861-4856-be7c-588772a3bec4", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471667, "uuid": "91334e68-d141-4881-beeb-d1ca44260bda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471667, "uuid": "90be64b3-5f50-4d1d-b8f6-e0a8870e55b4", "value": "Reooxtssf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262259e0-994d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1702426712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702426712, "uuid": "6b680840-7b24-4103-8844-de326e818543", "comment": "Malware payload (Amadey)", "value": "c48a043184a3a2bf2ffe1a31414dbb43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702426712, "uuid": "68056fcf-c72b-4871-9dbd-290751d3f3a4", "comment": "Malware payload (Amadey)", "value": "7eeec75728e0dcccfa2eae8e36a3013e2ab2784bf176bf781b2adf796a48ad9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702426712, "uuid": "1675f1ed-94a8-4e56-bf39-b4fffd989fff", "comment": "Malware payload (Amadey)", "value": "df18d37d361ddfb3edb16269b12890feb9391137", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702426712, "uuid": "aca17ab6-ff46-471c-825a-76ce3a42bca0", "comment": "Malware payload (Amadey)", "value": "27d01625c237feae7eeaa35b0db608644d608f6824cafcd8f9e83b48b1b018f6b51da219d3d27bf1e4522560f80024c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702426712, "uuid": "cf506aeb-8680-4f12-973c-9d08010f67b6", "value": "T1A7758D22B2D18437F0721A7DDC2AA2B9B4B57D0D1D28C94A3EE45E4C1F397833925B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702426712, "uuid": "704300bb-a623-4d46-9944-de1ff32335c0", "value": "eb828e44fa1047c6d842831c261da8c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702426712, "uuid": "da208983-6eca-424c-a688-c21835814bec", "value": "24576:M3IKrCe6EfAy7Decx9vLUsEldHCAAmvJLKfLr4BM0h7Gp/ZVG:M3eeXFLFWdjvZMLWM0h7+/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702426712, "uuid": "fe012790-2454-4c77-8e17-a7fd7a9dde45", "value": 1565256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702426712, "uuid": "9791e5e9-1296-4857-a768-387ca16a7ec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702426712, "uuid": "020209cc-ec1f-4d93-987c-46a61aecb65d", "value": "c48a043184a3a2bf2ffe1a31414dbb43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4542f725-99ed-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702495484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495484, "uuid": "84d5cddc-09b4-444f-88f4-24b5761cdfde", "comment": "Malware payload", "value": "57a242086796d426e6ad936def6e7066", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495484, "uuid": "e8dca506-f3d0-4dc4-9f67-e9bc9575f785", "comment": "Malware payload", "value": "7f48836911fa76863331e06d6d1d2c2e90b8fb9c1502c888fb0711885054d5bf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495484, "uuid": "3c955c86-e82f-4ef1-b6e3-ec0170cc7827", "comment": "Malware payload", "value": "1cec72c182d76c06dd671343fde7585d3afeb679", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495484, "uuid": "93745baa-c736-4db8-af11-5d9bc93e2210", "comment": "Malware payload", "value": "40422466446f20b5d05474c393713b6b4b430a02427761ccf878760d0f738ce3edc5ea69caacbaaa817878dee6f8ada3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495484, "uuid": "4ae199eb-60a1-4734-8a67-e1236837e5d3", "value": "T1C6533991FC819723C6D1127BFA6E028D3B2653E8E2DA72139D265F20378792B0D77E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495484, "uuid": "a077cd90-1d05-4858-bc1b-21179ddb6b2d", "value": "1536:8DFDJaT5C7RwaDtSN9p4ZYZSYjQFUibHKV:8DFtM3S2SYE2iGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702495484, "uuid": "3347bd0d-c990-42d6-8b30-f4f778b04a10", "value": 62876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702495484, "uuid": "4a6663d3-4706-462c-8fe1-a1c8510149f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495484, "uuid": "01907988-f03a-4d1a-91b4-8d8a300f814d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e236c1f7-99a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702464823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464823, "uuid": "391e7f9c-945d-4cb6-b04b-b11fe93c0e2a", "comment": "Malware payload (LummaStealer)", "value": "dd7a77d85e2de1a42ee972224dd43a1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464823, "uuid": "48da3e81-f5c3-4339-b457-df27e662d865", "comment": "Malware payload (LummaStealer)", "value": "7f8b0966f0e10399afea7f25ed750cfb95ee80d28241c826d27d49de4ca1b8d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464823, "uuid": "bd4c0cd9-01e2-437e-8931-68bf45695eda", "comment": "Malware payload (LummaStealer)", "value": "97f5caaf8ff4d72d24634488ba9b460424fec5d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464823, "uuid": "78d04bae-8b7c-4992-a5a4-dccb58297ac7", "comment": "Malware payload (LummaStealer)", "value": "d3e05e1a37513568cfa0e2210e7d251adedc10d85e0b3cd443a44c8e65c49373c65f62ac26b13b72de7c15e0fcc5cb2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464823, "uuid": "2af3f56d-4ea3-4c98-9f67-b1c2e6be14c5", "value": "T19CC47C1B521865B9EBE3DA3A21D28DD064DE4015FFC74F9EEA0EC48CB33872C84DA559", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464823, "uuid": "d325394e-2612-42aa-8a5c-bd289ca1f946", "value": "59737f231ef329f299654331c80b5130", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464823, "uuid": "5ba08f18-44c0-41f1-8af2-0f2c5acc41cf", "value": "6144:RFW/rZFFmyHEn9JtnfeK/I0CI01I0SA2ez8V81+mqG4OqNGVgD9JTRaBnYzf39dz:RypREn9UwlE8PmqGps1RkYzldIYGVgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464823, "uuid": "dac6bb22-7a16-4335-b216-c24fcf92fbf9", "value": 581448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464823, "uuid": "4e8a762d-6360-47c6-a5cd-b6559fde2659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464823, "uuid": "d72c04fe-d6a2-4853-9b62-62c316523269", "value": "dd7a77d85e2de1a42ee972224dd43a1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fbae89-9961-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1702435517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435517, "uuid": "302220c5-0e68-4d38-8627-5db9ba2ebfbc", "comment": "Malware payload (Gafgyt)", "value": "74ece2054fa6b5b613df1d319916a38f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435517, "uuid": "ebbcea15-381c-4641-b31e-c1559ae44429", "comment": "Malware payload (Gafgyt)", "value": "8014e29f017f00e972794f817bc3eab88bc59b2edb40e9bb0437f65d98d537f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435517, "uuid": "0739ea72-1247-4db4-8404-4221eccf76b8", "comment": "Malware payload (Gafgyt)", "value": "28f1b70b2a16031e05a59e656b6493ca21a7c0d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435517, "uuid": "34289660-d1e3-40c9-965c-5d7bc5b235ca", "comment": "Malware payload (Gafgyt)", "value": "3cd92e262aeef186159017c70d37a9cc6e35800805577ea5b60dd12337ecb867e4bec147ea677af40412e58d4cb331e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435517, "uuid": "5f499f89-9769-436f-8714-727700eed697", "value": "T199B3AD9BF74B5291C86187F40BC74BED3E2323119F2788E7AD0E667959391CF4A0A391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435517, "uuid": "db80ab68-31ef-480f-a407-4f8b21db785b", "value": "1536:cInUHpa+kzKgwiqvrdwmXC/mDL4satxWiaxgI/LWe:cInIpa+kz2iyusC/PsatxWiaxgIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702435517, "uuid": "7e0898c1-52bb-407c-ac93-558037862b73", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702435517, "uuid": "67ec8280-fa31-4d2f-9334-21b1dffa91cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435517, "uuid": "6e86d444-0183-4f76-8bff-1a0871b400e0", "value": "74ece2054fa6b5b613df1d319916a38f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406ab53c-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480873, "uuid": "4489f862-f5da-461e-9af5-5f8a37dcf08f", "comment": "Malware payload", "value": "9604c27af9bd7badff56c35fcfc264fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480873, "uuid": "790145b9-560c-4fe1-91d6-c9617c5618f8", "comment": "Malware payload", "value": "81c383139c341db50928912443c4a74bfe00fe742887bdfcfd91c307ad3e8c8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480873, "uuid": "63360dc8-7976-4a17-824a-fb48e3f8de54", "comment": "Malware payload", "value": "253c7c8aef751bf48d8ea45bf23ff34ffef97e3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480873, "uuid": "898b8d48-0485-46bf-ad95-95d0077742e6", "comment": "Malware payload", "value": "300dd4c0d5f9c876920c035b60afc068a130566f294d258973061ca46d52da6488a29436cd18ff048c43ed709f91533c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480873, "uuid": "7a8ef4b0-5a13-41de-87cd-50d15902906f", "value": "T1E3469D379E1D5CC9F80174759C5A8FDA29949C20B4086B9B75C1B969CCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480873, "uuid": "66d6a129-d6e7-4aa3-9faf-d5e2937d6e94", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480873, "uuid": "bfdcd0d3-a45a-4305-a9fa-ea93d93321bd", "value": "98304:HU1xTuR8SQXXVxrHZlgQSbhNqTTbOLs5x+eovVbiNR44anz4VFq:HuTuKZXlxZeQSVNWis5x+eovVbiNR44O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480873, "uuid": "6e21ac18-8de0-4f83-b200-0995f1c8eba9", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480873, "uuid": "79210a8e-bf90-42f3-bea0-132aa5f4262e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480873, "uuid": "76e8ee35-4fb4-4181-9439-ac1155b38c3d", "value": "SecuriteInfo.com.Trojan.Crypt.11020.22599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ba6dc1-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702471064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471064, "uuid": "6c51862d-0110-457c-95d4-8d8f8e9eb7cb", "comment": "Malware payload (AgentTesla)", "value": "add29ae359df00d68b063dde5f60ea77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471064, "uuid": "fcb949ad-8c51-4559-80ab-acc595408a21", "comment": "Malware payload (AgentTesla)", "value": "83027993477c55431189f73dfb877084df278ea4f14e8681b08550c699cc3f6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471064, "uuid": "98bfad5c-9c87-46ac-acc2-3f798571e426", "comment": "Malware payload (AgentTesla)", "value": "19b29ed16155b3277d4d4812f1900f61e3b38f3c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471064, "uuid": "61c939fc-38e7-4e30-85dc-64afe781c6eb", "comment": "Malware payload (AgentTesla)", "value": "bdd5897c7cede702817f8893509b860623f41cbae10984dad2ad6fac77dd2e65aa8246abe406403bf4eaa9cae959d9d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471064, "uuid": "5e282ce5-d7b7-4f82-ba6e-7f03703cfcfd", "value": "T18815B13C19F92227F175C3A5DFD0C523B260A9EBB1629964DCD613964317A0BB9C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471064, "uuid": "54d29f2c-53e2-4f99-a07d-6e7219b116c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471064, "uuid": "5856402a-55f0-40cf-b745-ae2314e2c48a", "value": "12288:EfuecqDk31AzfGnO8z2mZ+GupWEPH+R4/Fir7+P3EbtnZA8SM1P6QQI:gMQk31AzGOYuWqH7/FS+P3El5di/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471064, "uuid": "97e74858-1fa8-4959-af5e-308765241c49", "value": 942080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471064, "uuid": "2e1428e0-7a2f-4e5f-b937-b2645a7743b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471064, "uuid": "1a7baa05-423a-432e-8bd3-bd252b6ff72e", "value": "FedEx \u015eah\u0131s Form TR - Abroad_pd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e80e1a-99b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702470794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470794, "uuid": "07040caa-ecf7-43ae-93a2-c5f5ff1d41f6", "comment": "Malware payload", "value": "8e6f7a85d032d7f68c0d2111981f1baf", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470794, "uuid": "55ed5977-72d1-47ac-8b84-19903e549107", "comment": "Malware payload", "value": "83e571ae288ce7b75affa0031d7388c86be268f93442215a0f9de8f84fabd278", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470794, "uuid": "c4e00fd2-6abc-498a-950e-b9a80a9c6527", "comment": "Malware payload", "value": "eaf1ed37133849bd6df26c06e6ac5584a32eab64", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470794, "uuid": "9aeff0df-3ea3-4a33-9d61-72d817c25b4a", "comment": "Malware payload", "value": "4ff51940c5660fb86cef5624ec147ffa5257180a4ce203ed222767acc4b1e4634b3828d1d8653a8221dc067d16fdd0fb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470794, "uuid": "097e4a14-f53e-4da6-b8d2-f59fa2ec05fc", "value": "T13155021176C79632E4AB023135BFA7A11A7EBC305EE5C60B9384B75C2D313D053A9BA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470794, "uuid": "8e03e6fd-c199-4bfb-9103-5fff70072200", "value": "24576:e55OxtwYXtKgfk8c2GU8A5C9guJhEgUVaFdXft9R:e55Et/tKQcZsahE1VaFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470794, "uuid": "f0719e10-a48d-43f7-b720-5923fdbfff96", "value": 1363968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470794, "uuid": "edcdea5b-3352-4728-b615-327dc109728f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470794, "uuid": "8f2b70a0-f58e-4846-b78b-0234f2c41249", "value": "Google Gemini AI official version v1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0343242-99b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702472497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472497, "uuid": "ded197d9-39af-4247-80d3-3e7086dbb41c", "comment": "Malware payload (AgentTesla)", "value": "34793ade11411172d60e1eacf6c92bfd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472497, "uuid": "1e42307e-badb-40ec-9325-5db5d608b5e0", "comment": "Malware payload (AgentTesla)", "value": "84027098239c95b6ab961516849dac72bb2fc95fcf30b4172c17df971732edd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472497, "uuid": "ad3670ad-d6f3-4415-9390-6548cdbb9d47", "comment": "Malware payload (AgentTesla)", "value": "40d71238adbe533666a57be76197ed7d2cb4da35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472497, "uuid": "dffacae7-008b-4ac2-863b-916a55aa1d23", "comment": "Malware payload (AgentTesla)", "value": "baa35ba5e58c171d7bde02fde2b145797a145242ae9e89bb46b4d3f2eac523e4747d5b862523a5f82f110945807b26a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472497, "uuid": "58cc373d-5bc4-4647-bd1d-8e338efb2ec2", "value": "T190E423087BB24A0FE5F60BF3A5A1242627F0BC4596B2F7CC6DC632DE18F6B104562567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472497, "uuid": "ca3f59c6-fb4f-4b2d-9999-c79bfae96490", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472497, "uuid": "b828cf09-cc3e-4285-b857-3b3161685076", "value": "12288:6gCxq+4WpAEly7jKsvYyZ0YYLM+BpeZ0cnSvTnhlmbUgBwPz3hHw+VkrMh2DpU+:kpAE9Y+YZCa1SvTaHBEVbKOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702472497, "uuid": "4580f2b8-1f6c-42cc-b2fd-9ce7f4517f7e", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702472497, "uuid": "7d8f10a8-e516-4801-9c36-7ee9a8e5a51a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472497, "uuid": "47789fd5-fc67-4e52-8164-46a81d8866dd", "value": "34793ade11411172d60e1eacf6c92bfd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4495a656-99b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702469713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469713, "uuid": "e63b8e03-1a2f-459a-bf81-e67e05348914", "comment": "Malware payload (RedLineStealer)", "value": "9932a328e2e2dc740d724f509a1e7b5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469713, "uuid": "ca7b5b6f-d906-4faa-9aaa-74f1c74f66b8", "comment": "Malware payload (RedLineStealer)", "value": "8402bd674ef73cd0d1b1a1aac8c9d9ee50420525c17bac973dac86f8cf144c7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469713, "uuid": "de448b94-a887-4097-abf5-b86f3cdd4b33", "comment": "Malware payload (RedLineStealer)", "value": "77a478a42d927606277f995db05274eed8c51987", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469713, "uuid": "7ab1c03c-a817-4205-ae07-7473062bca4f", "comment": "Malware payload (RedLineStealer)", "value": "24c0a8396a0cffe442d93db63d1d9563c0223ddfe81e3fbe9285feca49375405069c1d5e05617ff6d85c544582510e67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469713, "uuid": "188ed509-11bb-410c-8a48-ab9876490dcf", "value": "T1FA543AE928A89062DEC273BDDCB5B3621BC4561913E3C71A22B74CF3F6713D165193A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469713, "uuid": "be495383-f7d7-4037-bed2-5ddcadd9f4c5", "value": "59737f231ef329f299654331c80b5130", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469713, "uuid": "ca5e4a1d-dc28-4a4e-a87a-f187d5c9e02c", "value": "3072:0OCFriTnuKyQvtfJibfdhISqExeJHjXPT5OUY2EvX61Yx1Eyh2K7c:jOiTn9pJi7dfuX7w2SFxaK2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469713, "uuid": "c3668d75-51e2-42b5-b824-264e2e650fec", "value": 302408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469713, "uuid": "7f139e47-44be-4428-b1f9-1ca9fe8a4fd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469713, "uuid": "9535e222-1bd3-40e7-8444-d7f753f4e203", "value": "9932a328e2e2dc740d724f509a1e7b5e.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c983fd56-99fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702502578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502578, "uuid": "8130e72a-3b64-47f3-a440-cb5a4d40fa62", "comment": "Malware payload", "value": "40b997b7c48aacce4933bf533a3fe81f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502578, "uuid": "5b3bd59e-8c09-4112-92d5-08242e426240", "comment": "Malware payload", "value": "84819d60f5a9000b73ee12c14a41216360aa61fda8c051c8aa584df292ac70cf", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502578, "uuid": "002ec0e5-f909-4dd3-b138-eadd1f310d9a", "comment": "Malware payload", "value": "1c5700b52fdc2be3172565c9a66db5150bb881db", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502578, "uuid": "da29d4a4-71ca-464e-ba9e-67c6e82d61b6", "comment": "Malware payload", "value": "95d128f6e7ff724ea43912c520d9f7f78bc0dead2b3121a943448be776886da52b803df906f3fe849054d4111a3e8708", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502578, "uuid": "f43af3e0-9d6d-45cb-b04f-030256d9774f", "value": "T1F4A70292DB6F2FCE3D281D4C045E7A5A4D89AD333D22C4F5DA9F240B82389D546F192B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502578, "uuid": "acc80c6b-e8e5-408c-8a4b-5667e5d55305", "value": "49152:ts5R4Exi3xp5FAge8OTQ38V2p3QzRNGZMXlJgNCItUuJCwoTDEcSHzJmh4kDzHBU:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702502578, "uuid": "5ff5f1c0-404b-48d6-ae32-94c223251eb0", "value": 47453923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702502578, "uuid": "fd379400-bc23-4092-a100-a5762725fea4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502578, "uuid": "84be345c-a4c7-4ee2-8547-cfffc6d2658b", "value": "Regenerative Medicine.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b544a4b-999d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1702461215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461215, "uuid": "1a596ecf-1043-412f-8fe3-66817b46b4b9", "comment": "Malware payload (Gafgyt)", "value": "a4e9aceb43ff857930e47b77c0e28851", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461215, "uuid": "895485ad-f550-4f10-a5e7-60f1e855a03d", "comment": "Malware payload (Gafgyt)", "value": "869a819cc5d7804b045ceada60ed1ecd5580e0f1ed333f63243aa9fc1a757547", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461215, "uuid": "233e1b6b-0d66-4026-8cea-163955d12739", "comment": "Malware payload (Gafgyt)", "value": "1267a8d4f26a693446dcb1b6e248f0d5f714cc64", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461215, "uuid": "11e8d20d-0df0-44fd-b936-7f0bffcf95b0", "comment": "Malware payload (Gafgyt)", "value": "6b14b7302f2657d3b5d9aac071a42798854cc9f7512768cb4bbec8d8f27dd8cd6b9fc556bb5b21fd3581b46a69f029a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461215, "uuid": "4f40811e-52bf-4f8e-9ad5-aecbda47272c", "value": "T179833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461215, "uuid": "b95c9e89-d92b-4b60-ab4e-897c1dfb64c0", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCIdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JvBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702461215, "uuid": "92275fc8-e110-4843-ba38-e396604b9ca6", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702461215, "uuid": "ebc21664-7bfa-44d7-a3b0-5a4c7d63bfae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461215, "uuid": "ea7d899c-2f20-41a0-acc8-f541948a639c", "value": "a4e9aceb43ff857930e47b77c0e28851", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474f24e2-9959-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702431922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702431922, "uuid": "c0ffe1fd-bae7-4e24-92ac-e693810f1698", "comment": "Malware payload (LummaStealer)", "value": "7217c3709f2bce073c28e3c62126c5ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702431922, "uuid": "afd7f779-a0b7-4d9a-a19c-8607a50eb37f", "comment": "Malware payload (LummaStealer)", "value": "8750bdd67a1ecaa07e2431fc016af78133ccf06a33b1118af63bfdddc5ec5670", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702431922, "uuid": "4a02dfff-11b3-4700-96fe-1850342e63d5", "comment": "Malware payload (LummaStealer)", "value": "afab2d22108a5b466798688c8c3d6d2b59966e50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702431922, "uuid": "a44aed5e-550d-4e0e-9a8b-768d28485401", "comment": "Malware payload (LummaStealer)", "value": "4bac46aae5aca61d2c7e174dbd154101ca9f8dfb6faf43ebe175ec0ea9aa4c89d53a75979c6b60879d8ca7b51c2da83f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702431922, "uuid": "94dcc49d-3832-4747-a6e9-959e0a3beea0", "value": "T1CA75234237E45475CCB66F7018FB16933E2ABE52C9B0435F76C5984A18B38C8AE3275B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702431922, "uuid": "3f0d5a59-50c0-4f2a-b3bc-206198145edc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702431922, "uuid": "98b1b322-05bc-41bb-87fc-4c66e06a651e", "value": "24576:QyxQGokOm0DGfTnV3vrc9Y3BTbwZlMvvYVg5obeUHyMSCyYwqfwa:Xxz0DG7nVQa9wZ3a5obeUPyYJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702431922, "uuid": "0f05fd22-0cbc-457d-952b-e613be37ce90", "value": 1569792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702431922, "uuid": "7e59e7ff-411d-4065-a709-ca1103972835", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702431922, "uuid": "46ccb5bf-f66b-4dc7-b0cc-e8c1091c9ee4", "value": "7217c3709f2bce073c28e3c62126c5ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80be663a-99da-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702487423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702487423, "uuid": "bd0cc905-b45f-4bbd-9b50-e37e1d07837c", "comment": "Malware payload (LummaStealer)", "value": "85a72351e9e8b94ac8cbd768f786810a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702487423, "uuid": "60f35904-e385-430d-97a4-ba3419f813ff", "comment": "Malware payload (LummaStealer)", "value": "8816147eb88a41aadb81e16062074ac5e3271915c6c2e697ce8d4ece6f4666d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702487423, "uuid": "99c50205-0c3d-4337-88be-9b08de2a31f5", "comment": "Malware payload (LummaStealer)", "value": "41df7277de9629f99b14ec01e304e03b0758d39b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702487423, "uuid": "29105c72-8742-4755-a6b0-3ed7292e863f", "comment": "Malware payload (LummaStealer)", "value": "6e8770dba580b94c133ccacc6f4b955cdd659dfa1edc16ae83312d9d30f6b6de2091078a8e861804eded6485f6654af4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702487423, "uuid": "50573e46-90c7-4cc0-bc0f-30f2905a6c39", "value": "T10B066B812D9D8424F2106F33F08F8F6B5E65CF55652255862B8C37CB5D22BBACB231E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702487423, "uuid": "a962d2c3-ca57-409a-8138-e23f5bd14bf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702487423, "uuid": "594576f4-3671-4bbf-8d05-9eb68add2389", "value": "98304:uGKVSHVbFhWPV1UFEiBcmn6broggGATK60A4pCQbSc3:v4SxzWPVocmnOoIA4pCQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702487423, "uuid": "ae0523b1-322d-4886-8948-004c7bdaa466", "value": 3732992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702487423, "uuid": "50ec978a-f833-406e-a936-b12f23f15235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702487423, "uuid": "21e2f1b6-3f6f-4e54-bd64-73b28cd82a4f", "value": "85A72351E9E8B94AC8CBD768F786810A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1b1e8a5-99b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702469869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469869, "uuid": "f460ed64-5bb6-4319-bd94-7003c5a76e12", "comment": "Malware payload", "value": "16217bd723d0c9c8917489e10f0d651a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469869, "uuid": "ff721ae0-387e-4ec3-945d-e1e48eaedcbf", "comment": "Malware payload", "value": "8a4f36b5cc7790284784c9e38bb8035e22eb3fd9bd3d87a495dd302d85e17efc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469869, "uuid": "dcc4355c-bcc1-46c2-bd0a-8b032f9f2a16", "comment": "Malware payload", "value": "1cc7045bd8806d7a87cc937462c5ced023de9d82", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469869, "uuid": "5cc4063f-ccce-429c-b30d-c526e17460e9", "comment": "Malware payload", "value": "a8b648809ef22a6a639444b50d78b598a250d2efcc546db7e7a9b7d669d961247a43f5487a81bfcd7afcdacb11273fe6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469869, "uuid": "80cf7a68-ea78-4981-a349-b36cf7b3ad19", "value": "T168631941B284C67ECE6804328CEAD7FA73797D449D48D26B306D732E3EBB614C681B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469869, "uuid": "509b3a86-9e5a-4d08-be45-1497e34fb577", "value": "1536:CtHflyz5m5K+VhPrExCrUM7ewSngC0h8:0Hfcz5m5K+VhPrExkUMK5nYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469869, "uuid": "3c9615fb-1267-4d68-8d68-9bd7d5a051e5", "value": 72704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469869, "uuid": "0234d418-002d-4782-b6f6-ad991fcbbbee", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469869, "uuid": "8b036917-c178-4f85-9ffd-bd2b97fc6380", "value": "Q_46Q0VWHU4.DOC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299bc5ed-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480835, "uuid": "f7e31a0d-b749-405e-b214-fc6b2ba60fac", "comment": "Malware payload", "value": "0a4c8179dcc6c0b01210612ca34621ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480835, "uuid": "78334ed7-bdad-4ebd-9e36-01bc38248e92", "comment": "Malware payload", "value": "8a7b1ebbc70baf139af7fe3307cebb472db3d0e4bc4aee7591a2810731c3703e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480835, "uuid": "08ed8140-f3b4-43ba-bf7f-8a19ccfe6a11", "comment": "Malware payload", "value": "5b9cea9686abc9abfc30856d0a69baee3c1837b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480835, "uuid": "be2136ad-df94-4af2-8bfa-a120b3258f15", "comment": "Malware payload", "value": "9cdea78d55dcdf25f977bb04189951fc6839c40c866858f0763ca0acbdeb6d7ce268c60bcdcaa1da015a944e1ec2c202", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480835, "uuid": "a1326f8b-3086-42f7-b3e5-c5e38cfe42ac", "value": "T1C0469D379E1D5CCDE90164719C1A8FDA2964AC20B5085B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480835, "uuid": "067369e8-4229-4c8b-ae73-eef4f9871f09", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480835, "uuid": "491419d9-4190-4c9f-887f-b62827a32f20", "value": "98304:ftLnXo6Cm3nGT0bwQggcAkhrqT9bOdxdp+mgulfa2FMIRavYd96:flXo/+nQZQZcACrkYxdp+mgulfa2FMIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480835, "uuid": "adaf0a92-82bf-4d1b-bcb8-88545c673270", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480835, "uuid": "7e90878c-d8f9-4721-956a-29a36d6c0ac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480835, "uuid": "62827273-5c6b-48ea-b702-2003bbb0d9dd", "value": "SecuriteInfo.com.Trojan.Crypt.29800.14649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "768f59ee-99fb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702501580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702501580, "uuid": "ced425a8-5133-4bf9-ae38-67416f40617e", "comment": "Malware payload", "value": "347b4f985414ca9f78bbbbff002e3ec6", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702501580, "uuid": "275f3ba4-78b9-4ab6-a632-8a9386bee626", "comment": "Malware payload", "value": "8afb71b7ce511b0bce642f46d6fc5dd79fad86a58223061b684313966efef9c7", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702501580, "uuid": "8f6f40ee-d94a-43f7-b1b3-ab7b2826c6e9", "comment": "Malware payload", "value": "a4b03f1e981ccdd7e08e786c72283d5551671edf", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702501580, "uuid": "ce9a0acb-1f93-4d36-a16c-1f1b17efc02e", "comment": "Malware payload", "value": "4ddcd71666f679e8069fa8feb3428c118ef8eafffe7045da6b9a7e24cdf05934e2d2a73062b84afedf3e63ca269ad014", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702501580, "uuid": "05789172-8b2f-4e9b-9843-0a3a30ff55f4", "value": "T1B255CFA439C72CA4F36AE5FC2967E6C871CD21D34964DA82350F52C398615B87A23D3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702501580, "uuid": "319069cf-ab0f-4f58-b327-d373b137086d", "value": "d14de6ced954f7de6c5f97117c6f24fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702501580, "uuid": "3646f5e9-3ccd-49c9-bc9b-0cebd1cfce04", "value": "24576:finmTffpaWRle7THhimdPKz6v529zfrhxIFxSwNFdi2GM8:finkaWRleXlT2hqFxSwk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702501580, "uuid": "59b11e75-1698-423c-8ddb-519c5e1a9bae", "value": 1304064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702501580, "uuid": "9d2ff32a-54e7-44c7-9c32-c9a85546d8df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702501580, "uuid": "f70470f9-0499-4ff3-850e-477a81be4d84", "value": "BringDouble.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9435368f-995a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1702432480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702432480, "uuid": "3daa99b0-52b7-4ab8-832b-76f960ffd020", "comment": "Malware payload (CobaltStrike)", "value": "a9cd040f3de100f802ccbce93bebd7a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702432480, "uuid": "fce9e9c0-e933-4ba0-b302-6144700a4c5d", "comment": "Malware payload (CobaltStrike)", "value": "8bfed2fc726e8d292fb7fd8238409aa096b8a17a6030c9aca6995bcbcf6b7a47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702432480, "uuid": "adc29bcb-b2c4-44c3-9077-6143a32bfc83", "comment": "Malware payload (CobaltStrike)", "value": "ceb22b979c3f2dcd50f659c48241a223bc8b19f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702432480, "uuid": "4941ba6c-a3aa-4947-b934-cf812517faaa", "comment": "Malware payload (CobaltStrike)", "value": "01d215b62ac9ffe964165f36f958950c13fd39969dc9a274c009cb5d9835481dbcd4df5f17e565c616a6f5ed954f3f01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702432480, "uuid": "7e81ff57-781c-48dd-9fde-dee09fd3976d", "value": "T1BE522935EB4378F1FD1A897414EBB6FF9EB3E2238C111C96CF94E80559234A6880765E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702432480, "uuid": "ca69b9db-035e-4abc-a210-4bb364fce9e0", "value": "dc25ee78e2ef4d36faa0badf1e7461c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702432480, "uuid": "3b253069-fd77-4878-b354-08df61f57a87", "value": "192:ADH+DgGK83SxHn2OQ/dmBI4KBfTgir+xzx5a07bqUqV/Qjo7AGa:AT+kGKqbOCdWIVBff+xzaAfCXAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702432480, "uuid": "a0f35624-4509-42d6-91b6-ce2e123a0982", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702432480, "uuid": "5f110b24-a8b7-4bd0-95b0-51bc0c10b1f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702432480, "uuid": "b9b87bef-b29c-40d0-a72e-b6a3c366fd4a", "value": "a9cd040f3de100f802ccbce93bebd7a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43c0a2f1-9952-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1702428909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702428909, "uuid": "b2c9ea9b-2af5-4018-aba7-d2a1912f463e", "comment": "Malware payload (AZORult)", "value": "5f928d186645503a400b6d5c5bc04a66", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702428909, "uuid": "85ad9eca-8f20-445e-ad47-6deec2633b10", "comment": "Malware payload (AZORult)", "value": "8c0204e55e1389338cabb0b8e552ceb382667715d9b97110c6fbe756bbb2f98a", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702428909, "uuid": "80179682-0d08-48ea-823b-3d839adb8cc0", "comment": "Malware payload (AZORult)", "value": "8521d137aa64d3781019d3e96c7a9d35ffd27fc8", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702428909, "uuid": "c10f6afe-a57b-481b-b40f-567a8c3b52b6", "comment": "Malware payload (AZORult)", "value": "5bfa3f9fa944f04c9ba4335637c2ea89b3f7d2b81974707bcf9018b5870ff0d79d644a57c80d3b0d507d2fa5b6bdff2a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702428909, "uuid": "44e37546-4d59-4e75-b18f-c84ee54849e5", "value": "T1004533B3D0B8D43ED62497320BBA9D14AC7ED2B404794A9F0B79A8A5B35338DF4195CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702428909, "uuid": "da84a2d2-9690-4fe2-a28c-0242ce7f55c9", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702428909, "uuid": "36edf056-75a7-4f1b-994f-3f75f553f948", "value": "24576:MZnDsr63UOeIqFq+o8uvxKXrsWGAzqZ003A2AKCfrm16vY1w4nY6ugQi3:DrAUB/UvYXX1qZD6KArm2Y1w4nY6yi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702428909, "uuid": "b1a6a201-16c9-4a3f-8038-7befea282f9d", "value": 1170304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702428909, "uuid": "5b3e1206-b657-4015-9f24-c180cf25ce15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702428909, "uuid": "f8a0a2c0-2d24-4d20-9aba-11c160a34a27", "value": "Document SWIFT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5108ae14-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480901, "uuid": "705c7de2-46b7-4006-9416-7ff25eb7ba40", "comment": "Malware payload", "value": "3270e301725948eeef183504353e4370", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480901, "uuid": "adc711f9-c204-45ce-bff8-11528f51ac5c", "comment": "Malware payload", "value": "8c238c9a39b92f10a78d36e8c5dd153cd7b451355d6e8e5f17c6f4d52710e29d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480901, "uuid": "c3d71503-a963-4bcb-92b4-3b7d99b9355b", "comment": "Malware payload", "value": "24dec9e6fcc1a46a17006bf7b6ae55ebc95828ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480901, "uuid": "0f347a64-2630-456c-a1fb-8f86393beaac", "comment": "Malware payload", "value": "566335033081c1bfa7d720e19615215ac48f84ed8f812d73cbfb6f1b27c41f33da0c6287f0611034ed43d0c6eb1fa84c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480901, "uuid": "e4c762cd-384f-42db-8065-5b158ac23e04", "value": "T136469D379E1D5CC9E90134719C1A8FDA29549C21B5086B9B76C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480901, "uuid": "f34b8b10-5ae6-4a00-b02b-a74c26f5ee33", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480901, "uuid": "6c5863c1-94ae-488f-af9d-2ce5d5c9d6bc", "value": "98304:SuQxIgTiQikbnbY4aHhFeOgkmrhaqT+ZOwlpxeeoiVLiiR44GqmIgdy:SuQxDiQiUbYXXe/kmlajrlpxeeoiVLiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480901, "uuid": "af0c8713-46ce-4fb1-9de6-5b249261d994", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480901, "uuid": "c0b85883-2c46-4d5c-a14d-2bf337a0a02a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480901, "uuid": "9adb4ecd-1aae-48cb-ba7c-b13df75296b3", "value": "SecuriteInfo.com.Trojan.Crypt.21454.10224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d3874ce-99ab-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702467150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467150, "uuid": "5c19a2bb-3d30-4b7f-afd8-391a6fb5dc8d", "comment": "Malware payload (AgentTesla)", "value": "d240933f4f32390711707b710716d0c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467150, "uuid": "2e0219e5-f5dd-49d8-97cf-f6d91293c2c9", "comment": "Malware payload (AgentTesla)", "value": "8c3df75077ed123924224935250b7ea35f29f38bee3f2e2fa40e3cbbd3d81a69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467150, "uuid": "6fe4f48f-07be-4184-af84-8c9cfc8cc3cd", "comment": "Malware payload (AgentTesla)", "value": "20486627a69245241cb066217dc1d12f738a54c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467150, "uuid": "51bfa000-3529-47b0-a30d-85007440f014", "comment": "Malware payload (AgentTesla)", "value": "af0c5b2b5f05be278e3f00e52fdbf7fd3bc852185ae199c19ad50bd794020f3da2b9ca4fccc675302a9aea09f096e1f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467150, "uuid": "374a5a34-cc55-4172-a035-3d886991524b", "value": "T19615C33D19F92223F175C7A5DFE0C527B160A5EBB162AC64D8D243960307A4BB9C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467150, "uuid": "2196de92-27a0-4b5f-9ecd-d9d2b620fcac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467150, "uuid": "11fe8883-37bd-4ac6-88c5-45e4341eff15", "value": "12288:aRDtzD5SRU0iLao6f+Mai/zTfqXIkGhWwBRGtzKxjm8Th0:ahtAVRo2b/z7Wt1kR8gc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702467150, "uuid": "ed506932-b3c1-4dd2-8376-78dbfb0f112d", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702467150, "uuid": "67f46ca7-a84e-41f4-bc5c-47d1d9874524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467150, "uuid": "26e436a8-c85a-414a-9e66-d5f01e20b3d8", "value": "rSOA2023-50HAPAGLLOYD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c659d2f4-99b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702470790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470790, "uuid": "e8ca6f4f-23e3-426e-8c03-6bded7bb6340", "comment": "Malware payload", "value": "47859ecce9efeddeaa7ff2bba72c3e44", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470790, "uuid": "0130c1fe-6d38-4436-84c6-03474c4e7027", "comment": "Malware payload", "value": "8d19a3526711185a27679c885f1888e60b29c7fb4994c1c53b479f39f17ef347", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470790, "uuid": "dd952625-861d-4b47-918a-802e955dfc83", "comment": "Malware payload", "value": "3ac0a0e7a444c89b3ab8781d59efe7254edf57e7", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470790, "uuid": "64b90951-acf6-46d2-98ce-d8db3bcf4294", "comment": "Malware payload", "value": "564f2a94853cb0c28c63e18db22810dd7ac12ff406149dc5adda7055588611179e339ff1f84c0bad7eaf44666f60bc4d", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470790, "uuid": "3f884801-a456-4fe6-9d27-6cb5db8d7d36", "value": "T13E85027061827DEDDE32DF7CA80A1DA38C56848BE145C5C8F984DBB123EE9568E5CCB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470790, "uuid": "72d72cd2-0e8f-42b3-b415-da57565e0ef5", "value": "24576:YqYiq3WKbG1zKnWBCXSDkfDd5HWpeaXInoFzd822oD2hfKYL:/3impea4nQ6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470790, "uuid": "14279b29-ea3c-4c34-af38-c3513e045dd0", "value": 1759281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470790, "uuid": "9e7a8f0b-674e-493a-a396-9eb97871b0cb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470790, "uuid": "5ffe9350-0ef7-4bb7-8bf3-585dfa1598f8", "value": "16459.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a259c20-999d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1702461240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461240, "uuid": "d034ea4b-4c3a-44c4-9c27-af37fa3e7084", "comment": "Malware payload (Gafgyt)", "value": "d3d07195cfc8c1794321bbce74890567", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461240, "uuid": "c1aec747-2d21-47a6-91ed-9ce7282dd698", "comment": "Malware payload (Gafgyt)", "value": "90922a105d47fe682a8d4725202aa1fda02bf05c83182ed64de3fabf286d1b17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461240, "uuid": "390d76b1-063a-466e-a233-97aebdb9a41a", "comment": "Malware payload (Gafgyt)", "value": "1977a62aba04c734222657c010250aeb33d4b9ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461240, "uuid": "24b37e8d-6cea-4c20-868c-47a74b6dd5a4", "comment": "Malware payload (Gafgyt)", "value": "97a21b837545242ecfc9c34691cc923de50841dda983dbc416439e6483c3bc66c8418f7a307b0ae3aef25a9f3ec6685e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461240, "uuid": "515c0851-baf6-4ae2-813a-454c10195835", "value": "T12F933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461240, "uuid": "750fdcba-01ed-4dc8-95f0-a45549715d44", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8Ul4umXxVqDrstKfz9e:Q97vk51RcG7AKl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702461240, "uuid": "b15764ca-5427-47d1-967f-5b6d23db1173", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702461240, "uuid": "72f94e1c-9705-42ec-ad6d-0388081d506f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461240, "uuid": "6541a43c-8ef2-47e5-af68-aebe4d7144c6", "value": "d3d07195cfc8c1794321bbce74890567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3798bea0-99c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1702476134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702476134, "uuid": "3340f321-36e0-4b9f-8a60-351d28764283", "comment": "Malware payload (AsyncRAT)", "value": "5cbd81023cd2af1594d0f53b9698f2be", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702476134, "uuid": "35d21e7f-4bef-44cc-9421-b51182b7ba1a", "comment": "Malware payload (AsyncRAT)", "value": "91e3037a261b4ee83292a1b79546019d2f3cef72c27377f33bdbffa65cbec41b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702476134, "uuid": "d41837b1-24b0-445b-ab17-634ef9c2bfea", "comment": "Malware payload (AsyncRAT)", "value": "94f45189a35ce8ee3a91ee96572752cbfdaa781c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702476134, "uuid": "46bafd15-9c3e-429a-899f-2213e9f9168b", "comment": "Malware payload (AsyncRAT)", "value": "c2bf8fcbb79857cba39536ab5221f157a332db444162ca3c2281ad9df8c6fd0bf07756648c0fdce234341372339ffdde", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702476134, "uuid": "9679a0b9-15de-4678-8c79-7291c5711579", "value": "T17C35DD343979BC2043DBDA1334F14BA65CD9568FC5703A3B199AD423AA346C265B22FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702476134, "uuid": "1929ff93-bdc8-40fb-a484-be2320c24038", "value": "1536:zgzjIiywGosQIMI43i/hc/jP1x+MKDhsN6/EIm+lIWFw2m7ictdZ7LLmoBt8c6XZ:czjIi7OQKT/hcLP1x0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702476134, "uuid": "18e39f70-feba-4c61-be1b-c6346c920704", "value": 1159545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702476134, "uuid": "47757bee-ede0-424f-8b4e-70b4d817c9d2", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702476134, "uuid": "a9df7dfe-3c74-4b22-b9fc-96080ed23bc7", "value": "last.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931a16cd-9a02-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702504634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702504634, "uuid": "f3595f4e-f923-4771-9698-f936458e115b", "comment": "Malware payload", "value": "760ada04a2b937dd81684807597b27c0", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "HTTPS", "colour": "#B27793", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702504634, "uuid": "cd3771d3-3b91-43d6-9c33-e3156a4738eb", "comment": "Malware payload", "value": "92c7693e82a90d08249edeafbca6533fed81b62e9e056dec34c24756e0a130a6", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "HTTPS", "colour": "#B27793", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702504634, "uuid": "ca7d4629-e6d9-4068-99fa-3b3496dc733b", "comment": "Malware payload", "value": "66e3f470129dbcf3a7da958405f12abea73b8a69", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "HTTPS", "colour": "#B27793", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702504634, "uuid": "3a8bf99d-b4c0-49c7-9fc7-496a3f667aa0", "comment": "Malware payload", "value": "64f2438ab1c949c27781c596f39a4a44eaefaf05895fe4d3e73d698158d48871aadc6456665687ac8143794d0e167989", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "HTTPS", "colour": "#B27793", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702504634, "uuid": "b7cc764b-e770-432f-b1b9-d99289e9d397", "value": "T110C38D776ACCCBEDDC88C33A54A1B079F0A3280776CD46EB02965345A714DD4EBFAA41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702504634, "uuid": "9afe1a41-07dc-4ead-b00e-4b04d72a0a8f", "value": "a71f9a1c4a1445f92b7bbca6fba33a96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702504634, "uuid": "648ead27-df77-4f18-8e7f-1b4a0a466375", "value": "3072:xFNuSUtQn/Td4yx4HSZ9Pk5L6wBp8gFK5PPoy4Fgnw:XbUcbdDkY9kp/KJEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702504634, "uuid": "46936835-7396-4154-ae76-fbd5d930fe5a", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702504634, "uuid": "07495992-7f55-4f18-bdce-fc7d849156a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702504634, "uuid": "0bd7db47-c9b5-4048-bc85-4a5ce2c7fa5f", "value": "760ada04a2b937dd81684807597b27c0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af3a1c96-99b5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1702471610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471610, "uuid": "4934d9c2-246d-4b2f-ac6c-9fdbf764fa48", "comment": "Malware payload (zgRAT)", "value": "f63691d0740dcbb9f2f1193f7cf6057e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471610, "uuid": "4fe9186d-0567-4366-95f7-ebbcd67543bc", "comment": "Malware payload (zgRAT)", "value": "9308672369748963a12d1fda1ad2151df4c8b6b8a092bd72eab3fe13d6fb86cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471610, "uuid": "e1bbf1af-53e3-49b8-b0d7-f8a63ca7497a", "comment": "Malware payload (zgRAT)", "value": "ff7fa47e66027e9e312e4debbb73c2b01c4e337f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471610, "uuid": "97e7acdf-d83e-4bbd-a0cf-685f00bb407b", "comment": "Malware payload (zgRAT)", "value": "4ae428b9f21b4c2dda317389fae29ef572c06a8c917b1ac345b5e10bb3b06ce3c50604509c140521b357f0f9fefb55bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471610, "uuid": "b9b8c7a7-a295-45f1-b541-f76593fc8fb9", "value": "T12305D07622130E29CB756734A973EB010951FD7694BA9307E3C1727E616B1AF2FA2703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471610, "uuid": "b65fdd5e-093a-4a9e-a271-15e7462dbf12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471610, "uuid": "a19d92ea-3594-422c-832c-6cf6a5515d0a", "value": "12288:FgiWLAS8RJY+EWR5uOpBzbWFRXXttGwt9XjYhRfsk24bNC57Ja6E5J0:WUJY+EWR1B2F17vTXjDApjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471610, "uuid": "d2307b63-5000-4475-9d51-4ce8eb7e3f7d", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471610, "uuid": "c17e093a-afde-4b19-b139-3096dec8b3f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471610, "uuid": "8aa15577-1447-4af3-8f46-8d4caaa00257", "value": "Helfzyvvdgy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757b24ea-99ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1702467647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467647, "uuid": "226d584f-4f35-42f3-ac51-057adf6b3599", "comment": "Malware payload (zgRAT)", "value": "4e9de821f3d7e8deeaa71691b130906f", "object_relation": "md5", "Tag": [ { "name": "r12", "colour": "#41F559", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467647, "uuid": "5a9ebcd9-9be6-48d4-9933-d5270991a012", "comment": "Malware payload (zgRAT)", "value": "9319970c137f387d9907d3de3d849ed2c0923a8eb14ad5f412bb06917264362f", "object_relation": "sha256", "Tag": [ { "name": "r12", "colour": "#41F559", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467647, "uuid": "096d5e90-10d1-480a-9c14-46e35e4e7bd0", "comment": "Malware payload (zgRAT)", "value": "9a2caf0ba86b2d55211a62cb90854d7535260385", "object_relation": "sha1", "Tag": [ { "name": "r12", "colour": "#41F559", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467647, "uuid": "9e3d0e9e-a2bd-4d66-b707-ec9e7f493d4d", "comment": "Malware payload (zgRAT)", "value": "f688756634b1f1f74c32734cf9461c34c229e70af3a01f696d284c4a21170fb35b5133dfa3b70205ed47ac6a87d77250", "object_relation": "sha3-384", "Tag": [ { "name": "r12", "colour": "#41F559", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467647, "uuid": "e8db571e-d7d4-4d1c-b41d-96173a063988", "value": "T10E5533BE5748933D4BFDBF992F7108EFB257E6D5650421BC10C4D6AA78B006E325D02A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467647, "uuid": "a287cbe6-86eb-49e4-9e68-e5914db9f16b", "value": "24576:ZNeC6cakcI/8aGioNxMazRD/uy2QNOCKQ8gNOp6VT1J34x3Bhdfw9aEZsCXlsLtz:H3668hZPrzJjLNOCd8Mi6VBp4ppfw9ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702467647, "uuid": "c9207d8e-ddc5-4080-a614-545a42b06489", "value": 1384218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702467647, "uuid": "f059b384-0fde-47ad-8559-6253e10d5367", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467647, "uuid": "c4edd33d-0eea-498e-a2cb-6b40139aca68", "value": "nDesktop.r12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695a4801-99ec-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702495115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495115, "uuid": "478238e9-1e08-434f-90a2-eef7306288fa", "comment": "Malware payload", "value": "9cc37f2fc9b87f09acaa2e8df0b7f5f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495115, "uuid": "ac1e9469-0629-4ab8-8c42-28c40d86c72b", "comment": "Malware payload", "value": "9331f9970a83bda8893c6ace5048f736426c8cbddbd7cc0857a7a7306efa9ff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495115, "uuid": "e8258906-82cd-4123-bd97-45640ed96e08", "comment": "Malware payload", "value": "0eaa44b79fe8268b14206fd4099ba8426acd36c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495115, "uuid": "1d6c5bf3-cfcb-4912-9fdc-6a3050b02733", "comment": "Malware payload", "value": "8343ece81ad620aa7334d2de490ad4fa50addd24dec392311ea9e2fbed80106487add0d14d1da9c5b990048466a63c90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495115, "uuid": "37c35a50-6cdf-44b1-9f7c-0af9b668c1b3", "value": "T1CF2272D5AEDC05F1C43347B24CA637062563FD6B8C7A2E692C27B34658324A21A73D9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495115, "uuid": "f793093f-4820-4bbe-887d-011f3e33a218", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495115, "uuid": "e5697958-d707-4ed1-8dc6-de8a35262627", "value": "96:bguFJ4OlhUP0bsmyZdYLQr/rcb00EDJs07x2k4zNt:8246poo79ED607Ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702495115, "uuid": "ddfbc283-a5c3-4417-8a73-3d77f604f398", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702495115, "uuid": "d255a2a2-ecfa-4a0e-99e0-fa3aae042022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495115, "uuid": "8c4de929-a836-4a24-9656-2630a4d3f23d", "value": "Product Technical Specification.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84347d62-999d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1702461230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461230, "uuid": "41d70116-8d5f-4c32-b1db-bd3691d6d9cf", "comment": "Malware payload (Gafgyt)", "value": "6b1ae3dac01ee2d8b0fbdeda86e2d4fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461230, "uuid": "2b402096-55d9-4c3d-bf5c-65fa0a455ab1", "comment": "Malware payload (Gafgyt)", "value": "94971c673aafb8b68ac6d5f00f2ca24612b1ae03047713617d6aaa8e4c830ad1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461230, "uuid": "5d426de7-8875-4628-9ee5-c900f593fbc6", "comment": "Malware payload (Gafgyt)", "value": "99170142bde1f955c6787f305e29026ceb16f743", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461230, "uuid": "8c802bd8-a284-43a2-8445-ebd0113236a7", "comment": "Malware payload (Gafgyt)", "value": "94eec1506aa11c17978237497a9caff1e8438bcc13aefd207f55453747fe38ac3092017404ad77347252bb251cfcf2ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461230, "uuid": "818405d5-10ab-4431-832c-a24970040300", "value": "T118C32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461230, "uuid": "84fc4f33-51cc-455d-9e88-51aa05288c4f", "value": "3072:ekYPUfsgnsb0J2ag/VfrkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0rkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702461230, "uuid": "a3c63b60-a01a-430c-ad5c-d1e53dac128f", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702461230, "uuid": "0020e567-24da-449d-bb91-6630c8adbc90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461230, "uuid": "10d2b936-23ba-4e6a-9eed-e8adcb86d981", "value": "6b1ae3dac01ee2d8b0fbdeda86e2d4fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ff41ef-999d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1702461206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461206, "uuid": "111c303c-84b3-462e-b9c1-bec796d3785d", "comment": "Malware payload (Gafgyt)", "value": "14692591f852f58457029669bdfb2361", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461206, "uuid": "9a59b135-b64b-4bad-984a-aa6b6694bbdc", "comment": "Malware payload (Gafgyt)", "value": "94e21021e1933c8845596a93037c0bb70488a46eba4bb0c21c17636877f58cab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461206, "uuid": "54f48be4-397e-4905-a908-5463a449ce86", "comment": "Malware payload (Gafgyt)", "value": "7d6ee2a02b1de3547d879385bbca2c9f3118f500", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461206, "uuid": "97475ea6-0ed8-4c48-a558-7d3c035ccbec", "comment": "Malware payload (Gafgyt)", "value": "0a4238f986208caa0078dc3f667b978ea077e764e23b2efc1d06584e2bc57d47b3c9893f281b84dd5a3bb4d930dcd31e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461206, "uuid": "ecc2762f-7c64-4b7e-be42-f8b4f4dbfd3f", "value": "T15AA31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461206, "uuid": "9e540732-c9fa-45c3-a9f2-41fd385ce381", "value": "3072:VSx+i6mqaObhNynPNKV+qKmZuqQ4DPwXXtse:y6mRObnynP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702461206, "uuid": "ff651aa1-ad61-4912-a184-4c83e6cbdd56", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702461206, "uuid": "0bf57a53-26da-471f-8790-57c5658688e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461206, "uuid": "217486b8-4af2-4233-badc-b3af7ffa9eb0", "value": "14692591f852f58457029669bdfb2361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a063d8-99c8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702479667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479667, "uuid": "76ee2b9a-ddc0-4a5e-9888-0a6c69d99e4f", "comment": "Malware payload", "value": "dede116be44b342ed69f51c0d6b048b2", "object_relation": "md5", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479667, "uuid": "c72a78eb-8b1a-4cd1-b0d5-ef6a736cf943", "comment": "Malware payload", "value": "9552d98f0da192781d48b22fb308519e2bcb33ab668a922298cebbfe1e3566ab", "object_relation": "sha256", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479667, "uuid": "4436f028-4d57-4d73-8c43-738e3074a04a", "comment": "Malware payload", "value": "d75a66da412e2a609893b020b446ad4f986d5f26", "object_relation": "sha1", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479667, "uuid": "97511004-c4da-4bcb-8c57-02c5eea0a5d6", "comment": "Malware payload", "value": "598b03f96d4d82dab65203c403fbe6956c0fcb8af87b9434d427105169f8a0d97ad408f3a0a86a176a9d3500d19c4a29", "object_relation": "sha3-384", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479667, "uuid": "aa73472e-751b-4741-9fc1-e31962d70a0d", "value": "T1FEC022244629C065D2024502625CBD09F80EB0080CEAC42C91C2C89A8C44090CD0D4EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479667, "uuid": "a5bf3bbd-00c1-45f1-90c3-f95bdb805e3d", "value": "3:HRAbABGQEb7PysGIyYeARyuJcXVYMf1LjRuAsQUO25YdimVVG/VClAWHyn:HRYFJb76styYeoyRXGMfHsXr54vVG/4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702479667, "uuid": "c5dc26a9-b65c-44eb-877e-fe3a6177adc0", "value": 191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702479667, "uuid": "e81583cf-6eef-4572-8c62-c52468c353e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479667, "uuid": "a94f82e6-24c7-4233-950b-7a3a00a1ac16", "value": "My documents pdf url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2891e35a-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480833, "uuid": "c7d880c0-d998-4bb4-8545-65f34b4f5283", "comment": "Malware payload", "value": "5c7a0b870847d827427877524ff83d36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480833, "uuid": "3cdeee09-cee6-4bd8-b325-5bb3302a8db1", "comment": "Malware payload", "value": "95c1f8f48983591690102d20cd620978b114f02b9e6b9634495ed622c878c2cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480833, "uuid": "f3c31341-e2a0-4bc3-86ee-99ace6ccfd51", "comment": "Malware payload", "value": "f7d340687312394d1c696c74a033386ba624c6fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480833, "uuid": "7a11cdfc-4e6c-41b1-942d-57deaad9f54c", "comment": "Malware payload", "value": "0842435b6500b94fef8384787f1c06fbd95a3b9272c61fd85c015e9fb80f0f19f1b5601c8e54814370d60ee5fda8f915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480833, "uuid": "7cefc0e5-2fd1-4b53-aaed-698d73828f23", "value": "T1D2469D379E1D5CC9E90124719C5A8FDA2954EC20B5086B9B76C1B96DCCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480833, "uuid": "49814c39-4530-4ccc-befb-dc032837b9e8", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480833, "uuid": "78fad1ef-7550-4853-afd3-1318d57a3029", "value": "98304:cx8atKxtVG69wSE5rsgjDIhtqTGEOjzZOVGwx1XKXtb7I5eQIAl:c5tKDc6KPrdjDmt3bzZOVGwx1XKXtb7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480833, "uuid": "294b367e-8871-42ea-a5dd-1c4fe2085b52", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480833, "uuid": "224ab973-9d29-4f1d-b51f-7beed35ba229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480833, "uuid": "6f3ed9e3-35f2-4346-92c3-36058c5ae423", "value": "SecuriteInfo.com.Trojan.Crypt.28968.6624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3575f5c-99b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702469872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469872, "uuid": "2331ccbc-afdd-4ef4-8dc5-b2218c69d550", "comment": "Malware payload (AgentTesla)", "value": "5082ed234bb9cf8c080002d2ff30b5d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469872, "uuid": "61611a6d-be21-41cf-9b9a-91d3110a5b9f", "comment": "Malware payload (AgentTesla)", "value": "95e38285534135da269853c1f565d622758bec0a2e6bd27da61ec6cb8fb72749", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469872, "uuid": "30589ec5-a68c-4908-b037-1b9608988d14", "comment": "Malware payload (AgentTesla)", "value": "aa401463cb2028eac54aff2a458b035d765cd399", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469872, "uuid": "e247de1d-2628-4828-9e8e-e35ab70d52f2", "comment": "Malware payload (AgentTesla)", "value": "adc47b2441146852c6056b02c0cb3e190f71e3bd941f621d285e41990c0fbc97fe151d17d49cc01f4266e41b5a454ccc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469872, "uuid": "13d9bc89-e1ae-4967-9482-832923b71f60", "value": "T19835DF03A910DF93D00D83F8AE631AD90F0B6F18E595AEDB04637F8B3A716A21D5B51D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469872, "uuid": "d282b7bc-ed3f-4f61-864b-09638a35c3c8", "value": "24576:ww6/4ZyLAXZSjyw6/bZy/AXZSM9QcI3thv75qNTQUJQwS6:r6/qFEB6/9REnr3DlcTQsQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469872, "uuid": "8a0ee0df-35e7-4319-82fe-0163e88f36c1", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469872, "uuid": "27fd55ad-6be8-45f0-8ac3-fa4d0b081f84", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469872, "uuid": "28ff576f-ca77-4c52-8957-0ceb526da065", "value": "Euro 36280.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef1c257-99c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702476683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702476683, "uuid": "a34ef5ff-a625-4d0f-b004-c7f6e763fc8e", "comment": "Malware payload (AgentTesla)", "value": "4f96b7f711eb87cc90c225af23aa2e4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702476683, "uuid": "68ab077c-f9b9-41c9-87e8-abf1de14fb9b", "comment": "Malware payload (AgentTesla)", "value": "9824b822a689518c8db4e0c8ab997a7bd149c57618bdc7790d1dc121a2493a86", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702476683, "uuid": "552a81b3-00ce-429e-b441-bfcd0294bec9", "comment": "Malware payload (AgentTesla)", "value": "d8700f13c05bba09e60ac0ea9970aa2c9f6db6f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702476683, "uuid": "5a02909a-2589-4de7-b1ef-e33d2052c4c0", "comment": "Malware payload (AgentTesla)", "value": "ccdad0b29d423259c9bd51f70101a7c6d6542d345f22258dff4e46e7a28b5864b0f3e94edb1da085b470fa8f312dd483", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702476683, "uuid": "7d9f9788-5308-49c4-9d65-5a6dca646c1c", "value": "T14F15A13D19F92227F175C7A6DFD4C523B260A5EBB1629924DCD243964307A0BB9C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702476683, "uuid": "a4e52f61-6982-462d-9b88-57ec06654023", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702476683, "uuid": "9cad736a-bd94-4c36-a13a-d42619b02345", "value": "12288:RfuZJFqvsFUdrO8pORKeTszIGNPyjb8srcE6cGpJPg2RDJ2Lx34:ZgzKBO86TszAv8sgc4JY2RDJ2LF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702476683, "uuid": "3a93c668-2c0d-48bc-bcb0-f7c0779043d6", "value": 940544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702476683, "uuid": "f23e3d3e-d25f-4670-8727-c72887033264", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702476683, "uuid": "bffb355b-5fdf-48aa-b353-ed2a2d802119", "value": "Commercial Invoice and Packing List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef02f58-99a6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1702464925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464925, "uuid": "edb8a390-d704-4ea2-9cb2-b680deed87d7", "comment": "Malware payload (RaccoonStealer)", "value": "4ca6003b71e17022a936283c5f156409", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464925, "uuid": "7b43411f-eaef-4fa5-8278-3a3028eb0369", "comment": "Malware payload (RaccoonStealer)", "value": "983973027f8ada09e153b25ff02bb3b2f17c1c83376b0cd012eb93cf1116bff1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464925, "uuid": "b77c09db-11b5-4f5b-aa70-c4c0b55a44f5", "comment": "Malware payload (RaccoonStealer)", "value": "e3e545066a8dc7169da5561ecb837ddf7d109fb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464925, "uuid": "3d04d1b2-0d9d-4510-8f05-3e1e3b1f1304", "comment": "Malware payload (RaccoonStealer)", "value": "8d329bb0e916f426a4dbb9985d17fa90b8ea7dea42c3066e7128feebb3130a7079dfe32afaa104246cff1dcd8eb41c75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464925, "uuid": "d46c5a03-fc8d-402c-a038-57d81feb5867", "value": "T15F3623731769024AE5D6CC7ACA37BDE532F647BB9F80BCB8609B6CC425129E0D603953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464925, "uuid": "6b35ed47-3f5d-4510-bff0-c8fafb0ede3d", "value": "595cc7a068cd47980fc72b40b8f15027", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464925, "uuid": "f81a8fbb-c52a-4924-bccb-e305e33c5fc9", "value": "98304:/0xiL62EqHhq0SZkpxOo3iW8YIYJu34sY0n2DwBiPZlhScSlDOkmDNl2s:sxqo0UkKoyBY4zwzhBODsr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464925, "uuid": "3889b548-f9f9-49e2-98eb-b240eece3043", "value": 5035008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464925, "uuid": "14943f25-4c4b-4494-adc1-91f42023f98f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464925, "uuid": "b86ee9aa-6e2a-4cd3-aa70-26679714fb6b", "value": "4ca6003b71e17022a936283c5f156409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5f8991-99ac-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702467662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467662, "uuid": "07aafd9d-5b61-414a-8492-5dc80e706920", "comment": "Malware payload (AgentTesla)", "value": "7885cdf13b2df5ea853b2f97dadfe06f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467662, "uuid": "466a02ed-ebbf-489b-87fe-659fd3a0996b", "comment": "Malware payload (AgentTesla)", "value": "98ab9015ecdc96f72bf9002e753b766c1d5d2526e8b2b8a18899d1c91ad6e7b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467662, "uuid": "f2b31ea4-d65f-40c5-9444-6e8c34b692a1", "comment": "Malware payload (AgentTesla)", "value": "73116ef98bb6c2914435f70cef07fb22c0d08f04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467662, "uuid": "fc59de63-6c34-4bd8-bc23-d541147d8d26", "comment": "Malware payload (AgentTesla)", "value": "7558b2695b5fc409f8220901b91e3a90311a27bce8c4bad8af24a106531b26a324db92231b68ca0d8bfbcb154ab0af3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467662, "uuid": "31ded14d-6882-43e5-af96-c294e8c3fe2e", "value": "T1F715B23D19F92227F175C7A6DFE0C527B260A5EBB1629924DCD243964307A07B9C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467662, "uuid": "e08c2041-86b9-4767-937f-0cefdeabaa6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467662, "uuid": "48f04b39-75a9-4aed-8fcf-0a3a0f9aab5f", "value": "12288:pfu+wm3f9LE5AHA/lWxsm5GrHpRkkx8jS+Z8IuPmrMc0wirSNaLrG:RFw8E5NWbArHpRkkCJZ8TPM0wiLrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702467662, "uuid": "835c0b8d-e73f-4efe-832e-1013d4c6cb27", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702467662, "uuid": "84a781c6-3104-43e1-95b1-9ce163d65ef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467662, "uuid": "5de9a908-a517-4072-aa24-df76ea6596b6", "value": "z1STATEMENTOFACCOUNT-13010913667.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd2d5e2-9992-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkGate)", "timestamp": 1702456444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702456444, "uuid": "a8e57ffc-e969-4e00-86d1-60bb7af3e70c", "comment": "Malware payload (DarkGate)", "value": "c97607e6e04da0e5ef7414821afba0f5", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702456444, "uuid": "0e76cdf5-fa0c-4f57-979a-9994e102ab4e", "comment": "Malware payload (DarkGate)", "value": "9a1d62c7aa156b0920f87b422ab3685e60393fc97a0b742e533e791adcf5a31d", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702456444, "uuid": "f430d958-c16e-4ea4-bb7d-2999672bc0cc", "comment": "Malware payload (DarkGate)", "value": "2acd031bbb023660c5c214809ef7e32a040ad4dd", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702456444, "uuid": "307811c4-611d-49e0-a01c-cc2c7a386219", "comment": "Malware payload (DarkGate)", "value": "e061c65512191bcf668c14202cd113c651e7a3281f2a7965442ed60f5a72795d6e2f25840b709e4f7929e3795c43d079", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702456444, "uuid": "0abeed14-2490-4f43-8b66-577b1aab36fd", "value": "T16341D82226DD8B04F1A2383688640229A9B7B581C8328718464EF49D1F57B40FD76F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702456444, "uuid": "6403c1f5-205b-4d0e-a54f-c8a62e9613f1", "value": "6:4xtWgpwPProg+zloOzxOn8TkkiDS/GJM6SaU/k1ARokJxtQ4ZB5U:8JpywoiIwkNM5Mf8rZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702456444, "uuid": "a2ec2c06-37ba-4fd5-a743-93c6fea6f2c4", "value": 1974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702456444, "uuid": "52ebba13-7530-4fc0-9985-cc70687f7f30", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702456444, "uuid": "1b6acf11-6a59-4749-af40-e067afd2db25", "value": "Passport20231023_90223 pdf lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31f7bd0-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1702471294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471294, "uuid": "222c61d0-99e0-45fb-97cf-55dacf8dbb5d", "comment": "Malware payload (DarkCloud)", "value": "cf085e24e181483c7683f3ac9a465784", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471294, "uuid": "01a1f03d-8e0a-4c83-a885-43be18f04934", "comment": "Malware payload (DarkCloud)", "value": "9b11f1e925b08b47fa128269da41c25430d9c19c244566cf8b327e6aff8aee1f", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471294, "uuid": "2ee86719-a2a7-4c46-ba00-08aebe95e283", "comment": "Malware payload (DarkCloud)", "value": "83bd10517f30cf7fad841c0b4d6bd2daeeb2e781", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471294, "uuid": "66afdec6-f432-4d62-9f00-4a75e2569403", "comment": "Malware payload (DarkCloud)", "value": "5933a2b6e4bf230b54f1c0d716fcba3bd8d577873014a592d09359a1c3a9a3f6806cc94c71588a72829216d5e64ab3bf", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471294, "uuid": "9ad16e25-24a4-49d8-99b4-948111c0ae62", "value": "T142B4234E851DCCA1CC852978807F2FA50B63D9B3422B54C76615B226ED36786987FF0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471294, "uuid": "dce731dd-6522-4ef6-91e2-95d29c5319bb", "value": "12288:NNXWi6akbtBXTaI4fVGM7mnZZ+xywljhh:XGtBXuRVGM7mnZZ0yEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471294, "uuid": "4c14eea2-33e5-4b8f-b825-798d532fcf66", "value": 502160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471294, "uuid": "09228d95-7e47-4ee5-aab2-254d6961a886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471294, "uuid": "35c639c6-a257-4b71-b05d-2661545fe79a", "value": "Merchant E Statement 20112023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f984864b-99b8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702473023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702473023, "uuid": "28d48c6b-c8ea-4407-bdae-e8f7b7b794b3", "comment": "Malware payload (AgentTesla)", "value": "c5ba7e6042b583fe31f06fb02751fe7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702473023, "uuid": "51ed556f-e1cb-4e9a-b24b-b86e2e5654f0", "comment": "Malware payload (AgentTesla)", "value": "9b717950e0f460bfb390125d3b300825db9cee565793222cc1c982d7be6cf6f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702473023, "uuid": "269f096d-0772-4180-9bd5-231cd34bb3da", "comment": "Malware payload (AgentTesla)", "value": "08491fa886f3cd20f7c8dbf9c51d001312686433", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702473023, "uuid": "b3475821-298e-4282-a4f3-5458f33d1e44", "comment": "Malware payload (AgentTesla)", "value": "c8c593e41d480de97c3f9e833b27ed644bcaf682f043d1fbacb248aae80b47f794cec49f730a851e77b7bf40ab0446c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702473023, "uuid": "3dcfb59b-8c6e-4f9d-9544-06545eb4c45e", "value": "T1E015B13D18F92227F175C3A6DFD0C527B260A5EBB1629964DCD243964307A0BB9C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702473023, "uuid": "5f8d32d5-bb61-422a-b1f8-10e5f5717b46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702473023, "uuid": "77a795c2-d7e6-4f47-99f6-3c1748901067", "value": "12288:0fu8yC/a/lrgKMRu5HscsPh/UOG3AEcSK0F3AM4BgJ:Qg/lUstsPh/U3/cSK0FwZBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702473023, "uuid": "3aed6ddc-789f-4231-aebc-f24b3aabc6a0", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702473023, "uuid": "dd2b5bd5-a881-47ef-9824-b631564e2063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702473023, "uuid": "18198b41-8a11-4e2f-9eea-19c086fee5cf", "value": "RHU-20230911759.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53961369-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480905, "uuid": "e70906c5-fd4c-4d71-8587-7372fd099cdd", "comment": "Malware payload", "value": "2bdf006afbfcf56b64128e537951309c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480905, "uuid": "6f5b3862-d976-42ff-8377-0caa58d8aece", "comment": "Malware payload", "value": "9bcf90a200a01d3e2b2c052fee2fd069de288b6553f01091093ce51f3144971a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480905, "uuid": "f26a0c26-cd39-4270-b3ec-e740c27484c6", "comment": "Malware payload", "value": "5c0d04b91d46b751f20c67886265ac76e5cfbf17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480905, "uuid": "0ec6762c-1058-4ebe-89be-17bdfe28389c", "comment": "Malware payload", "value": "11a509124e530eb10f5f830d9c48e3386234b9ba74253e11baf0f3e5718e9bf45d7173e0b07aa691361fbbb3e3084738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480905, "uuid": "2dd8b3ef-075b-446c-a111-460ae9d8cee6", "value": "T1C9469D379E1D5CC9E90174719C1A8FDA29549C20B5086B9B76C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480905, "uuid": "cc80ba5e-6f83-491f-95d8-d7e15f55d5d3", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480905, "uuid": "18d4d27a-0a36-49ae-b017-3cbb598a0b85", "value": "98304:2xNWwqMXORpDi4Txy8gy+3hMqT7YOVlpxeeoiVLiiR44GqmIgdy:2Wwq0UpW0yNy+xMiZlpxeeoiVLiiR44f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480905, "uuid": "e8311b3d-c53c-44bb-b324-4c5f015deeeb", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480905, "uuid": "7a307141-bfa5-4a63-ad7f-38ae7c979374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480905, "uuid": "04cea6e1-68d3-495a-a3f2-7e565d8fcd89", "value": "SecuriteInfo.com.Trojan.Crypt.28487.8082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157a3499-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702470922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470922, "uuid": "d2751e9a-5d78-4148-bb62-cb7b92b58330", "comment": "Malware payload", "value": "0d84c671c1c3d5682accd258127614a6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470922, "uuid": "195063ec-dbb0-4fbc-82c2-ed77dec338c5", "comment": "Malware payload", "value": "9c211182447f6cc84135c4fa5aca2fd4f96c9dd5b6218472b5b5214e488245b9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470922, "uuid": "78b7e105-b32a-4eca-8dd8-233c26ffc61d", "comment": "Malware payload", "value": "08bf8767db9bc1cbc11cff433f0d61198262ede3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470922, "uuid": "cfcb2385-9712-4f09-b813-82412b60c46e", "comment": "Malware payload", "value": "8d135e9bc44583e34296ed06f2b3a045ed2e94cf91dd00b2c6bb91cad158207e585aeded9d3d9796cc3075f0f34413b0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470922, "uuid": "0d4c9e1d-dbc5-4974-87e1-dc0d92e5eb7f", "value": "T19FD42380D542684CE40AE7B9712195829F3E787C778711A3FDF79E81EB1B704AECAC85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470922, "uuid": "38afd128-47e6-4216-810a-7679de75e2a8", "value": "12288:L44E0piaMrt7JpklkRa+CbJZ5r6YRAMAmCZZWG4xfKkYzvsTFL:k4E0ps7JpkEWxGMlddtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470922, "uuid": "5e998661-c48f-4725-90eb-4d8ea8ff7f5d", "value": 617600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470922, "uuid": "e94e92e4-0fba-4ea8-9719-53bb223344fe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470922, "uuid": "6da8e01a-0897-4564-b033-73da08fb03ef", "value": "Request for quote (RFQ).xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf149a8-99b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702469190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469190, "uuid": "36f865c0-c144-4187-bfef-98459ae09807", "comment": "Malware payload (AgentTesla)", "value": "63f05f8ebe6e7e9b2479c8ce35620671", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469190, "uuid": "739b3def-290a-430d-b471-64b73b7c848a", "comment": "Malware payload (AgentTesla)", "value": "9c9ee613a09b7435f2b959c350da3342f0bf440fd87c91286a5c3401f35c9ae1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469190, "uuid": "8c1be8af-2465-4d73-9242-4bf34c2162f6", "comment": "Malware payload (AgentTesla)", "value": "1566a79e045add5c8466e210d98bb4bb4dcf03da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469190, "uuid": "ea522a8e-b216-4d55-a71f-4c621dac2bc2", "comment": "Malware payload (AgentTesla)", "value": "f378444990ad5099a642d72300ea37dce545f11c5afce5c62d5536efbd44f5ca37551fd27260b845a52819666804797d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469190, "uuid": "d9c1eb0d-3f09-44ab-97a5-36e18152a2ac", "value": "T1534522823730C017FAE30B72297966675EF2F14111E4EA4F33AC5F287F56A429D1A752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469190, "uuid": "2a996221-79b3-42aa-8023-f4eaf5eac9db", "value": "6144:yNeZOQLLGui7G1Z4AL7Igifp6hiSmfu7DCCN4EVUjKcnwTt1am3g/cDoX5P:yNNuq7cifpRZTCVUTnwTd3ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469190, "uuid": "42f5e18e-b8d8-4e04-8931-85b54bffa935", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469190, "uuid": "c71979b2-b9f5-41c5-9090-6e0a329b583a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469190, "uuid": "d34761cc-e8ce-4783-a41e-40c8443ce057", "value": "nAN#LISIS DEL CONTRATO-pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256aa6a5-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480828, "uuid": "d1a731d2-8493-4e82-8328-9df7476399cb", "comment": "Malware payload", "value": "885ad57cc675b11dbedf4f7a9e1f9f07", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480828, "uuid": "ff466b6e-0f9c-4be4-93f7-a85cf00ed1dd", "comment": "Malware payload", "value": "9cef8af8553c511b5b247099ee4a9f9f9ee022665c94101fa8db12dccb935afa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480828, "uuid": "bb6a1e46-d032-4c68-bdcf-18cad24f1d8c", "comment": "Malware payload", "value": "bacc3842ea1b68d2696479dffcd8f6a2a3da8e28", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480828, "uuid": "caa3e289-b263-455d-b4e7-d77f1316e43d", "comment": "Malware payload", "value": "ffc73f5a9d64f2cc0dca26f27a8f83b8dbc71659e978119baea9c1890388468076eb724213e8759923479f0d721c24cd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480828, "uuid": "e4dbbbfe-6d97-4ee5-8ad6-53444d661dda", "value": "T15A054A86B84A9556CC1D4E3004DA0FF5F6325C9F5DAB464F2A90369F1CB74C26ABB133", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480828, "uuid": "471acccf-c4ef-4a2b-8e06-6992f6d67c0f", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480828, "uuid": "88d81006-de3d-4806-87e2-9a424a733073", "value": "12288:+R5nWFpPoSAZAMfv8O2VPaPSPt5sFeixdOBpnQkgF:VbKAMH8O2VPwSPt5sFeixdOBFZg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480828, "uuid": "4fc0474b-baf9-4d9f-9fbb-ecd3378fe5bf", "value": 799151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480828, "uuid": "6f79b15f-f6a3-4181-82ae-3ba135b11181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480828, "uuid": "2433b560-3e62-4e8e-b40b-a24a3a5f4910", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.95.29752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6bb488-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1702480863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480863, "uuid": "571dc790-90f2-4e85-b9ea-0ce0d9c5a210", "comment": "Malware payload (Amadey)", "value": "df192e77b2be11456feef6a3488487a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480863, "uuid": "941eb1ef-c289-416b-84b2-bdff1e0e6536", "comment": "Malware payload (Amadey)", "value": "9d3661d9407f84a4d40169a09635fc663e3f4cedefca83547392adec2918d999", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480863, "uuid": "f565b45b-4d4e-4e77-92ba-a828f5d7a950", "comment": "Malware payload (Amadey)", "value": "50663c36c6ec41f0b95bf03f0e3d3df877c46781", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480863, "uuid": "e146bbed-8c30-45ae-b93a-6ec93cdf4cc0", "comment": "Malware payload (Amadey)", "value": "d37dc9f23c1018974b3c641da597a14d9aedaa0a5ae3b48a2259619ab9cc094a843d1688fb0652b1a7b582fc63188844", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480863, "uuid": "1a991b8e-cf36-4392-8dca-6e2eb5afcb48", "value": "T1E4758D22B2D18437F0721A7DDC2AA2B9B4B57D0D1D28C94A3EE45E4C1F397833925B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480863, "uuid": "deb2eb98-09e4-4057-ae09-9653744a90f5", "value": "eb828e44fa1047c6d842831c261da8c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480863, "uuid": "d58b2483-d6d6-4f1a-943d-c7cd55fda28b", "value": "24576:M3IKrCe6EfAy7Decx9vLUsEldHCAAmvJLKwLr4BM0h7Gp/ZVG:M3eeXFLFWdjvZ7LWM0h7+/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480863, "uuid": "23980f67-f11c-481f-b6b4-5ebf1b62e9ae", "value": 1565256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480863, "uuid": "78a25132-921c-47a1-bedb-26a49063c4a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480863, "uuid": "e5c97fab-0d62-4981-a624-cafee61ec79e", "value": "SecuriteInfo.com.Win32.TrojanX-gen.17967.5066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1234fff-99b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702470754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470754, "uuid": "6bd0200b-5841-465a-9a5e-b6288a36bd69", "comment": "Malware payload (Formbook)", "value": "1dfb6a15afd2965abb3d24e725b43d12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470754, "uuid": "338937ac-1ec8-43c4-b963-8969336cb583", "comment": "Malware payload (Formbook)", "value": "9d833b4a66beca22dcee2a030ffa0ff1a9c72eba3f9ee50eb412f56806915f87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470754, "uuid": "d637870b-b1aa-40d6-803c-a06c94d552a9", "comment": "Malware payload (Formbook)", "value": "8c9a16f09378a190f51ca0aa6438884701036f2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470754, "uuid": "d827d204-d83f-42d8-87bc-9650bdc7f823", "comment": "Malware payload (Formbook)", "value": "a9722bba80f010b84d96d79549673c960dc838111fa06a01bd324f49cfd437c514cf6be6d66c6d28765e41c62f05634e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470754, "uuid": "8c35e8fb-7056-4673-8669-a191250ec9e4", "value": "T19AD42346BBD98A71C97B2239ACA3420107F6E2399A35D72A14C37DAD18F370513D1FDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470754, "uuid": "c49ce45e-b110-4c87-adcb-98eaf4cd8496", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470754, "uuid": "cfb7f54d-13c7-4469-bd14-a1eb357ae324", "value": "12288:tEfoIgGy+YYUBYr3/zRhD8MlidsyzEummAznj84RZ+nossc//mNJUV/E:v+YnCr3/zRMJzEuxeB+9/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470754, "uuid": "8190c83f-efba-4492-9d41-fd6d7a6715ce", "value": 620544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470754, "uuid": "1a387539-5954-4ed4-ad32-2ba626ef229a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470754, "uuid": "32885bcc-56d3-494a-b942-f3c19225d0e6", "value": "SecuriteInfo.com.Win32.PWSX-gen.29111.14586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa017d5b-9976-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1702444543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702444543, "uuid": "21f8add1-44ba-4a34-b2d1-a99c9da16916", "comment": "Malware payload (XWorm)", "value": "bcf8cca327d77c29ba8d8679f2b97dc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702444543, "uuid": "b0575312-c43e-4725-bcb3-683e9e0a8d71", "comment": "Malware payload (XWorm)", "value": "9dc6397ce63aab35e78a75e8d5cc48bb3c35e3652044aedf73f2f5adb77a0878", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702444543, "uuid": "ce82a3ce-8599-4e20-a22a-3c052d15b31c", "comment": "Malware payload (XWorm)", "value": "37fe89e00b9d42381b5d8cb400bb45e053c434e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702444543, "uuid": "0888bbe6-2940-4b14-87b9-b0eedecdf9f4", "comment": "Malware payload (XWorm)", "value": "2ecfd6aa8a2930ba919da41876f6c3ecbad54b9745af93a9c19530c1e99f88dfcf66e425d7863c4ed552ee54a1c6d50d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702444543, "uuid": "4faaedec-e569-4cec-8e74-41f32bd419b4", "value": "T1B0A45143D2B20257F14B96F2F4E348C74B91AD4E259C0E167CC2392AC927429B59BFDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702444543, "uuid": "190b7d79-bbb8-41de-9529-f3d79254ea89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702444543, "uuid": "06b629b2-6ab6-465c-b390-e709726dc0cf", "value": "3072:EP/mzU+evvaKqZ3WKTyhFNqGKbNL+0Kevm3NHuAeBHifIWOy3s3R7P1m9KQQQQQ2:iO4+eHaKqTcFkbbxE3NOFRifIWtuRRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702444543, "uuid": "1e705422-9806-4491-a77d-9d48be4cfbfd", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702444543, "uuid": "043c9840-b032-40a6-b65f-94b29f8fe5d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702444543, "uuid": "cf424446-13af-4c12-9744-8a5e8acbf208", "value": "SecuriteInfo.com.Win32.BackdoorX-gen.32100.19589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b4a9a5-99b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702469883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469883, "uuid": "34f46315-d516-4e8c-bedd-f554042044ff", "comment": "Malware payload (AgentTesla)", "value": "903e5d1444a96b0fbeff29278e633743", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469883, "uuid": "f8f86dc0-7ca9-40d4-87e6-83000970ba98", "comment": "Malware payload (AgentTesla)", "value": "9de19f99b91399a44070985126b113643716376fce4d3cb1d65c621155426907", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469883, "uuid": "be1f4e31-cad6-45ba-bb69-b5a671165ebf", "comment": "Malware payload (AgentTesla)", "value": "8279db6efbc0e1d1a355cff774e1c98bea62e1c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469883, "uuid": "30199e8e-3564-4dc7-8482-85624519fcbf", "comment": "Malware payload (AgentTesla)", "value": "d11935c57d897ebc2de594604970f858d8b82f5384d5228c3de38dbb02ab6208964158fb1e2f0ceebbbf15eebdef92f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469883, "uuid": "7d17cc8c-f085-4ac7-9eff-8813551f8fd1", "value": "T125D41209B5E0DD07CC07A870C8D478EBD26DAD54AF09D30F72C7779D45B52F28262AAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469883, "uuid": "346d96dd-9f99-45ff-8838-618652153812", "value": "12288:nrMMe0yk2LvUbyF+a6PhIGLg0xYpQtDCny2AFSn1ulUDmwIVoj78u:rMMeoIvn+aiiGLg0xScBUUlUajV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469883, "uuid": "9471a5b2-7423-467c-9705-91bd3fcc5237", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469883, "uuid": "ae402e81-b111-4508-98fd-376ba57028ac", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469883, "uuid": "d67c4790-6c05-4cff-aba3-5c82f9d28778", "value": "DHL09685879790890068689.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57add319-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480912, "uuid": "d9ebfc96-bb54-47b1-b682-076ebd68ed1c", "comment": "Malware payload", "value": "368c11086fd312700c1b86b0793beef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480912, "uuid": "e538927e-936c-4540-9315-7c9497c85859", "comment": "Malware payload", "value": "9e055ed48990ced5b0ca6665dfb1e72272fbdf88475cb1bfb00092ed3e70aed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480912, "uuid": "56efbce1-a1d1-4fc5-902e-d229783d74d8", "comment": "Malware payload", "value": "7e83152eb5e6e6e78940fc1cd7da826c4f85aeac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480912, "uuid": "9d18fd31-796b-4b7c-bcad-e0c13c7c335f", "comment": "Malware payload", "value": "666ec6591a2b005f0c0e42811d9766595c0cfdd689c60aa044a437dc364ac3200731c7f9199a3383fe65a9ac15b27a27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480912, "uuid": "bb60c25c-eb5c-419f-aa91-ded8f895020a", "value": "T1A9D533336E74C521DB481B701A6DBB729B12B24A481BDA9F3F53416D27BF0DFB98005A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480912, "uuid": "b96bb306-93de-4507-9e8a-8ed6fdfb09ac", "value": "050d22b2824a459a45ab1f2d766c9cbf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480912, "uuid": "cc18b9d1-a184-4e86-9512-6a194eff16e1", "value": "49152:UuXUblFSG3a4TUWORuuKY2fFQjdZy0R5VnM6kGxlIBgerHJk90fHrAex7ibNkVd4:/XUblF1q4gWRuG92/VMiAW0fFxGb0dhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480912, "uuid": "77106b0f-6e61-49ca-89cb-fb361968f2f1", "value": 2892515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480912, "uuid": "6fb45e97-9427-41d9-b50c-92aa781af3f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480912, "uuid": "b309b10f-b96e-4725-aaea-680838b464b6", "value": "SecuriteInfo.com.Trojan.Click2.25931.16518.31966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf047b6b-99b5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702471663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471663, "uuid": "89ad3413-03b5-4611-9a1f-1bf2dcbb0f5c", "comment": "Malware payload (Formbook)", "value": "71171b98b3109e9c875eba821a8a579f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471663, "uuid": "732e3a44-becd-4946-a2b2-14f694d7f66e", "comment": "Malware payload (Formbook)", "value": "9e333423ba38f87b72d6d52f4ec7e432315c05d5275fcc0f7b266239ecc17747", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471663, "uuid": "7d0eb532-9d50-4f7d-9db7-94b0d6274613", "comment": "Malware payload (Formbook)", "value": "21a9b81efb15513799505f9e85d91b81a3a34b36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471663, "uuid": "80fab8b5-72a8-47ac-a75b-75197bd55602", "comment": "Malware payload (Formbook)", "value": "7f5d9e9eecacd5d6aa9dca10fd52dd2ba4295f5df1056836caf45f35bc3a08fc4e85aef942e9587e74bce5b2bc1fc4a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471663, "uuid": "aefe91b5-f995-4ba8-8e48-9fa975e654e6", "value": "T1E6D4123833034FBAEE6183F3551584020BBAAE5D5667D70AFDC2B3DD58BAB681106367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471663, "uuid": "2ddf6518-d6d7-4257-99e8-abce2d3d64d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471663, "uuid": "ce875226-015e-420e-a468-51ff6b524ca7", "value": "12288:YU7Jhh62x8VhPRrsqO8xWpCGcwukjOBf7i+LlJM5fVsbR:Yghza/PRFO8xWp7cRBf++RJMtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471663, "uuid": "9a04bee8-ea70-4a7a-854b-8c4d052d549d", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471663, "uuid": "63e6b1c4-fa20-485a-9f7e-a6e6a23fee96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471663, "uuid": "6f251977-999d-46be-9923-b1317eb7303c", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c959aa-99a9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702466259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466259, "uuid": "0529bd3e-02fe-47bb-b3b2-020e815ccc23", "comment": "Malware payload (AgentTesla)", "value": "d102e661784f4defd7fb3d8179e41a3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466259, "uuid": "1467b69e-47a7-4902-8ff7-fc9f4941b5fc", "comment": "Malware payload (AgentTesla)", "value": "9e51d8259c0807e1b9d9572f4e19cf3dc2f70c9d0defcb7eab35a1d129ca8551", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466259, "uuid": "c2d777d7-e6a3-4a9f-844d-6dbff9787900", "comment": "Malware payload (AgentTesla)", "value": "da148026c58d05d5ba36de99fa84546948934d2d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466259, "uuid": "da20d48b-7835-4dbc-af8c-7e0d12a4ea34", "comment": "Malware payload (AgentTesla)", "value": "99442fb3dfd2bacc42b3c1a0b3a1530a041632151cbdf64aaf91b5825b52650c0596202944ffe2badf6cb7d85893152e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466259, "uuid": "f63f8056-c1b9-4bb1-9a40-cfccfd24cf7d", "value": "T129E42308329466B3C13221FC6C7293628FBD99C10A11D3AB3C6535F99AA778573D3B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466259, "uuid": "39f0cc7c-64e3-4a7c-919e-9fd45af0a4f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466259, "uuid": "ed714de1-9f1b-441d-939c-2ff9fbd4bcc2", "value": "12288:gEfvINGy+YYUBY/xQdcPO9+nhpZ5U7T1m8ASeFkTKmlMyQKX6EE4p2aq:/jYnC/JPRXZSV7ASakpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702466259, "uuid": "ebbaf877-9475-45d0-b548-5620e3bca177", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702466259, "uuid": "224c06e7-191e-4a56-899e-dc38b2769239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466259, "uuid": "940e22dd-b1a8-4fd4-9a10-b9bff79a2653", "value": "SecuriteInfo.com.Win32.PWSX-gen.22354.5293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a468d89-99a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702464649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464649, "uuid": "eb8091f4-dd50-421a-b1e3-c57286c9947e", "comment": "Malware payload (AgentTesla)", "value": "dcd345f3d75fcf3c5afb218bfdbc50b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464649, "uuid": "319b249b-3bdc-4556-a4fa-65667b2905a6", "comment": "Malware payload (AgentTesla)", "value": "9f58500972fe9038c23e03bbf762494b356e358aebd9125a0a55d9f9ffe042af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464649, "uuid": "3fbf7d38-f823-4ab4-a5e8-98cae7561139", "comment": "Malware payload (AgentTesla)", "value": "9554f906a51d50a8982b644947877719214a42ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464649, "uuid": "76266bd6-68de-4abf-954f-f81f2dd8ca01", "comment": "Malware payload (AgentTesla)", "value": "883ada5207b24d349e6e72b87f3d9b73b23dee789b2887c57bbf2a5ae63ddfe7886f147c1a3186273a7c97e87bd1d002", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464649, "uuid": "7e91eb7c-4095-4c24-bac5-262f264e892d", "value": "T187E423457B425636C0EF213F79226261117401D3BA62EB5F2CA4FABC5DA27290ED13FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464649, "uuid": "053f3872-df77-45d9-9cf7-b83a2a1dcf7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464649, "uuid": "1cee80ea-dcc6-432b-beb2-e3fcb2f556e7", "value": "12288:OEfHIaGy+YYUBY3ATTvIeIVocJ90v0lSrkK2G9EgpKO4cI6Y3MDJp1K6s+2LAeQ0:NMYnC2TlIbP40lAkfGWgpKPz6Y8DJp1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464649, "uuid": "3fae5444-6ed3-4f4c-b096-056ee42f763f", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464649, "uuid": "8b758b35-348a-45ea-962a-de33811d6969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464649, "uuid": "81ba23f3-8984-40a9-8563-2b73a18191d4", "value": "Shipment details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d6367cd-99c8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702479526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479526, "uuid": "9cea29de-d306-4b37-bba1-c4e8a836c1a3", "comment": "Malware payload", "value": "0c3b85b73db67fe7ce664dfdb5981186", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479526, "uuid": "378affe2-382c-4610-b74f-b0457e3cd863", "comment": "Malware payload", "value": "9f93bcbccee4e4ec2a28475b2426f63d08ba121f579e6f09a1c85d3cc9633241", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479526, "uuid": "7f80be7c-a8ff-4f19-a490-fd4c0c8cda5c", "comment": "Malware payload", "value": "89266d49a7b4c78a02147d0ddc72b2afba969d7c", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479526, "uuid": "da214101-87ae-44b0-a907-6f8afb7db262", "comment": "Malware payload", "value": "11065d0e4b9c2a38874a2356285861500df35b6ee98583753c6d1a5faa6dd5e01f79739cdd3b3d50aaa0712f1666241f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479526, "uuid": "a2e08e8e-5b63-4497-8720-589b1f90d857", "value": "T10445834BEBB611D5F4BAC139A553222AFC7234A18738D7D792819A0E5B30FE4AD3D740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479526, "uuid": "3c5ee60b-dce3-48d8-9ec3-ac95813dd7d0", "value": "7cfb5f728219442db8b9b05dd399e043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479526, "uuid": "89abd8ff-f69a-4639-80bf-fa36e87694da", "value": "12288:3ZQHpjp3HNogWcmXS1BfzxdWg2dkJ+6F6ziB/iXh3faVUOEhDQfxwtGGzS:YpjhHNoghmiz5OiBcS2OEhsszS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702479526, "uuid": "5ad112f8-0a23-4765-8882-5fb25feb246e", "value": 1248256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702479526, "uuid": "c231c504-fa8b-4faf-9ded-84378f4b968a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479526, "uuid": "39e70b30-f011-4bbf-86a7-ae6845246e08", "value": "runsysclean.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4248c80e-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480876, "uuid": "4f1bea88-31d5-4cc3-9ea4-94607d567619", "comment": "Malware payload", "value": "abd4e172c1c923a536f34bf3833de56b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480876, "uuid": "19a78059-550e-4bde-8137-34a8ff23aa59", "comment": "Malware payload", "value": "9fec9090cfd602f31b962dcd7c0f12df2f9f18b004488755429f4d65cafdac51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480876, "uuid": "24d0ece0-dc4b-4627-9e31-af31195dabfc", "comment": "Malware payload", "value": "f160902913356be2d4e87d5c2b922607a4d7585b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480876, "uuid": "c5042aaf-ee94-45ee-bc62-436ed6738670", "comment": "Malware payload", "value": "aff1d04b40152503b8a96b4972ef16c59a0e469cd6d3f878d0d01018834a9fa9cdc7f607932852e42651b98c28a140d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480876, "uuid": "27785e10-15bd-4576-8638-913da76ccd31", "value": "T16C468D379E1D5CC9F90124719C1A8FDA2954EC21B5086B9B76C1B969CCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480876, "uuid": "14d66c79-720c-49a3-8f28-7da4e090c968", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480876, "uuid": "01cc1a48-b2a8-4a45-b9e3-ae4f1032f9f9", "value": "98304:FsO/y9GFkUkEof3GGBfgQ7YhvqTOTOzVNGduIdlzCb5nLXRBQjhK:FsZ9G2DE61BoQ72vnCVNGduIdlzCb5nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480876, "uuid": "89a906ae-fe29-4fca-90e7-ac23581f483c", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480876, "uuid": "def46e2e-8425-42d7-8d4f-c35719166800", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480876, "uuid": "ef6c1976-7ad4-4835-bb58-4af6cc799944", "value": "SecuriteInfo.com.Trojan.Crypt.28736.10287", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b69e787e-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1702471193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471193, "uuid": "678871f9-c667-41bb-a908-255cc9eb9ca1", "comment": "Malware payload (DarkCloud)", "value": "1bcba1937404829e91e88683b5ca3ae4", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471193, "uuid": "39f96ba9-786b-4c3d-a996-0e0849dd7d37", "comment": "Malware payload (DarkCloud)", "value": "a0697458c5cbd8207d6a289b500f9f72da15b97918a5822445d552b7cb898370", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471193, "uuid": "b8411a66-8d46-482a-a6ef-b99373f73ed7", "comment": "Malware payload (DarkCloud)", "value": "1d846fd8e35a755024b192fd301c72e681c02d58", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471193, "uuid": "fcab4b50-78a5-4673-9676-d3fb907c86b6", "comment": "Malware payload (DarkCloud)", "value": "2279552231273c12b29b790fc1f4489688a9deafe53f0c6323fe88081b74d478932df2c6020b2e80bc350e516ae6c0d8", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471193, "uuid": "48f8bf25-c465-4c40-bdd4-2c303e1c0df0", "value": "T1609422A3D7879D80EA8C9AF87B7BAF213F219F52961214C6A148B3108F1439654BF51F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471193, "uuid": "d69f9fb0-c052-4dfd-a3c3-3fac4d570808", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471193, "uuid": "c504bf04-f02e-44b8-b41d-ff00e334a024", "value": "6144:4utdjzwr5FOcM06u484UO3BLLgyYT9+9qO1aoQmzmJerC8kb1q2us:zrAY0tzORXgyC+9j1aoQom8qq2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471193, "uuid": "2e074be0-64cd-480c-83b9-b75b79295e54", "value": 431496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471193, "uuid": "2f979f94-c490-4036-b567-0498b1ac0d00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471193, "uuid": "f1eeb69c-6bcf-41a1-8bc6-181e6917f2f3", "value": "Aral\u0131k ay\u0131 Sipari\u015f Listesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc30f4ea-996a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702439473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702439473, "uuid": "7b5a879b-5fa2-4eb0-aaf1-a470ee6f138b", "comment": "Malware payload", "value": "3e7d3dbd3a0d15855151da31d57963cf", "object_relation": "md5", "Tag": [ { "name": "nigalulli", "colour": "#BE9758", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702439473, "uuid": "d5b82059-29ba-485f-8b7d-18b695a92913", "comment": "Malware payload", "value": "a0cffd0b2c0cdcc207c37ce2aec8c7b09025bef9e941cadef016e921712d42f8", "object_relation": "sha256", "Tag": [ { "name": "nigalulli", "colour": "#BE9758", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702439473, "uuid": "c2b472e5-f3b6-4aef-ad89-928c58bb70ca", "comment": "Malware payload", "value": "5fa8614e7baad00f99ea326985d3fbcd3b9c63ce", "object_relation": "sha1", "Tag": [ { "name": "nigalulli", "colour": "#BE9758", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702439473, "uuid": "80d3d190-e760-49f7-b073-96dc858453a9", "comment": "Malware payload", "value": "b0b063c2dd7e5419ec0e82afe0414d09b971bbbda8432e7c6c73b37534558f8ed8b2009fe5b47dea78b1d9966a39d157", "object_relation": "sha3-384", "Tag": [ { "name": "nigalulli", "colour": "#BE9758", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702439473, "uuid": "39b141e3-8439-4328-8bd6-c06e938a4e7a", "value": "T129338030F7CBD7C91B8B5A8D953F3C73670592D442E84173802B8C1A6AA5F3A0A536BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702439473, "uuid": "df745562-c3e6-45fc-b5de-63183753daf4", "value": "384:MvpF/sEG55555555HRAIIHiy5nMxQ0H5H2eX8z14Z1fA:AhG555555551ICy5nMSfep3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702439473, "uuid": "773db11a-6817-4063-9f84-da5ab0733dfd", "value": 52694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702439473, "uuid": "cd670c05-23c9-48bf-80d7-017f86ca3b3f", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702439473, "uuid": "dbeac7e2-3a38-4c95-9fc5-e076550b6e3e", "value": "lnvoice-1578246817.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe38dc9-99a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702464685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464685, "uuid": "7baf2a1c-0fcc-4bfc-8991-59a982ab7e4b", "comment": "Malware payload", "value": "cb976f4f6c3b080976bfd30c2946c93a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464685, "uuid": "27bd55ae-3b28-4ac5-9c5f-a751a8aa04d8", "comment": "Malware payload", "value": "a226bd4e41a54d46ae567229c8240fb1b5142e5c85cb97f60be10ba8c70a3024", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464685, "uuid": "34c7ad8f-4092-4577-94fb-38dfc5b36243", "comment": "Malware payload", "value": "725a92f15761f1d47c743228c6200da9d1357677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464685, "uuid": "a7590e48-9fa3-4bf3-98f1-09785d287893", "comment": "Malware payload", "value": "66fcac79f7d989a7212a6908ee9035c42ca7b63eb8d4c527ff8f1da9ecd3f59c9ac625966e792ad0dd4d250e07b90f21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464685, "uuid": "547cadc6-5aba-43e5-9c83-7e4d69b5f494", "value": "T1C7F24B0977CCA621C3AC757A84E7542423F692F67B03EE1E5EC021685AB3BE39541F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464685, "uuid": "c6c16252-3ddb-424b-9aa9-0062f3b5d779", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464685, "uuid": "5caa033a-2e73-4fbc-b6a0-a7516c1854b9", "value": "768:St4L1mebnz8HNtGaUXl8YVxJuGSKWWLYCC2AVZHUsQ0DFd9:StaAqz8HNDUV84MGSYwJ5tQoFd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464685, "uuid": "f47b261a-0b93-448d-8ab3-2dc78eb80330", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464685, "uuid": "1bea55c9-30c4-4095-b24b-419d2d35b225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464685, "uuid": "78330e09-ba8d-466a-8e31-d8c134399422", "value": "Para Transferi Bilgilendirmesi-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52763783-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480903, "uuid": "d16ff8e1-b7e0-421d-8881-2e7f45418cc4", "comment": "Malware payload", "value": "ca63af0eb0a9002effe20ed48e6e20a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480903, "uuid": "0568c898-9fa4-4b04-a57b-e2eb63b1ac83", "comment": "Malware payload", "value": "a2f8521c3231c643997c10ace0356e47ba1f71dc7cdfccf05417d61ecbe68c2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480903, "uuid": "dddd3c5c-68ea-4efb-b86d-4670ae6cfdb8", "comment": "Malware payload", "value": "4960129e7dbfef99f6d4fb6605825ed6d78f7504", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480903, "uuid": "e38709a7-7851-4cd4-9950-f059d838db79", "comment": "Malware payload", "value": "28b989fbebebb3c79d97cc6d0d7a253be4892cce7c53f732822c6359de850dc915c6d0307182404c8df9e1df5c640f2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480903, "uuid": "532cc1ae-cb48-49e7-b5fe-02ed9502d2b7", "value": "T134057E83B6E380B2D716153009E65B369E78AF650E30BB879BA0FE7D5E351608E3711D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480903, "uuid": "03bebc57-58c2-4da1-9e81-1160404b7635", "value": "3e8075ce6d2d34e15ebb7888371bbc8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480903, "uuid": "c6abd07f-355c-4cbc-bb86-3334cf22470b", "value": "12288:NEKfaJldcyE3gcvGegFfz0j8W9t4r2Vg0IJdknURvp:NEKfaJlqgcv3gFzw8W9t4PJunS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480903, "uuid": "b7d110b4-ab50-4d80-8228-a0e67bd9b577", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480903, "uuid": "1ead9ea6-1fa4-44b8-8fd5-c254fa02ce62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480903, "uuid": "4d30c8ce-b9f7-41e6-afae-85472dea0a67", "value": "SecuriteInfo.com.FileRepMalware.1118.29592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ba827b-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480902, "uuid": "109c4e85-8659-4854-96f4-75e63b2facff", "comment": "Malware payload", "value": "94198d265052d0ed2302fc256cf7dc1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480902, "uuid": "83d83c3e-20b4-441f-a58f-eb85348a0a17", "comment": "Malware payload", "value": "a47087da9bf8a86a5be90ae63935e3ebfe834f97a756f1394a3b253a03010c45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480902, "uuid": "175f74c5-fccb-4291-8da2-661e0d408f93", "comment": "Malware payload", "value": "6b0cd6de48e975ae0906b7206cfe11ba090a6230", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480902, "uuid": "92d3aebc-7dd6-4e03-ab43-33add80634ec", "comment": "Malware payload", "value": "ed3074c857f030156df66e82b351dfe70e49527dfb05c68757e3c8bf027db3a138e963a669a9ea14f0c2a830943c26a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480902, "uuid": "e94a897b-5f6b-4042-ae7e-1850b30cd50f", "value": "T134843B067697D82BC80F0D3069868BA8EA21EDD12C70CA572BBC7F5E3D723906D27557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480902, "uuid": "75e5d405-c0db-43d6-b99b-50719a8885c4", "value": "821c455b475c3595aa1e4e6ad93e77fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480902, "uuid": "ad5c889a-186e-4482-a085-70c967962289", "value": "3072:XkRU1yOo8yOSuRtr9ndhjy2tsW/b0YRy/HbAGIT15YKUnStDC1tl8:XsosW/FqswRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480902, "uuid": "be6522fe-b00f-446c-b5a0-c9086cc0a9e3", "value": 392653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480902, "uuid": "a9c96c68-8e5b-40e9-a2f4-19b150f5d604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480902, "uuid": "396f775e-8a3d-4a69-a819-dd777e5bf84c", "value": "SecuriteInfo.com.HEUR.Trojan.Win32.Agentb.gen.23448.7101", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd9c504-99b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702472198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472198, "uuid": "09b07161-6d6f-46bd-9a55-13df869cc08c", "comment": "Malware payload", "value": "5710e00dc72a8b5da8a6e235a7c22118", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472198, "uuid": "711ba0fb-7260-461f-8f12-4371a48136e1", "comment": "Malware payload", "value": "a51a49511394f1aac271a2f16f18111165599bdad487eadbcb06c9bc8637f4a2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472198, "uuid": "e422db52-e5d3-43fc-ba8d-add63017579e", "comment": "Malware payload", "value": "51d4d5be4cb2c3f3d08e0ba90799674d4a7aae55", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472198, "uuid": "72eab384-1825-430c-9adf-26afd9816609", "comment": "Malware payload", "value": "ee7bef1a91d135c961bbabce7ca50b54183c4244c923796d0ec96447689755a0f91293df3c4c15bdce0ac0bcc08122ab", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472198, "uuid": "51f0b018-d8f9-44fb-99bb-f95567719fe1", "value": "T163B1E5CC77D3B445831304B9057BAE8FF67ABCE4298D0958D524C8897E6892C8677FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472198, "uuid": "86a69692-0069-4736-a143-f5d7c17284a8", "value": "96:xviOC4HzmPbygTLEtoFbGekyrCRTxHC4so64SX:xdHzv4EtsprCRTxHtv6BX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702472198, "uuid": "5a93758e-b6d9-4b16-83df-895bc0e23a92", "value": 5305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702472198, "uuid": "7e46f0c5-2ec3-432b-8a7e-1d858d2c4f95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472198, "uuid": "4729e6c5-975b-4843-9a1e-ad386076d4f5", "value": "fax_00534754.doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5943800b-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480915, "uuid": "72d91e42-b0bb-4a2f-85a0-f66b24cffde2", "comment": "Malware payload", "value": "9e4e58d1a3556a417647bc30d4de6331", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480915, "uuid": "c3344359-20fd-4aab-ac63-7b1da92cc4c4", "comment": "Malware payload", "value": "a58d6e807b37339e33aef13f007400adfab3f69a4f212e800ace1d8c930ace29", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480915, "uuid": "91a67ab9-c710-4456-98f9-5668766bcb18", "comment": "Malware payload", "value": "3a8ba9dc2db5ec8c3b6aae8ec8fd8b53f3763d35", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480915, "uuid": "0c01e91a-8543-4b10-ae4f-af68a532d6ac", "comment": "Malware payload", "value": "5e51942e64f554420a5260bfb7a613693ff9d90eda9de10e78b8190a72343aca8f6f17a0150fc6786c11659551f0a606", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480915, "uuid": "c7c6ed49-094e-4119-ba1b-3b28cb42d261", "value": "T1D9D4380936E3F866C07DCD32C992F6DC9D62A8498E24834F35E8671E6C76D50AC27367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480915, "uuid": "824941e0-3b42-4252-8e29-c5498d62417f", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480915, "uuid": "9583a31b-dd94-46c1-9c67-3e9071e32f42", "value": "6144:+RR5rhZFQGrsUwF7vlPoSw1pSA8XaMYfMV+I8T1aUfpJ+M4:+R5nWFpPoSwiXiVLvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480915, "uuid": "2b6ce6ad-14e4-487c-b8c5-b3f9aa6d43fe", "value": 619920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480915, "uuid": "511c9c21-9969-48d6-90ad-9d918b948d75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480915, "uuid": "be64218a-db07-4e1b-ab00-c29001c897c3", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.9833.21183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae77aa6c-99aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702466884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466884, "uuid": "4edc8789-65cd-4b3c-8e59-368a6da22ae8", "comment": "Malware payload (LummaStealer)", "value": "9af7c42f197794370d28ec2454ff4b6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466884, "uuid": "f17dc34e-d4b7-4d8c-aa34-b9b823489f70", "comment": "Malware payload (LummaStealer)", "value": "a75b46c2ac37130f67b51b50521b4cfda99c15ed0824cd5f5b1af94c8fc3896d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466884, "uuid": "502a0968-90d8-4698-8683-ce40842144dc", "comment": "Malware payload (LummaStealer)", "value": "fa202f05e5b2710069bdd5d1d3751fc5e9008972", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466884, "uuid": "665e6ab7-d36c-44a5-8f49-07fe9dcb312e", "comment": "Malware payload (LummaStealer)", "value": "bfe499cbe90457be988aca658ac6e0cc350265ba5e7947f8943a532e582da38797c62864686fc306f3cc30daf88c2ec0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466884, "uuid": "459ec843-d3ed-415e-8201-c5275d15ab05", "value": "T1F7368D836EA2DF27F11D1037D2DD990993F4E83075C1EB2B69B4322D8493761A866CDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466884, "uuid": "2c144cad-3351-4ee0-adf9-73d84256c7be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466884, "uuid": "a843058a-2201-40a9-8aca-628bb244e8ed", "value": "49152:aQqRYz8Kyn3NyNt8gGv+Rkqahx2a9x3re6otuqKOcS1AL0S8Joqkjx9sk/IRUnFW:/by9yNSv+Ex2yQ67qrcRqy38Z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702466884, "uuid": "bc3e6c88-3b2a-4681-a6be-861c6cc60e7a", "value": 5190392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702466884, "uuid": "9d7bc1c3-240f-44f2-9367-782839a6c91a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466884, "uuid": "c71cd113-505b-4def-b9d1-86dafeb3da76", "value": "9af7c42f197794370d28ec2454ff4b6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f928e2-99a4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1702464177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464177, "uuid": "95d4e559-1649-45bc-889d-dd01b75c2542", "comment": "Malware payload (Pikabot)", "value": "61c58c2bebffb3b3590f24675721fa5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464177, "uuid": "63b8f317-15e7-4037-8bef-2813bd9442e5", "comment": "Malware payload (Pikabot)", "value": "a93fb9f75e3a93a7334c24f60b3ede274f51ac87c07d7b45320a0081867de2df", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464177, "uuid": "0e7b3180-f9a5-4a45-bab8-549dfa83912a", "comment": "Malware payload (Pikabot)", "value": "6055be6eb1625bd60b5fec494ab8fddfbbdf52ad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464177, "uuid": "1b7fc9c4-1218-4c56-927f-58c145302277", "comment": "Malware payload (Pikabot)", "value": "9734306915ca41c3f57b63b03254b910aa2a98d5010645c852c5bdfdbea29ae2f932523bf7875de3604cc8b433a869ba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464177, "uuid": "5e285f61-7294-4012-99e4-ae709f5259b4", "value": "T1A745C023A2F04437D1731A3C9C6BA354A936BF802936D9666BF51F4C7F3A2513B25287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464177, "uuid": "de6d561f-2543-4695-89c3-639195f07227", "value": "f5bc4ec0da51e649a1c0c02fdc5c7f44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464177, "uuid": "9ff2812a-05ab-48f8-8037-8f46701aa589", "value": "24576:kIaMIOzjvVDdJSOLyVMMRB6q9ZeZzZy0M1i:bTnHzWVP/zeZsFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464177, "uuid": "800c9aa2-ed1a-43d2-af38-924d94cb1441", "value": 1174088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464177, "uuid": "964a7f49-e37e-420b-b5ca-d72022eb6319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464177, "uuid": "3188e15d-6d8c-4d9d-9d70-6de9ddaf2abc", "value": "0.26620849638416144.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce514ed-99ab-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1702467230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467230, "uuid": "8bf99a88-a82b-4d29-9020-c1c13daef306", "comment": "Malware payload (DBatLoader)", "value": "6a6157e89092356c3dba8b56e1f4e814", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467230, "uuid": "ed5870a6-cacf-48d8-bd7e-43983dee838d", "comment": "Malware payload (DBatLoader)", "value": "aa08699840c1d2ea33152d24ca907665700257db70fb68e6b8b778931f4a1544", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467230, "uuid": "44a83b08-dd61-4347-824f-2226dcb7be06", "comment": "Malware payload (DBatLoader)", "value": "588469415f31577e8a070d73992a627d8724cab6", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467230, "uuid": "39157c38-99e4-479b-b4f0-4e4e939b8cb3", "comment": "Malware payload (DBatLoader)", "value": "6b4a55cea7416d9ea2a218bc8226a520bdea73f389258b5422e42ee2d10cfc82b42ea84b393448650964891239f791b6", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467230, "uuid": "67c82282-437f-4ac0-8741-e16002e38756", "value": "T1BF75C009FACA5B7EC1733A355872C241CC3ABE932D18EC1B9BE55F599CB0092251BD87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467230, "uuid": "d110d42f-bae0-476f-acf7-97e626271f8f", "value": "c821ef948e147b24b857092227f5d15b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467230, "uuid": "33cdf65e-3f9e-43a2-8766-f8800d7b5ca8", "value": "24576:cpbbeAR9HJiAO7eZ3bXfkGSZr/QTopkgxKJYiTswQaN:cpyAueZ3bnSZr/QTukKiTsXaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702467230, "uuid": "1bf21d48-e0e2-474a-acd3-cd5cd75f9c43", "value": 1559552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702467230, "uuid": "b20fe4e2-9286-4791-baed-eb4364e067c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467230, "uuid": "8e20f3c1-8489-48f6-9a4d-b02fc76f0578", "value": "Invoice And Payment Confirmationo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec88a27-995d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Citadel)", "timestamp": 1702433787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702433787, "uuid": "83b89cd3-8a72-41ca-9c5f-39b754be2b4b", "comment": "Malware payload (Citadel)", "value": "85d23cbcf8d86be8a0d0e4633e24b94a", "object_relation": "md5", "Tag": [ { "name": "Citadel", "colour": "#676146", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702433787, "uuid": "6b4614f6-24e7-404e-8631-06f4039b0002", "comment": "Malware payload (Citadel)", "value": "aa84cc4fd2150d0dd0986943e8567dca381c47c69b29673e8ba120d922fcced3", "object_relation": "sha256", "Tag": [ { "name": "Citadel", "colour": "#676146", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702433787, "uuid": "85bb6392-7bed-4843-b1d8-e26720f14244", "comment": "Malware payload (Citadel)", "value": "d74ed2840f0fc67d632890ff471a71dcfb859726", "object_relation": "sha1", "Tag": [ { "name": "Citadel", "colour": "#676146", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702433787, "uuid": "74ad7cda-ec57-48c9-b947-ea88b8ec0f8b", "comment": "Malware payload (Citadel)", "value": "5f42226876f08d25272aa884c1ac36fd0568fe1257ca13a62ca377585fb4c028f57a52c7cbf717e5bd0dc233c8071adf", "object_relation": "sha3-384", "Tag": [ { "name": "Citadel", "colour": "#676146", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702433787, "uuid": "7605f206-5300-4d3d-b26d-691c2177b178", "value": "T1D1150173BBD000B6CAB21134972A6735AAFEAD305775E747E3D00E446E76DA28A35313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702433787, "uuid": "00007dc0-51e6-4bc0-9a74-6a7934c9cc31", "value": "45e32db5371a83c22f83161834883d6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702433787, "uuid": "5bac3b92-30cb-4bd3-b75d-0b193c84e92c", "value": "24576:wfna/BVJITZ+9zlmSzFpIS+1Ao4T1oUwaCDnbbXTy2:wfud0KzlmSzFWS+1Y6UPCTbbu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702433787, "uuid": "e81931ab-bf21-4ea6-a22a-ef3362d0b673", "value": 912172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702433787, "uuid": "2e5a7222-429f-4055-bb04-d431bac98204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702433787, "uuid": "cad3721a-d375-423d-b560-206bba77f26b", "value": "aa84cc4fd2150d0dd0986943e8567dca381c47c69b29673e8ba120d922fcced3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a019a9a-99a4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1702464165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464165, "uuid": "7892b028-ba17-4f9c-9f1b-2c8ea866d07e", "comment": "Malware payload (Pikabot)", "value": "95f58bd4ad625f045be43d4321167ac7", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464165, "uuid": "e1b755f3-5602-4a10-8664-02a943c07ecf", "comment": "Malware payload (Pikabot)", "value": "ab288923f9cd681f02aabd023a3c7c167490dfbab639b7ae07f5bc1517f2cb7a", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464165, "uuid": "7378967a-6582-4d2d-ad86-cb8558acd4df", "comment": "Malware payload (Pikabot)", "value": "b8abe5182067caf4b67e0975117a224e41f9c8f2", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464165, "uuid": "628d1b5c-8dd2-4369-9a12-c58f43a1c9c5", "comment": "Malware payload (Pikabot)", "value": "84de0ab4c23fc3719d10ff9084267804f11a34bbc40da83ed56db945b1cf2b4b402aef52e6ff7aadb91e493211815271", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464165, "uuid": "d8a2e9ae-ceca-4917-afaf-67e67a2e7ab5", "value": "T13FB3120316520D69462C7DFF505EF9084E55FD9BB5E63D329BBB2B6060EB5C432C8E09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464165, "uuid": "0999c4db-17bd-4350-b42a-2f68a0e4a872", "value": "1536:5hMG394XBW/LlJDea/8zFmnXNm62xcM5S4MAo8ySDIT3KZZnuK9Ie30fISyf4InW:5h0uBJH/8zMdaPKt8ySa3KZRyUFnHkQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464165, "uuid": "18dfae26-e2fb-4334-828c-f416a7aff2a7", "value": 109277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464165, "uuid": "3add69b9-4b8d-48bc-bd2a-5750b255314f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464165, "uuid": "b4aeb88e-52e8-475b-8423-5ea7804bd2bc", "value": "NYBM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386d5806-99a9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702466257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466257, "uuid": "b2d3d326-15c4-4126-a90f-ac2a1b899ed1", "comment": "Malware payload (AgentTesla)", "value": "014aa8e99106ae278f2a5702ebb99fc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466257, "uuid": "01cab692-4714-4ab9-9271-5100579e1cfc", "comment": "Malware payload (AgentTesla)", "value": "ae74573b2465c82c7251fafa08ed86f4113f2568f21709f57c998371e5a6150b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466257, "uuid": "62a6a387-ec19-4120-bc79-6cd886071cba", "comment": "Malware payload (AgentTesla)", "value": "ce7dc89d6ee1ced78723fc94cb9c11c74f5432a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466257, "uuid": "59652a62-df3c-47bb-9c7e-09b57acc112c", "comment": "Malware payload (AgentTesla)", "value": "afe1fccaa40b8fe4478ee5d6b05ec7f21a959d977fe706d7b265aeb9b7d660e66f9e477a1e75ddbcf28dd4c4c4611394", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466257, "uuid": "41e94248-cdbf-40f4-ab59-b48921af47e5", "value": "T1C915B13D19F92227F174C7A6DFD4C527B260A5EBB1629924DCD243964307A0BB9C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466257, "uuid": "d9448f1e-662c-4b87-9b7e-4e74b730d21e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466257, "uuid": "73e64ad5-5e46-4311-9d8d-73c0b106e294", "value": "12288:KfueyhOr3O6KaF8hHDR00IEjaLzs2UZ84AX1pSHOsIL9CdszUIfTjuNvuss:W6A7O6yhjR0+csgpSHOdOsAIbCYss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702466257, "uuid": "6e936199-b9ad-433f-b661-40f079ed4676", "value": 943104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702466257, "uuid": "93562940-e3fb-440e-9493-560f40316834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466257, "uuid": "2baad3df-3b05-4610-99f0-deee631ed139", "value": "SecuriteInfo.com.Trojan.PackedNET.1995.1214.167", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a129345-9993-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1702456810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702456810, "uuid": "cbd4f1dc-5777-48a2-9825-3aba0cfc87ff", "comment": "Malware payload (njrat)", "value": "a6f450b5406742a8569c031eb24d78d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702456810, "uuid": "a9ccecec-9c6d-42e7-86a1-4a76eb108087", "comment": "Malware payload (njrat)", "value": "aebba02f27c0ede4cc2ffd0db4fe3ca949797919114253faf1c6b263eecc7331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702456810, "uuid": "0fcb8448-2cfd-4974-b486-bf89a2896594", "comment": "Malware payload (njrat)", "value": "41457cb5b30dad69604e50c7a7957a97d243e13a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702456810, "uuid": "cbe8a8f3-653b-4ea8-85b1-68b339ddc846", "comment": "Malware payload (njrat)", "value": "1631db69e3b31abbe3e5ea59bf02103fc7eef10ca257ed46179748a173d1424a8663cb74980b8dcc6ef8ce1a35d58bd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702456810, "uuid": "5c73a441-9a5a-4c71-98ad-7a28217bfe1f", "value": "T129B2194E3FA98856C57C07748AA5965003B491870423EF3FCDC554CBAFB36D92D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702456810, "uuid": "25d4f6ca-05ae-4a29-bf16-bc9457a819d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702456810, "uuid": "1aeafccd-0f8a-4d48-9ade-9830639f0d27", "value": "384:9luBPiZCMfdfSJrQbsLRGSIxYVL46pg/i8BD9FmRvR6JZlbw8hqIusZzZW+:SOmhtI+RpcnuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702456810, "uuid": "8b9cc3f3-523e-4042-99d1-7ecb77c0e031", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702456810, "uuid": "f1f420ed-290e-4c09-9f31-464074d2d86b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702456810, "uuid": "43d4c926-bc97-4a21-bb88-4bdd7602fdff", "value": "a6f450b5406742a8569c031eb24d78d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313ed97e-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480847, "uuid": "0997240e-8c1c-411c-ba5f-6e4d246c3ae9", "comment": "Malware payload", "value": "055b0d720d71ede96020ddb9dc7e8754", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480847, "uuid": "4a9d7d48-67d0-4204-9b27-a0309ab14e09", "comment": "Malware payload", "value": "aff4315e9dc4b6cff890d406a9d66f548342b8ee28627a3166d2485960d20195", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480847, "uuid": "1e1060b5-4d67-4a9b-aeb5-627946dee502", "comment": "Malware payload", "value": "c5e0ccf77e5b9bc628ac8cd071eb8cfebe8c5d9a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480847, "uuid": "d613db93-8a2d-4c0b-8c29-7d10b916fb8e", "comment": "Malware payload", "value": "ff384d506c21f9aca4c1fd3a1125fa245482ddf05b3cd75f2a2b7e146c0a5b288c2faf0d40691aef0063d9989b1b0576", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480847, "uuid": "a0b773aa-9301-491c-b4f0-98d89b850398", "value": "T10D545BFD76C4ECEBC01C4E314C82E7EC6966A8945C63A7473A9627CD2C32A406F93975", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480847, "uuid": "952d58fb-06e7-4319-873e-97033841aad7", "value": "deba71fcd4e68e93af678f2a5e291977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480847, "uuid": "028bce69-6aef-4c0b-8eeb-9da0ccd01cef", "value": "6144:+RR5rhZFQGrsUwF7vlPoSC844AH5QWYp9:+R5nWFpPoSe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480847, "uuid": "420affb4-98d5-4216-bd9c-ea15d21c23c2", "value": 286445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480847, "uuid": "58ddaa23-7329-457b-8a30-855c7f4d7481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480847, "uuid": "ee54d578-9e51-498f-a980-b158acd0622b", "value": "SecuriteInfo.com.W32.Agent.NNJU-2136.29893.9224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699c90ed-9972-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1702442717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702442717, "uuid": "3fca584a-a720-455b-abb9-42123557c73b", "comment": "Malware payload (AveMariaRAT)", "value": "3ced47fe93f7b65481e05cc385a4c027", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702442717, "uuid": "0f23ebfa-58c2-42b2-b1d5-8cc9c2510175", "comment": "Malware payload (AveMariaRAT)", "value": "affbf94f4b828e79ebc9545af0383872ecafd2d0bc05f128205b55a672f2df1a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702442717, "uuid": "90b81ec8-eba1-4a45-8cdd-9e3c26fce343", "comment": "Malware payload (AveMariaRAT)", "value": "a9087241d0b6d7b2fc5854a1be6e02dc1f759fae", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702442717, "uuid": "28c712a5-cc4b-416d-b715-4f79f5a93cb3", "comment": "Malware payload (AveMariaRAT)", "value": "171397d8a38bc1d686d6fd7e7d7b13b0dc454dacbf86f18ec234c0d99f99c3ce25021c55f7be99efa0174b6f12e49e9d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702442717, "uuid": "253f319d-c2c0-424f-b756-b44f7feceadc", "value": "T1EF7370A897B04B13CE7AC3F6E9EA1528C73814566C12F27B7E4055D619A3F4CD4122FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702442717, "uuid": "133744c9-659f-453a-9b5a-62a14acc9a3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702442717, "uuid": "74faea01-83da-4cbc-a6db-6f139decdc6b", "value": "1536:E+y06W4bKapTQuGf1OlX+8gfGC2pui6Dk40U7Q2x22riGN0II:Xy0W+apTQJfGTguC2puiU0Qx2EPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702442717, "uuid": "43f3c909-2617-4c59-9788-3dff842cb748", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702442717, "uuid": "813f9927-5999-450f-9035-15cfa288a075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702442717, "uuid": "85241b22-c44b-4c88-9112-eb15a5a9833f", "value": "invoice12132023.xz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7487354-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1702471301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471301, "uuid": "f5badf25-9483-4ad6-a21b-c14614faf83e", "comment": "Malware payload (DarkCloud)", "value": "695abe318bba22f9b36bc5411dae94e0", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471301, "uuid": "124c5ad8-66dd-4436-86a4-753a75bdd1c2", "comment": "Malware payload (DarkCloud)", "value": "b050241efb52972edb6e008934a240531cc1d32e35ac2a5cc6e09c51ea55dcc5", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471301, "uuid": "3b646478-b3ab-4a75-a03c-b7c5b50c29b5", "comment": "Malware payload (DarkCloud)", "value": "54afc1efc06293c81e2f1bf78df9aca58cc83196", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471301, "uuid": "4fde3699-e170-4295-9491-00f8427d82e2", "comment": "Malware payload (DarkCloud)", "value": "6beb205bde9b79896e456b556eb435da011eb1f03392979d3fefc19761999652570a4632a877992402fe344bdc3f388e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471301, "uuid": "4efd2fcb-4fee-4d7b-8fd0-06afbb57e85b", "value": "T1CDB412989A5F2CC2DE6D6A78C3F7DE344F22B953841388C3562032238C5ABA5957F54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471301, "uuid": "a5c9920c-6e8d-4fd7-a50b-bf1efdd1920a", "value": "12288:2j46B7XNjj5keHYrrnijq+OVU/ERipNGzzW2fZ/44V:2hjtx40q+OVU/ERUGpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471301, "uuid": "7b336d16-1d6a-4753-9646-af3025f11781", "value": 500624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471301, "uuid": "7f37e96a-39d1-477c-a3e4-ad7777a0913c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471301, "uuid": "81ffc7a5-a83d-4c8d-ac55-6d7d9ec6b157", "value": "Transferencia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc80bc3-99c8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702479684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479684, "uuid": "7bfe5cd7-8b50-422d-a95a-d7482d73604f", "comment": "Malware payload (RedLineStealer)", "value": "5fd002676f224c376302680812079254", "object_relation": "md5", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479684, "uuid": "699db89c-b34c-4cac-8f6c-0be2d007e6f9", "comment": "Malware payload (RedLineStealer)", "value": "b102410e9081cfbd826fad8e2ece21cf24f75dcc7ba329129660528d5b2eda91", "object_relation": "sha256", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479684, "uuid": "ab78e008-02d9-4fc5-9b36-1fe9281b4c88", "comment": "Malware payload (RedLineStealer)", "value": "715f56e79706d5bb26dbaaf37b39292069c129c0", "object_relation": "sha1", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479684, "uuid": "9c246e62-d3e6-471b-bb22-b684fe9a4b3c", "comment": "Malware payload (RedLineStealer)", "value": "537a6982f72278959ade3170804d47f1363e9e0b67bce902358ef22ed677ec1447bfd9f380cf593a2155de794a574da1", "object_relation": "sha3-384", "Tag": [ { "name": "bookinggoogledrive", "colour": "#D12BEC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479684, "uuid": "9952c74c-f8fc-449a-8641-b6f5d4e59bf7", "value": "T1F1173319F6E81D43E655D0BDF11298833F30D85AA68BC78B3E16B34C352AB89151F8E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479684, "uuid": "9f077212-6742-4dcc-9d00-82d1ba16b8c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479684, "uuid": "4303c0d0-3656-425a-a68a-af0cb97cf371", "value": "393216:0RUzzk8fKnZBz26+SR/rxFCWuQu2LXc8Ku7nk4VuUuoqalnGrJW:0RUPk8SBz2DSRT+QzLM6gUuoplGdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702479684, "uuid": "1f8a044e-d205-4696-9b5a-2ade4a78b3cd", "value": 19036672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702479684, "uuid": "4e2892ee-31f1-40ef-aa96-21a2d0782e13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479684, "uuid": "c2e60c35-dd07-4bc9-bdee-9850c3ef3974", "value": "pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52a9551-99f4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702498651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702498651, "uuid": "918aeda4-05d4-4221-a41f-055de7398c31", "comment": "Malware payload (Formbook)", "value": "5f3fc233c42ec439a53b8cc88f52d8b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702498651, "uuid": "cafd442c-60fe-45c3-833a-0e7003934745", "comment": "Malware payload (Formbook)", "value": "b2587673f763a90585340e9a2cac2ec42143e05278483935f34f85dab922dbc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702498651, "uuid": "5ef0f0c9-94df-41bf-9f61-36c9491157a1", "comment": "Malware payload (Formbook)", "value": "66263a6267d7f2e0d4b370608e36b78fee7e3f69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702498651, "uuid": "03749260-2297-493f-955e-258d2b251513", "comment": "Malware payload (Formbook)", "value": "37022206d6c25efa8e36977fbab88e4e4189a8d9bbc0ad7ff3512cbbec622f88e26188791414037931cebddff14f024b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702498651, "uuid": "e640f739-01f2-40e8-bf8a-41a1a0f34cf7", "value": "T1DBE4232BAB94577AD1EA98383C73422653F49395881AD31B397079BD2CB371013E2F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702498651, "uuid": "385c1c45-ee11-42ed-8c58-76a4fa2762c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702498651, "uuid": "80061392-786c-453e-955e-ccc5457ad8af", "value": "12288:9EftIeGy+YYUBYsQ/On7JPAogA7Xg19SrsyiJC1VIiti9e+WRySG5X/MXCO:G4YnCsrNPAogYxKHitV+6yS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702498651, "uuid": "4b85cf33-5be4-43fc-9d3d-4aa8130e8ad5", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702498651, "uuid": "edf2efd4-3445-40e7-8dce-5fe30aa22d09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702498651, "uuid": "da6f5fa0-b2ac-4546-9ebd-62cb0a73630f", "value": "z17Solicituddecotizacion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cbdbcdb-99ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702468465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468465, "uuid": "f2536122-8e79-4345-acf2-eb2f5c343063", "comment": "Malware payload (AgentTesla)", "value": "1c2a311bc660c4caed7cf12f40f83243", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468465, "uuid": "72198c78-98a4-4d23-9d2f-9b07f72d6c60", "comment": "Malware payload (AgentTesla)", "value": "b314c20bff2c88a6137835282a28c4c902082f91f07a2e38d9cd05c0b97f76e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468465, "uuid": "24d6d9a8-4b5b-467f-9584-7718f5c5d46f", "comment": "Malware payload (AgentTesla)", "value": "024cd5ceb2f01c7381f3d55e98b1b55f0bdcdb56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468465, "uuid": "a8e30a63-9b96-4880-b5a8-04416d9721c8", "comment": "Malware payload (AgentTesla)", "value": "d7cdc275e23bd2b8129e6f2d801038f65a4ddfd0efd8eb9beba167ccf16932d1feb97b0071050ccc696ddc4631528b8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468465, "uuid": "db26179e-74ba-4bb3-891b-cc764f7cab70", "value": "T1BC9423446BB8C447FAE30F772A76F76A2EFD655205A8418F03106E423DB36835A5E783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468465, "uuid": "8211dfcd-34dd-4e55-82ad-022b7cd48575", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468465, "uuid": "50fb4b21-cf4c-4ade-a14b-de780edad699", "value": "12288:0NNaBL82iFweRbjAwvLerWwHeWAck3NDs:0NNaBJehxFwHeWhk3Ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702468465, "uuid": "a7a7943b-622a-4927-9bd7-c2be4b5c3877", "value": 444176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702468465, "uuid": "a5d91cf0-cc1b-4674-8f13-1e9e2788aaf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468465, "uuid": "4a76cfd4-d36a-4170-907b-866d3c66562e", "value": "LEPINGU L\u00c4BIVAATAMINE-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584b545e-9995-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702457720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702457720, "uuid": "0c2d916f-f8d9-4090-bd72-43c9525dbaf8", "comment": "Malware payload (LummaStealer)", "value": "a071c33195002f3ae86bb4c38725990a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702457720, "uuid": "785328f0-24eb-4589-9fcf-9576f5f3d494", "comment": "Malware payload (LummaStealer)", "value": "b31b3189b4f352ee38ed4c8e0a920149f787f79fe2c948268f1350708daa13a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702457720, "uuid": "2719303c-3e74-497a-8430-b4c62bea0bad", "comment": "Malware payload (LummaStealer)", "value": "30f40f1469993f3e86d3be9fb37d142a5be4b309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702457720, "uuid": "8e979079-e1eb-4e0a-8e8d-32a76c734c0d", "comment": "Malware payload (LummaStealer)", "value": "e9063a632c1fcb39e643efd202d6bf454c1a3f05e9882e689aa0484945e5baee8425c26fe1f82800e6830fc310b9710f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702457720, "uuid": "30b8bcc6-06d6-4d34-92ed-f3a88c318b4a", "value": "T17275238266F85877D8BA5F7288F717D36F34BC46ACB8836B5492648D09B31842D3137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702457720, "uuid": "5a36831c-fda7-4526-a7a1-c24d266a53eb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702457720, "uuid": "bbf6c867-f868-48c5-8482-58b5ccc2e3e0", "value": "24576:9yOcwnDiqZHmf/nV3drc9CBB0gDVVDCsc45C8BPUH2pA36+qIm1Y1j8S6Ht9mxya:YOcSHZmnnVawBB0gDHVcrGUjNF9oxHtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702457720, "uuid": "3510d4d2-b84f-4321-8da0-6749926f9742", "value": 1571328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702457720, "uuid": "b06d48ef-132e-43e4-a250-fbb12a0070ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702457720, "uuid": "9c8d1ab2-9af8-4854-a583-b31ddb425385", "value": "a071c33195002f3ae86bb4c38725990a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d187a10-99a6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702464922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464922, "uuid": "f6875a07-1270-4f62-ad75-67ae27abb0af", "comment": "Malware payload (RedLineStealer)", "value": "08ba91920f21f22f58d37d18e9c72a87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464922, "uuid": "64e87292-0071-4659-a4e7-4322c5dd72a9", "comment": "Malware payload (RedLineStealer)", "value": "b39623b8acfb69033f814e555175ddb2c95d314c38914432ba6c2881ce9dbf35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464922, "uuid": "8522dc0e-9f67-4984-9ae8-1702c2955366", "comment": "Malware payload (RedLineStealer)", "value": "a4b1d637f230db4a72b3c821bedac34f052b521e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464922, "uuid": "f50c89d2-fda8-4a79-80e7-1397d15dd011", "comment": "Malware payload (RedLineStealer)", "value": "992658fffabdee302d6bd9570b88499a00b67a5792fac0cc4754f149cd411e719d0d71d216417600e15a205aa60c2687", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464922, "uuid": "32bb1f4a-8cd7-497d-bd61-08c89cddf4c7", "value": "T1F3468C7074E6C031C462203109F4D7A9DE3DBA770769AADB37AA0A3E5D642C1DB3D71A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464922, "uuid": "ba1b09a6-3269-4629-9fdc-547199780dcb", "value": "5126f161c901e3ab94a05a58465b8645", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464922, "uuid": "0928da07-8043-41b7-90b3-5cd1117808a7", "value": "6144:S0uBcCFdklWvZMJvez81T7vkAOH21pbNxqKUZ4x:S0u2CbklWvwVk14hNxqVZ4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464922, "uuid": "3e358670-7de4-4e0e-a305-20ce35923544", "value": 5569819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464922, "uuid": "7a22dae3-2c21-493c-acc9-097f9263fe23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464922, "uuid": "626d061f-27fa-454b-8097-959f9085f7b3", "value": "08ba91920f21f22f58d37d18e9c72a87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49520069-99ec-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702495061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495061, "uuid": "9515502f-68d0-472b-8789-de0078eeb0b5", "comment": "Malware payload (Mirai)", "value": "6953d9e7ec31c6cbaaa311c05b46baa4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495061, "uuid": "4f376497-77df-4c7e-8906-2cd44933f012", "comment": "Malware payload (Mirai)", "value": "b48e9c74b3d1ee869829981932f168c2e8af837af0006a37615b8a81196a7efd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495061, "uuid": "425dcd52-7f0f-4629-b8f9-fc5f5711f334", "comment": "Malware payload (Mirai)", "value": "1e7bb3d792214a1eea5fb3e648e67f1da1961212", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495061, "uuid": "76a4cb0e-b427-4607-a5ff-c7ea1a00278f", "comment": "Malware payload (Mirai)", "value": "8b67ff702f67ab0c14b9f3bc072da72e18069d673451de38bbc490dad2756f174e08706e48e3c610007b4953a17fea4c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495061, "uuid": "da683831-efae-4c07-8880-977ae02cbeab", "value": "T13E632981BC819613C6D452BBFB6E028E372653A8E2DE32039D266F1177CAC5F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495061, "uuid": "70861d56-a752-4026-abd0-b5f00bdfe40e", "value": "1536:xKjoQuQhjegIeLXcVkcWk/XyFAUFn53eal:EjoUvLakcWk/XyFnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702495061, "uuid": "34406977-f76c-43a8-a963-ae1b701dd8b8", "value": 66896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702495061, "uuid": "ebb25f34-ee45-42eb-898b-c65390365d6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495061, "uuid": "56761671-34fc-4b03-b7eb-a8700eda1046", "value": "arm5-20231213-1917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f64915-99a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702464622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464622, "uuid": "8f8e2d02-c316-4027-ae19-c35e52e8c751", "comment": "Malware payload (AgentTesla)", "value": "5f394aa21213711f5af8e57b739bb4aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464622, "uuid": "f628412e-0855-4385-ab8b-b17bc865f579", "comment": "Malware payload (AgentTesla)", "value": "b4cbf684e8873e04a1ff54c62bdb9eb5782d1cea507edc3cef13ac280f049a2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464622, "uuid": "c4da7dfb-9115-4c88-8143-42d75041f3bf", "comment": "Malware payload (AgentTesla)", "value": "bd9e657fe4473769e1eaf8124ed67d4660e3fa5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464622, "uuid": "33e9565a-c99c-486a-bf2e-17af83cf3b4b", "comment": "Malware payload (AgentTesla)", "value": "826d4eb2f37bc4929fadb55bcb03251dbc2b9b84a889c49802143d4d04d89e93be7371458273eb4498285834992c0c28", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464622, "uuid": "5514bbb7-ca90-4710-9178-0cbd0c12cbcb", "value": "T14715B23D19F92227F175C7A5DFE0C527B260A5EBB1629924DCD243964307A0BB9C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464622, "uuid": "9eec8248-734b-4681-9ecc-11d1fb43e542", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464622, "uuid": "f1646cec-ea25-4be8-906e-519b8adb78b5", "value": "12288:6fuey/jG7zr2PUonWXp5GT5ybWtoXjVCR1aVAbzWHr:GcYzr2MAQGTob7mQVA8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464622, "uuid": "d75cf828-ce7d-47a4-b1bc-40de0f178a1d", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464622, "uuid": "310850d5-2f70-46b3-887e-170b29710c31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464622, "uuid": "2c85487b-316f-4fc4-ba99-ee8e43266417", "value": "Pagamento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f53a25-99d9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702486779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702486779, "uuid": "31fabf48-ebe8-4f66-9c4d-e02a71e8d0cd", "comment": "Malware payload (RedLineStealer)", "value": "4bc1bd277770c8da36c5d31968a0e977", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702486779, "uuid": "90b1c734-3550-4766-ba52-3a2f286d836c", "comment": "Malware payload (RedLineStealer)", "value": "b5ca13b6a480bb276bfe2440ae0a7d896039e5cc272bcd74bf9204d3b4919900", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702486779, "uuid": "dd815ead-463e-44ff-a6cd-444bbaf3d665", "comment": "Malware payload (RedLineStealer)", "value": "8983310a112763c2692daca276d649757aa2ed7d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702486779, "uuid": "e573e3f3-789b-4690-b8b3-a607f2a8ab84", "comment": "Malware payload (RedLineStealer)", "value": "24e4776a76fc3f03a13cf600f93d29e63d4b61e663a23fcf0e52a22a6e15a2cb6fd7e5be68016cbf46789d0f66b2144d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702486779, "uuid": "5d04a377-1a01-4791-8fc7-b058ddfe32d9", "value": "T122564987FC9141E4C0AAE33589669293BA717C480F2027D72B50FF692F76BD06EB9354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702486779, "uuid": "892c5deb-9c0d-4347-a098-56f0b6092e93", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702486779, "uuid": "a70dd51f-3609-427d-a001-aaf41be0a2be", "value": "98304:hIAXS/l+HHb7QICgF3EqF6DnCmE3or8r1:8l+HHbhCgF0qFqE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702486779, "uuid": "c51dcfe9-37fd-4659-ba9b-a98035f5e35f", "value": 6366720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702486779, "uuid": "73da4b1e-97d7-49d2-b7ad-0c02a12695f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702486779, "uuid": "d5e7d937-0596-411f-a3e6-41c8e09278f8", "value": "4bc1bd277770c8da36c5d31968a0e977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f844965-99e6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1702492548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702492548, "uuid": "9ff5fb69-6b11-4209-94cc-3ec216969040", "comment": "Malware payload (Smoke Loader)", "value": "447ce13d52d10211f7d777a8b7e1bfc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702492548, "uuid": "c4561d92-cfc7-42ac-bc97-90625223e7bd", "comment": "Malware payload (Smoke Loader)", "value": "b6aabf5268984525553cc98792ebffbf5cbcccd9827442697cb98a8e04464513", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702492548, "uuid": "087883b8-875e-4b1d-9da4-15505430bf4f", "comment": "Malware payload (Smoke Loader)", "value": "80b39826c8e09adfc2e4f51510e40b4b8237614c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702492548, "uuid": "2eb6315f-6fe7-4675-bef9-f2c37120bd76", "comment": "Malware payload (Smoke Loader)", "value": "ad1b4f28a14d7065c9e690a06a09cc85260d6170710c5db51425623c54917c8db5d5350542150de6f7c4d78b7ac56c56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702492548, "uuid": "78997f29-0152-4942-9b70-53320804c439", "value": "T17E449E13A7E06472E62346318E6AC7B43A2EF4718F6576DB27549A7F0F712E2C671302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702492548, "uuid": "4cc14192-d823-4147-b2e8-3cffaad77b8e", "value": "2d67bd3588d47d895c2fea44b0a5f529", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702492548, "uuid": "d30b1cbc-6b83-4d48-9acb-6df4871664b2", "value": "3072:kN/0bgF6qbTlendOUzyf3cuIP3BQkXxrzLVoYuZrfg/aYB8csk4/B712Y:6sbGwndnzyfMuVWLVRuhIl8bk45cY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702492548, "uuid": "f02e9439-8c83-4f2b-961c-db1965f6bb7b", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702492548, "uuid": "171bb0c9-f330-4ece-afa3-d4eb62567dee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702492548, "uuid": "402fee12-9447-48d1-9df7-3a3420a68508", "value": "447ce13d52d10211f7d777a8b7e1bfc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73bcddf8-99e6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Tofsee)", "timestamp": 1702492555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702492555, "uuid": "1ceb3742-9e87-496f-b9d2-2e62f903d6f2", "comment": "Malware payload (Tofsee)", "value": "1878343378de0f934ea65fab5939a59a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702492555, "uuid": "dc99eb79-89f3-4bc0-afaf-72ee08fe2795", "comment": "Malware payload (Tofsee)", "value": "b71122e4dea173f9fb6946e17de8c1b44ada3afd08f6eb93cf39dc6eaff046da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702492555, "uuid": "98f47b23-356f-4928-bd22-621e1581e896", "comment": "Malware payload (Tofsee)", "value": "0562a20680014897f0c60769c56cdfbadc42596a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702492555, "uuid": "b9e04e72-4d1c-4dd8-866f-5a2ad7865156", "comment": "Malware payload (Tofsee)", "value": "d0f06b057abce7d69434af3dc8aa2877148db17b8b1434deb95926aff72326dc797687bd2605a3ad7c897913b3cb21df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702492555, "uuid": "04bdb76e-991d-4a18-b4b5-f24505635d25", "value": "T138449E13A7E16431E52346318E6A87F42A2FB4714F6576DB2794AB7F0F712E2CA71302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702492555, "uuid": "87b0ca34-fe54-43bf-8db6-395a4105b807", "value": "2d67bd3588d47d895c2fea44b0a5f529", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702492555, "uuid": "bd5d2904-a1ed-4006-832b-25a00b2f9ce0", "value": "3072:q9/0bgFaqtTkenNkcS542ov3BQWDbZpAMzCO/hVlFmg4WBlx824dELM6HTxBG12Y:0sbmDnGcS542F4bfntDlFSgnfo+b9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702492555, "uuid": "60bc1926-efbb-49c9-ad2b-a1597757d0b9", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702492555, "uuid": "c3e8193b-cad9-4ce7-b5f6-88faafda612b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702492555, "uuid": "43e655a8-a1a8-4526-88a1-fefbe15168cc", "value": "1878343378de0f934ea65fab5939a59a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a31f627-99ec-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702495143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495143, "uuid": "8fd4036e-27f3-4fa1-8ba6-87640a067730", "comment": "Malware payload (AgentTesla)", "value": "5f38b79438578be05c97414e5439b0f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495143, "uuid": "b6128e04-552d-4b87-9ff7-130713606d87", "comment": "Malware payload (AgentTesla)", "value": "b7e50c77235075031ab1fb6afe9896e57945c387816beac89e49f961f537d609", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495143, "uuid": "530c60d8-70c1-4ba9-bc0e-8b9b99aac146", "comment": "Malware payload (AgentTesla)", "value": "589e78b93d59036815b6d99232a82e6c99dd46f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495143, "uuid": "604a31ff-6b74-4203-90d1-7a41f48e0360", "comment": "Malware payload (AgentTesla)", "value": "3af2ea5f4debdf7c05a2390de058b8229f939067b9f64dde27df478480e1c57bab66a08ade3b8da8b18cf5b765290419", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495143, "uuid": "08cd654e-cf8b-4b34-b539-5c81e004c76c", "value": "T1AFE4230E6E8C754ECEAC7070DEB6745F0B7162722C5AE6597E9401862713EEEC5B2F08", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495143, "uuid": "14851ea9-e5fd-4274-8b4d-7961f443347c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495143, "uuid": "1966698d-534a-45a3-8548-2dfe5d54475f", "value": "12288:ycGaWw3jraNCnkYrHuDHLxSERN1fdwa7fdSSSlIalUFseDAGWZ6:3GGgMpqDH5X11jfcSOGFVOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702495143, "uuid": "8da07e12-577e-4a86-a039-79b80726a58b", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702495143, "uuid": "a38c5aa3-95a5-4ca0-a8e8-3ff9bbc0ccba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495143, "uuid": "700e92d1-65ec-4740-b478-8e77257b92a5", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f3030e-99b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BumbleBee)", "timestamp": 1702470841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470841, "uuid": "e6dbd70f-60bd-47f1-86ca-8a1cf44b3885", "comment": "Malware payload (BumbleBee)", "value": "4a2c19fad49e76f0274087955e760173", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470841, "uuid": "4a6fe75b-b149-4497-b2eb-c26066240be5", "comment": "Malware payload (BumbleBee)", "value": "b926fac036a5e46c033c3c5644d34266d72ab993ca1bbd76957422227030d04d", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470841, "uuid": "0e372cbc-67b7-4d1b-b934-7f4f2d326692", "comment": "Malware payload (BumbleBee)", "value": "610daa059dec5752fd6398fc86fa628d307cd7f3", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470841, "uuid": "6ebf426a-20d1-4bf3-9aec-23b67c089d72", "comment": "Malware payload (BumbleBee)", "value": "8d4f7af0aadb648a5cee283214e524b28299d7ab8390dfd2fa2a3872b2646bd49855d08bf5f6c311ddb0b0140ab6b5c3", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470841, "uuid": "03d2f385-c01b-4a0c-9378-50a590c405a3", "value": "T18BD0972CA56D8279C142B82E82487C246C0FF4061DFEBE0C17C0C5EA8C808F7D848CF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470841, "uuid": "c8015a97-215d-42bc-ab60-89a8dd47eca1", "value": "6:HRYFJb5bsZLK1S1tuOPFHQOPF2vyc1yc54vVG/4xHn:HRYFJ+K1S1tPFwOPFqhy3VW4xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470841, "uuid": "34e57489-3171-470c-9b5d-e23eb2664082", "value": 250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470841, "uuid": "25f0d77d-59c4-461e-90f3-61ebe9786d92", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470841, "uuid": "84def7a9-2ed2-4d62-8e39-b1e43e2cc9e1", "value": "Skip Reports (8).url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba96f4c-99b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702469913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469913, "uuid": "7b664848-4376-428f-8efe-8312cb25192b", "comment": "Malware payload (AgentTesla)", "value": "994a51fe7301ea8e7586bea00133b940", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469913, "uuid": "6fb1caf1-4cf3-4bcc-8342-59dccd593b2c", "comment": "Malware payload (AgentTesla)", "value": "baa33e4af48c368d00f80dd88c3d991248e54df004fffe4955db85d643691c03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469913, "uuid": "ec469bc5-ebd6-4e74-ba94-4b9bc432ebab", "comment": "Malware payload (AgentTesla)", "value": "5d5f32460eaf4b66dc5fc2f9e2fd9506a6a1ee1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469913, "uuid": "7dc73966-899c-42d4-8e3e-de6c9617b5a4", "comment": "Malware payload (AgentTesla)", "value": "f952580e7a2b9f2c101faa9978df1e35098714b915edc913b5c41e6cb9d16f0840055a1fb2408475df45936961110e4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469913, "uuid": "dc656b85-4306-4e3b-8463-e3263807260e", "value": "T1A6D42258F691DA2ACE2758B4CC8970E3C22DEC946E02D78B72C9774D08757F38256AF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469913, "uuid": "7e3f0730-9632-48b0-b6cc-f3dd7272fbc8", "value": "12288:0zMe0ykH1OpxLisyIEG6sXVW0tk+GVs7aFs3UuYC41AVGLdNQI15w0QQsC9J69MH:0zMeoVqxWTIhlWO1GVs7aC3zYZAVGH1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469913, "uuid": "526d12da-122f-4e41-b77d-824a190cadb3", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469913, "uuid": "b1865e0e-f212-4e72-a9fc-7c913e5c6899", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469913, "uuid": "6c4eb2ea-de6a-4088-a655-4536effe19ce", "value": "Orden de compra.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138ed2d9-99da-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702487240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702487240, "uuid": "d16d3b2c-ef1c-4dc1-b228-4996946a7bbb", "comment": "Malware payload", "value": "1ed6e346e435a7f400dbededcadaa2f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702487240, "uuid": "6aa91240-52d7-42b7-8fbe-cb64729ebb9d", "comment": "Malware payload", "value": "baa85d8fac6543991982603906aee5e16c88bc08a3916680775de0000fc9996e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702487240, "uuid": "2c049bfc-534d-478b-992a-27b7236d40c9", "comment": "Malware payload", "value": "038ecc17f62eba1d70b90801bd877d9880e45e33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702487240, "uuid": "5f1a3f28-636f-472b-b983-7180b4c1e5db", "comment": "Malware payload", "value": "3bae7b2cd1b23aabe49392dd750c089eaead774f7eac741d878893f916c9bcee17bfd57e86623f313d70f51a918c951f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Revenge", "colour": "#1C7753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702487240, "uuid": "c11a884e-56a3-43e6-bbc3-5f0082b91759", "value": "T1E4622A09B3DC0339C1BD07BC0DB242256371E5A79A62D71F1CD890FE9992BD45B60BE8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702487240, "uuid": "999b2042-2911-44c0-abdc-c9f58d11e07f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702487240, "uuid": "f77d41c6-7820-4225-bb6f-38299059f256", "value": "192:r+8C+EKS0O9ejYTDG8bcp4LlzKnieXubWyD9JEBkGxVXlqoN+RJw:rNVjYTDG8gpaReXTyD3Enx6oNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702487240, "uuid": "df6ecd04-956f-42ff-8173-ada2afe58497", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702487240, "uuid": "4d046a2a-1199-44c0-ab17-f6d81723378b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702487240, "uuid": "5f5d2c38-6d88-4a18-b943-91420c42a3e1", "value": "bSvX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a0a6cd-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480856, "uuid": "ad3b9d1d-8918-4a63-a922-c9939cc1e770", "comment": "Malware payload", "value": "d121a4d94e02d4033b4ba707253d0fa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480856, "uuid": "bfc075e0-5de7-47ab-8b66-11feecd58805", "comment": "Malware payload", "value": "bb331f170c51344c91c05c8d3f2fac57eb3ebcb9f09a5cf2ce6fb50722a7444b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480856, "uuid": "329bb3aa-da65-439f-a025-dc1808f36b6f", "comment": "Malware payload", "value": "52893a30aa110a45ad3b7ae4632ab4fbe22d7335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480856, "uuid": "a7b32685-b52a-49c6-9dcf-3bb34c4ac96a", "comment": "Malware payload", "value": "eab17b5e9bd4320595d1d05c20674c7d2408df9ce6c7620378e7e88c8ce28aa693dc71cedc49cf6ee249ae7638345273", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480856, "uuid": "1338b73f-42d3-474a-9749-15b3b3140594", "value": "T1A3469D379E1D5CCDE90124719C568FDA2964AC20B5086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480856, "uuid": "6f7a6c1b-f672-47c4-a72a-58c3aed6adb6", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480856, "uuid": "a0e19166-816d-4165-8290-899fd16f656e", "value": "98304:b+RAtoF7jd0bn6uEVDgbxehfqTZTOcxdp+mgulfa2FMIRavYBJS:bBtohh0zUVEbxEfItxdp+mgulfa2FMIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480856, "uuid": "388d0f09-61a0-4ec7-a007-5daf3a3271ea", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480856, "uuid": "eb19704b-7efa-49ef-93b6-7b854d721b04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480856, "uuid": "3bbcccdb-6d5c-445e-8aa2-55fc255f71c8", "value": "SecuriteInfo.com.Trojan.Crypt.3798.26032", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e2fd9f-99b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702470759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470759, "uuid": "4a5f6288-7668-4b45-bfd5-979b38dbc6ad", "comment": "Malware payload (Formbook)", "value": "1baee1e9f95fd9a88ca902a9b9512461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470759, "uuid": "a6a526da-65c4-47bc-9eed-6848b04b7a6e", "comment": "Malware payload (Formbook)", "value": "bc35041e89440dc6480f6c9d7b52003d4cac2bb22c0164535a73291a7975e309", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470759, "uuid": "b615d07d-379c-4516-a0ad-870995f961de", "comment": "Malware payload (Formbook)", "value": "57d74304d6a98550bad9950c79df7d2922bd45e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470759, "uuid": "eb3633a7-ca06-47d0-9f5d-dc8b5f71ea2e", "comment": "Malware payload (Formbook)", "value": "7fbea26423b1b9418bcea918abd950e7428e363d4ba7752d1f22caa40b3eb1ba66e5ea445e17549bc281b45fba907497", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470759, "uuid": "95b3f315-48ca-42f4-8ad1-e6ecf279a77a", "value": "T1C1A37B1336E1C475E4A347761D689A100A3FFD624F708E9733D8168E2E782D05E7ABA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470759, "uuid": "14daf9fc-d85e-4519-92bf-9643bda68710", "value": "a2b237a3d4044533f93cc953b769baf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470759, "uuid": "b082f3ee-6c10-4233-a59b-0252bbd7e6f2", "value": "1536:28nkrnqpsh5MhzF/e36M+1coOXKPzKs8jcdsqVs5j19uqON:JnGGsTyFM+ROXKPzPsqVsFuqON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470759, "uuid": "a6a59bc9-486a-41f6-9a30-da7c8084b27b", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470759, "uuid": "efdd691e-0612-4df0-a957-43080f0c8ca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470759, "uuid": "f1d7f684-a1cc-4ad9-a894-2266bd86a57f", "value": "SecuriteInfo.com.Variant.Graftor.419430.19252.12029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3461c7f-999f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702462221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702462221, "uuid": "cc2aac36-d9b7-4371-9de4-7503b0b9b865", "comment": "Malware payload (LummaStealer)", "value": "239dfe1687989dceaa48cee1db4da166", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702462221, "uuid": "31e16ab4-53c0-4b35-be92-a823dcc3bae6", "comment": "Malware payload (LummaStealer)", "value": "bd03c3f962a1787bee1d0af8277895fa5555bc11c2e80e5a3a07e00e4908965e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702462221, "uuid": "35c4fe42-f89a-4d23-a9dd-44f501d15f96", "comment": "Malware payload (LummaStealer)", "value": "5fff6af08ae34005a9311c3a116f4c00438d8c88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702462221, "uuid": "f42ae6b4-90a4-4817-bd5b-41d9aaec4c7b", "comment": "Malware payload (LummaStealer)", "value": "2a0ebb25ca3b77590a6200bdb2904425ba2daeb2e243adc75108872faac452f048740634afceda43ae53ae411781eef2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702462221, "uuid": "81851ae0-1901-4020-bea3-e25dd3e3db33", "value": "T13575234272E418B5CCB1BB7198F607D336327DAB65B0932B72525DAA5873488BC7073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702462221, "uuid": "280307f3-9b6a-40b7-9bd5-1ad1f8eb0159", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702462221, "uuid": "2254f63b-7bb0-4459-a65b-90c9fd838552", "value": "24576:3yeKLotFf/nV3drc9fGTJuyoXpa0V+EdZ/5cTK0V1KyuRYfck:CTYFnnValGT9opZdHcTXKyuKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702462221, "uuid": "f8097573-9f18-4a1b-b100-909ca2cba376", "value": 1570816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702462221, "uuid": "07744f29-e7d1-4be3-a114-7da7361ae88a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702462221, "uuid": "7fd0177b-f345-4d50-8a4f-1f362150b666", "value": "239dfe1687989dceaa48cee1db4da166.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f90ac04-998f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702455263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702455263, "uuid": "2230d57c-53d8-49e8-90b4-b6e7f0619622", "comment": "Malware payload (Formbook)", "value": "76c00f40d59e93c9a2aa33f7c54725b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702455263, "uuid": "0588e42f-7f78-44d4-9528-1a154e9da422", "comment": "Malware payload (Formbook)", "value": "be5ea75b6b003e8d06764370ba6a89be22845dec6bcf25a6f2d50c2d478dd214", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702455263, "uuid": "95a8639d-fc67-4710-8487-1940edfcc73e", "comment": "Malware payload (Formbook)", "value": "75c62b98218110e47ce165c0c1b9cd9bd7550307", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702455263, "uuid": "05be21e6-34df-479e-bdba-6350b7417fae", "comment": "Malware payload (Formbook)", "value": "841f3fdec235c05bd62a861892a19aabd68db8c027e9b17869bb91643c48fb546e86a0bfc67e85bd9b6659025dd9d3c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702455263, "uuid": "184c6132-86b7-41f3-8e95-3f396f37ff8b", "value": "T19015B13D19F92227F175C7A6DFD0C527B260A5EBB1629924DCD243960307A0BB9C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702455263, "uuid": "4388e51d-7414-484e-a4c3-962380af2e62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702455263, "uuid": "13a25e3e-8596-45b0-ba60-4f3bd329799f", "value": "12288:cfuhXlmL8ZoyIqpZA9LkllZ5fmYlgur+FVcBxBTBICSLnSPlSHDsX:47L8LIqP6LkxaUuutBICSzSPgIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702455263, "uuid": "87dad435-55ba-4947-bbe0-149d41425915", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702455263, "uuid": "86fe6350-8483-4eb8-9668-55baeafa3cac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702455263, "uuid": "c584ef51-610f-4d6b-8307-20cbfa6b5be0", "value": "SecuriteInfo.com.Win32.PWSX-gen.6457.2909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a98629c-9976-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702444517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702444517, "uuid": "05d3792c-ca16-42a0-9bc8-9dcdce875bab", "comment": "Malware payload (LummaStealer)", "value": "b9770b0cc509fa41b083f9c0ddaf19d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702444517, "uuid": "a438f339-f477-41c3-bb7d-abc2d6272271", "comment": "Malware payload (LummaStealer)", "value": "bfa2d8ea02128096b697884ff2ae77b1b1c5d597883d75b33b9f013908d1d47a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702444517, "uuid": "1e4f3c81-e693-4f7e-ade3-f188c3171d7b", "comment": "Malware payload (LummaStealer)", "value": "9895dd84b30e7722652b2f81a89e6d13e10e416a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702444517, "uuid": "3e75a61b-559d-417e-be25-1e1a2d933de3", "comment": "Malware payload (LummaStealer)", "value": "26b848e233f1130c415c620f5d23fdc71f767c940086d3183906160ab8c6abb5e769783d59f58b48d22af8c26464fa1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702444517, "uuid": "eda9ba20-1e97-49de-91ab-c24b0eea6298", "value": "T12A7523A27AF0A5F5DC336B7084FA12D327363D53E4B4469B36A1681A08B39C47D3477A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702444517, "uuid": "34cd58e3-27fb-4292-99d7-456d27f38189", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702444517, "uuid": "90677bbc-e1ad-42e4-b492-99d98e803d26", "value": "24576:Sy8g5cbKIdYfxnV3/rc9dl6gE3HD2zEGz8RMG+jTHFMHV+KRmyoYrfz3ci:58MMYpnVgXcHjrFxaLFs+KRmyoAfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702444517, "uuid": "055bf439-9393-41dd-bf2f-ab3874daa3d8", "value": 1570816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702444517, "uuid": "fcd839c9-203c-48c0-adab-9d186d4ed482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702444517, "uuid": "db37762f-41c1-4f40-ad20-9279a619a081", "value": "b9770b0cc509fa41b083f9c0ddaf19d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a23b094-99aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702466743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466743, "uuid": "d0862c61-f7ac-4620-b7a0-68ba2382c2c4", "comment": "Malware payload (AgentTesla)", "value": "9f36f37a2e83f9355be11ac462c7160a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466743, "uuid": "f593dca5-f0ac-46a9-9c65-c99d1dcc0bd3", "comment": "Malware payload (AgentTesla)", "value": "bfa9ee3b5a985b9a9a3d5df7d691a1f2fa14334d800331310033d37d3ed2ba8b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466743, "uuid": "fedd4039-68a6-40b3-ba54-a30a0d595154", "comment": "Malware payload (AgentTesla)", "value": "421bef7207444c94cc0ff8df8791c27f9fd4853a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466743, "uuid": "f25a4576-4abc-4acc-a73e-9b43fcb6f617", "comment": "Malware payload (AgentTesla)", "value": "881ec445d2d1f2030b47d020be7f6f1218dff52096f586a725eb012eb6b99b6ecb34aac75c768293ba1b9d16f8d244e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466743, "uuid": "0ef91409-7f13-4330-8779-3512a86ec108", "value": "T1F7E423683B28850FE5B753B395A211482BB27515BA73F78D7DC170E860F27920B926F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466743, "uuid": "3ea8395a-a6b8-469f-9201-599217310b5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466743, "uuid": "2e4f9d70-c973-4ba5-8d92-730dfebcd206", "value": "12288:lGZ+4WpAE6yzOhpJw8z0K4iircLftmVupjmoaL7FnCyyynlYI/vdl1U7pl+:FpAExWz06ircL0VDBYydnzXdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702466743, "uuid": "33ec8278-fb0e-49ae-a845-a16edfaff11b", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702466743, "uuid": "95643c0d-843f-4181-a08d-30895c8067cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466743, "uuid": "922001d7-05b8-4c01-b452-943ede633d3b", "value": "inv#3009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658034f6-99a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702464614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464614, "uuid": "ee5304ee-9ab3-4de6-8d03-0766e1edab3a", "comment": "Malware payload (LummaStealer)", "value": "c87b85fd0cc6012b5fb160f52e2f380a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464614, "uuid": "98949d67-a034-4a0c-bed3-74630d95e781", "comment": "Malware payload (LummaStealer)", "value": "bff3056054d9b1479039a698b688fa5df6c95b38b2d89108a0bc8ed3c5394e9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464614, "uuid": "443e7fee-8b83-4cec-ab5d-7aaf128ee85d", "comment": "Malware payload (LummaStealer)", "value": "06791174a3209dcc5f4c1874fe594af02b0a2c3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464614, "uuid": "5f2c42e0-1d8d-4bb7-90c9-8560c6aeb4d3", "comment": "Malware payload (LummaStealer)", "value": "62c301fbdf8c70aded4246e59336d44d7d8d1c9cac49cba06c5b655ba315a3febe205f2da58a77a1f65a948ce60cd112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464614, "uuid": "646362d7-1a47-4499-9533-cfc3ba21c0e7", "value": "T13C55F14073D68611E5FBCBB0E8F381640BB6FE117533EB4E3E54326E4E616A08D617A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464614, "uuid": "6c051ccc-28fd-4cba-9d61-20c97a297146", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464614, "uuid": "e2994dae-9d5f-410c-9967-1cc1a96e5de3", "value": "24576:WpT1FQn8ytsIMU9//YjGbZpG8V2+DCPOJ9hkLiROF6wsSeL6IWlRB:WpT1Fy8fURjnNVxCOJ9Kc+WSeKJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464614, "uuid": "f4571978-fef4-4e60-9681-aac2cc21986c", "value": 1299968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464614, "uuid": "bdadad5d-ebf9-46f4-9191-f4cda0a9920c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464614, "uuid": "0b86e3d4-25ae-4e15-bb27-081820cb4ba5", "value": "BFF3056054D9B1479039A698B688FA5DF6C95B38B2D89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9350501-9961-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702435549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435549, "uuid": "f75bd7af-5347-4fa3-b9d2-6de007a702cb", "comment": "Malware payload (Mirai)", "value": "5e39af89910e96132566124f2633205c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435549, "uuid": "2cf47087-77fd-46b0-9963-5de33bc8064f", "comment": "Malware payload (Mirai)", "value": "c131f311dab2a08d93859f3e6540e2bbedcb59015201f0b44e0e195749b5c2e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435549, "uuid": "1088b08d-d561-4101-ae07-7827fc85b1da", "comment": "Malware payload (Mirai)", "value": "99b84c29971b22cb67f9b0db81263d37a634b3f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435549, "uuid": "0a5c6871-f5ee-4b3f-b590-f67d5db1081a", "comment": "Malware payload (Mirai)", "value": "99b2475bb02ecf70f306c08879d76bd67ed39a0d22ec9a9c4d3f4739034c87a03d264682a8452865a52624abc9f463b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435549, "uuid": "779aa0a2-1372-4be8-8e2d-ffb4bece4c92", "value": "T1FA3308C4FA8B89F5D90749304067F13FCF31D5B940B1C6ADEF9A9F35CA67542A20228A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435549, "uuid": "08daf8b1-06dd-49fc-ba54-aa3b7f1ecee7", "value": "1536:nfyMY0q0Yv5qP69kj0MGNLMj2KZL7YkOwhtP:fyMY6Yv5qP6moNLMqKZfYBwh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702435549, "uuid": "296fcfa2-c0ec-4e13-8996-ea2c50df5bcf", "value": 54032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702435549, "uuid": "1f626ec2-1d40-4488-90f4-cd09263a577f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435549, "uuid": "105fec21-6f2f-47ee-a8f9-60baa7663c10", "value": "5e39af89910e96132566124f2633205c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47264fff-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480884, "uuid": "c1bbb75e-b0e9-4f40-acbb-209eec0ef2ec", "comment": "Malware payload", "value": "9bd66d936217089475d56fd69669994f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480884, "uuid": "4341764f-e07d-4805-8afc-47c200cb82f7", "comment": "Malware payload", "value": "c15dc70b92c586560570b26728bec9e13a34fa4e6392ec7e0497fb4939138919", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480884, "uuid": "1905315d-3bf4-4f3b-92eb-c1b24b3215f2", "comment": "Malware payload", "value": "579e13d614de35713270553dec21b3622a251d8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480884, "uuid": "caf98bf0-60c0-45b3-9393-14384d40986f", "comment": "Malware payload", "value": "07b6f9a28c2195fa3af8420eb1b2b5e72ff4f1337f6fa8e0e91892d3593d0b22e77a2a76c532ea23462bce07c1d067bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480884, "uuid": "bc1a1b3e-af27-4b86-ad0f-bd627e21e29b", "value": "T1F3469C379E1D5CCDE80164719C4A8FDA2954AC21B5086B9B76C1B96DCCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480884, "uuid": "13be7602-5956-44d9-9107-d9af8b30e2f5", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480884, "uuid": "7357aa7f-bf10-4196-94c4-e17483c2e016", "value": "98304:BDRUdkg9LiJFGjchchgQn+hKqTtVOSM65eGwzVXq590IjPtGg3le:BCdkm+JkYcCQnkK4BM65eGwzVXq590Iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480884, "uuid": "895a2293-1756-4ff3-84ed-4e5881162122", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480884, "uuid": "4bf7a29d-be27-403c-9578-b7405ee3e7c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480884, "uuid": "9de29e87-1a6b-4316-86e8-0508695fa3fb", "value": "SecuriteInfo.com.Trojan.Crypt.21717.3856", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5578a937-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480908, "uuid": "21af0dda-1115-4aa1-99fb-f1411d0f9150", "comment": "Malware payload", "value": "291b34166345073606f660feed127d66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480908, "uuid": "b3fb6567-2d24-47bd-848b-26153085143e", "comment": "Malware payload", "value": "c1862c091c5153b9ae06a0379b2ad38a58b75cfd626a3af63837ca68d9a011e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480908, "uuid": "a70228b5-9fa5-4c25-ae47-ae1533324e5a", "comment": "Malware payload", "value": "842d8f432d55ebc1b9b34142bee04d084830ff91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480908, "uuid": "6207f1a0-005b-47f9-a9fb-bc6a1fa82c72", "comment": "Malware payload", "value": "ef089632a96ad07c9a1a02129994d970ae7c2065825d7f56ec5b77c0db4e1133ec43e9d6092e3dad767501fa3f36445d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480908, "uuid": "45229ea6-173f-4988-950e-802ade4f12f6", "value": "T14F469D379E1D5CC9E90124719C5A8FDA2955DC20B4086B9B76C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480908, "uuid": "79cf1c86-a0ea-4dc6-a789-a85280749922", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480908, "uuid": "8a8e76c8-29d9-4891-ad32-729bf6fed124", "value": "98304:kKr0eaTsHC4rtoMZZ2c5ug6Hih6qT1AOEzZOVGwx1XKXtb7I5eQIAl:hUsHBpo855f6HY6AAzZOVGwx1XKXtb7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480908, "uuid": "e5bd6f36-8765-4c35-8cfb-ff72f1b6c7d8", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480908, "uuid": "6025fa3d-51db-4d7e-b6f8-a2315fefee49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480908, "uuid": "8b5c04ab-9fad-40a9-93d3-c80de74c9093", "value": "SecuriteInfo.com.Trojan.Crypt.16772.5556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f5c2bf2-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480871, "uuid": "a2356cef-42e2-4101-95a0-e44c099fe9a0", "comment": "Malware payload", "value": "890d2a72e54ac2292a41bf1a93a2d75e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480871, "uuid": "f5c37672-14ab-42e1-80f8-a752abe5a520", "comment": "Malware payload", "value": "c1f1a2043a601de5fba52dbd084d883400195ece24127c5e8260f470ee6694f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480871, "uuid": "7d425db8-1354-48aa-b4d4-618e5c264805", "comment": "Malware payload", "value": "e6e1e3627c59ec38f2ba3cb6d421583be2134372", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480871, "uuid": "dd7131aa-0e92-440f-b5c7-074108ee3909", "comment": "Malware payload", "value": "9b4508902ba43094b9db4260f616beb8fc798e16c55e88bc50d2de1d4d7b90086eb77cf0264ed7d97d5ff385bad69fd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480871, "uuid": "ae26ae4c-8750-462e-afe4-b411e8bffd8d", "value": "T1D8469D379E1C5C8DE90164719C5A8FDA2954AC20B5086B9B75C1B96DCCF0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480871, "uuid": "a6ff9cf3-6b5d-4106-a5ec-6a7c979c95e1", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480871, "uuid": "f2fefb48-8525-4dff-b62e-60932f902574", "value": "98304:KsTDu7+y3fuhpLsfeEg7U1h/qTlyOTH65NGwsVXqj90IAPOfj4q:K6u7zPuXmel7U3/MRH65NGwsVXqj90If", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480871, "uuid": "fafb8eef-163a-46ec-a895-6db2d5069149", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480871, "uuid": "b8778388-17af-4112-a7b1-2347c69a755e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480871, "uuid": "95bf9d13-01e1-4192-a5d2-3c81230009f4", "value": "SecuriteInfo.com.Trojan.Crypt.22869.14054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428ebdf7-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702470998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470998, "uuid": "e8f5d441-cbfc-451d-a480-3f7302d96f6a", "comment": "Malware payload (AgentTesla)", "value": "6c9e183d3be7e1ae1ee6ca6728b0c9ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470998, "uuid": "2fdcd0b0-5364-4886-92de-fccca7d0ae50", "comment": "Malware payload (AgentTesla)", "value": "c23c6f254df159d602ee926a7f87d01b7273b2d77c1ed1a0cd94755a0a7e5ca6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470998, "uuid": "87473b9a-5408-4ae3-8988-e1826db499c6", "comment": "Malware payload (AgentTesla)", "value": "93e62b7a50225dfb463edfc4b8968cf2dcaa5274", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470998, "uuid": "d9cedf52-5dd0-49b8-a933-798adf51d41b", "comment": "Malware payload (AgentTesla)", "value": "1acbda982d9713c68629344d54a65217460dacb32c9f901fc198376f0b4a907f41f35bc7eda55cfff95453cebd0b8033", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470998, "uuid": "ef92b3df-63b6-4f53-9836-87f1afb6ca8a", "value": "T10475BE13F70C4AACC8194FB1F037402082719EA797268A097AE9FA7E5DF5B491A534F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470998, "uuid": "2c284307-98f4-4a26-adb7-e4b4fa453a63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470998, "uuid": "5e6cd6cf-bb83-4fa7-ae06-5f85573d549e", "value": "24576:IG1pzw4kQFj5e4b6NSFKFAhqQOfW1sJa/Q6KzHrR23:vhw4kQFj5/4SFKFaxOfWwaort4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470998, "uuid": "148a9285-8507-419a-b196-ce5c8498c57f", "value": 1615872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470998, "uuid": "19bfa165-7bd0-44bb-be78-1bd91269af7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470998, "uuid": "f12b35a3-0cda-4a72-a30d-f514fe063700", "value": "INQ#876567_AWBMATERIALS_TCW_tresnds_incS_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493d8afb-99c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1702476163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702476163, "uuid": "2eca98e9-4693-493c-8e0e-faa9b3adebc7", "comment": "Malware payload (AsyncRAT)", "value": "2e600b1ff7cd82c6402bb280720ced61", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702476163, "uuid": "61e49c4d-6b25-459d-a4af-43d7570ecd20", "comment": "Malware payload (AsyncRAT)", "value": "c2ae169495738288c01df97f582da3db67e4f4d4514be563a7e2cbc069b76448", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702476163, "uuid": "9ddf815f-f860-46f2-9d10-ba077df7f3a4", "comment": "Malware payload (AsyncRAT)", "value": "b182c466b2a43d7ec3b5dad5a351b703771baa27", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702476163, "uuid": "7e95315d-74e6-497f-b3a3-bf2051dea62e", "comment": "Malware payload (AsyncRAT)", "value": "894e962d7bdb9e069dd6c478afa845abe46474e1067f2b1d8b06a34905e65bd60cebc3be356a718f52c26a7067ea74fe", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702476163, "uuid": "9ad2e0fa-c03b-465f-b160-f8ed4aa4c300", "value": "T1FE55D122A3D14437D17356799D7BC298AC367E203AE4984A2EF4EE4C1F387C17939267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702476163, "uuid": "e474538e-4743-4f57-8516-509fead62a7e", "value": "2991d2c176248f75cc944dd85863c8ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702476163, "uuid": "e57f7edc-527c-4fa3-9c5a-8051b959dda7", "value": "24576:w+7dsbKHIny1loKiqxsbOMVolrhuXvc9Ft2rmeOaNRRL:Non782UTt2rm1KDL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702476163, "uuid": "5b072073-d361-400b-b924-435060c0df2e", "value": 1388032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702476163, "uuid": "ca02ea8c-fcdf-4dbf-a632-e6110f3cab82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702476163, "uuid": "ade1619b-3231-4b3b-a727-eda24c91637c", "value": "TierDiagnosis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdad45f9-9a0d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702509457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702509457, "uuid": "3c909508-4f70-4989-ad72-66b1b30f5916", "comment": "Malware payload", "value": "0d570bf163d36de1eb179e1303efa48d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702509457, "uuid": "9fc67711-8d6a-43d0-8382-3b7a72c91e83", "comment": "Malware payload", "value": "c32118c2a3762e9f726d9ff46966beff26669fa952798183642e8c1de6efc927", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702509457, "uuid": "d11f15e2-311c-4e9e-b409-5f9366605451", "comment": "Malware payload", "value": "f72e3894e811a640e3cb711b5b2fb48bb2f819e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702509457, "uuid": "1ab9963b-e875-4c4b-8e70-34356c7c172e", "comment": "Malware payload", "value": "8480aaf4a4898236414affe4bda811a4552dec99b08fc20e074afbffcc140d74c7918b6ca5e9bca9164a9a52abf0b19b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702509457, "uuid": "455c5650-664e-4c8f-9104-b405564988c3", "value": "T1BD95F190ACDD655EEC237BF548B161A483EB10F95287EDB4DD9016BE2864ECB0DC1C3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702509457, "uuid": "c04b9e31-e9b8-4e08-88cb-2196876b32a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702509457, "uuid": "8a58721a-2721-48e4-85c6-fccab06ce1ab", "value": "24576:kptvbuGMVbT2DK2RjIsPf51MfAKzsrYqNsfvwEfm358elUQzlR0CgNHRMywJVo/c:IvOdyDK2REsfgQaoE+22CQU/hp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702509457, "uuid": "7529db9b-12dd-49ec-af02-2e7904114dc7", "value": 1919896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702509457, "uuid": "4427592d-df67-4e5b-b0cf-2b3bf80e1479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702509457, "uuid": "8e568b25-af00-4e18-bfd6-0de5726d223e", "value": "SecuriteInfo.com.Win32.PWSX-gen.8428.27403", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2aac1e-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1702470930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470930, "uuid": "6c2f4bcb-4a4a-46ca-bb11-e6d4a3bb8760", "comment": "Malware payload (zgRAT)", "value": "f339ea43db0f11330dfd558cc25a5a82", "object_relation": "md5", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470930, "uuid": "6daa4fb1-a213-4d4d-843c-ca13ec7b898b", "comment": "Malware payload (zgRAT)", "value": "c331f95e895af34cdef56c25798f1e1fe8ab448af4267e2a26ac4e46290fc2dc", "object_relation": "sha256", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470930, "uuid": "d8d74d50-af7a-40cc-ad13-ec0693a2e106", "comment": "Malware payload (zgRAT)", "value": "f8bc2249fedcbe2643e87f5475e420ecd59d2e1b", "object_relation": "sha1", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470930, "uuid": "cf92373b-0bf1-4982-8c1c-61ad071071e1", "comment": "Malware payload (zgRAT)", "value": "c10825db62222a9db36741dd82cbca138697f0166f46f295db27636500a2ec6fabfdd7aaae8e230c514251548348b259", "object_relation": "sha3-384", "Tag": [ { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470930, "uuid": "7c899abe-fe1c-40a3-80f9-220c2b02977f", "value": "T1E615C33D19F92227F075C7A6DFE0C527B260A5EBB052AD24D8D243964307A4B79C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470930, "uuid": "64864d78-8cb5-4c84-8e79-e28d0b23f9d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470930, "uuid": "b3a1173d-08e8-4362-9ce7-4ed4ea1eee47", "value": "12288:s0Ety9Cx37a6Swu8wwKAMItNAnbdpYksx8j2oxJjCFESDwWaWd:sDthxHr4bIIbdyksx8jvxJGvwWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470930, "uuid": "fb0db079-b754-47fd-8877-8555dfe8fba2", "value": 914944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470930, "uuid": "605eed88-a734-412b-86fa-96755e9f1350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470930, "uuid": "4c9c4ada-d3d5-413b-a745-48ef99ef2034", "value": "Certificado de cuenta BBVA.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358c99d9-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480855, "uuid": "d0d971a6-c0e9-4d3b-b4e6-1f219c36e370", "comment": "Malware payload", "value": "4f097d89f3284625c48f717bf5180064", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480855, "uuid": "e4f8901a-9167-4e06-b711-5e79ed5a977d", "comment": "Malware payload", "value": "c385b6acb1081c74c04056785f9d2369df55832f1f8d3ac4acba310c45a4da81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480855, "uuid": "a924c8da-6431-4fec-9d4f-7160b03de71d", "comment": "Malware payload", "value": "fd38085a96755390761eb562f16fa01ac4cf1d76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480855, "uuid": "0ede5481-ce0d-4476-8c32-07cb3658fe3d", "comment": "Malware payload", "value": "e0503848fc2eb6ab0a926f6c9154e886ce0fa11fa6e3a5590fdac078964b550a1d62b24517c5f65d08026725339d7345", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480855, "uuid": "6b58c043-b2e4-416e-9d78-f287fed4a01a", "value": "T1F1A36D43F1C24076E4B301334A355E35EAB8FE79D237195793C83A8E1EB2C96D71529A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480855, "uuid": "56d53583-dcc5-4228-b3d6-5d26a251695f", "value": "dfe9e05899b669639a906e7d324950b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480855, "uuid": "5e180e6a-7e5c-4cf6-9659-e86a12f3b1a9", "value": "1536:rAicAAxdlRlo9o/QKzxZfcCQ/euTBjeGIobozKJpqRjzIp/CMARtrnWV:00AxdlRlMIZf0/egBeAJpuzIglR5nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480855, "uuid": "579116fe-7dcb-4599-9c7a-cacc80a40bfd", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480855, "uuid": "75d836f4-d6d1-46fb-b392-ee0a05cbe6d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480855, "uuid": "cf0bcd86-27d1-4849-b504-4d1cc150b958", "value": "SecuriteInfo.com.BScope.Adware.Puwaders.11744.7256", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5eb05c-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480839, "uuid": "d8c08199-6892-4406-9fe4-5d7c9ea99058", "comment": "Malware payload", "value": "a63e98a82f58022aabcb1d845ba6a90c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480839, "uuid": "e242bf70-8935-4b6a-908c-9f24c6fb6492", "comment": "Malware payload", "value": "c3aabaea71508fad37191348d9d4cd2ef08f74d53fcd70d668912599814124cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480839, "uuid": "bacf0442-b2a1-4bc9-892d-4bf1758b364e", "comment": "Malware payload", "value": "0c14eff823727e877aed7c945dcd3290d362d426", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480839, "uuid": "42ff25aa-f325-424a-a60c-af6be5d69e10", "comment": "Malware payload", "value": "76495efc6e32c99ab5de72fced1650d3742d6c528521ba07e3c3ba70977faf1f5ff9a1611b4f3e46af2c4d403feaebdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480839, "uuid": "3a436293-fa81-417c-ae73-b474c9158d26", "value": "T163469E378E1D5C89F90164719C1A8FDA2954EC21B5085B9B76C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480839, "uuid": "cdb7450b-4cda-4e25-ae31-0590d1babe34", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480839, "uuid": "1e827750-efd8-43ad-a8c4-5796e548b9cf", "value": "98304:RPyg6u0bIObqcP9j66g+eehgqTZaOAX0G8uIqlDC75QYcB73yBK:RH6uMdbPd6j+eEg4yX0G8uIqlDC75QY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480839, "uuid": "47c4c249-2bcc-4047-b38a-d005d7ca699d", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480839, "uuid": "b2313c56-1a18-43e5-b15b-aad8ef97f259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480839, "uuid": "cefeec6e-2a64-4b62-b8c6-c2f864745eaa", "value": "SecuriteInfo.com.Trojan.Crypt.30959.28707", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1510847d-99a6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702464909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464909, "uuid": "8acd3a95-12ed-4687-a7f7-3f872f169997", "comment": "Malware payload (RedLineStealer)", "value": "f22162193a0259940034c07038be5b85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464909, "uuid": "b6295e84-88af-4f53-9b4a-48a7aa670610", "comment": "Malware payload (RedLineStealer)", "value": "c3f186d06596a1815be909f8ac67efb46d553868307dd64de40f536128d10d5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464909, "uuid": "4e05d3e0-2117-45ec-9a72-432ad09eb7b2", "comment": "Malware payload (RedLineStealer)", "value": "ba6946a252df0400e270018b49482ae49534265a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464909, "uuid": "917e85e6-ceb8-4fde-bb2f-5e11532e8f90", "comment": "Malware payload (RedLineStealer)", "value": "56e5f91e4bcf7b1c459a2ce57c0f443b9b012cbdd3ab0fa942fa640a7fe1fcb6bd844b1ca29c0674ba3f8339b3772ec9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464909, "uuid": "aa28a046-52b2-4f33-9268-6a79ba7f3121", "value": "T1D9B59E11B6E0C471E5A1613706E4D7B9E67AFB604B2A59FB23900FAF4F233C09A34567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464909, "uuid": "2dfe16c7-76d4-47c2-bf88-dbc2bece9dc5", "value": "5126f161c901e3ab94a05a58465b8645", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464909, "uuid": "c57cc13a-3146-4c56-987e-c2b89c23a743", "value": "6144:q0hBcCFdklWvZMJvez81T7vkAO72z3jdX/fXNqayaVx:q0h2CbklWvwVkNmjdX/UayaVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464909, "uuid": "0c21b93a-3096-48b2-bed6-e85473790e0d", "value": 2423921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464909, "uuid": "81ce7a48-ca74-42a9-a7e5-a9f38c2867fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464909, "uuid": "89733aff-bd2d-4f0a-a8e5-479bb01c2bec", "value": "f22162193a0259940034c07038be5b85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdbb98a-99ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1702468470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468470, "uuid": "d5a2b566-8f66-4ed4-a593-3a7d8fb6834c", "comment": "Malware payload (GuLoader)", "value": "142b0e62a8327db1abaacb248bae2e17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468470, "uuid": "47a68f56-26c6-4a05-9efb-a96800551a9d", "comment": "Malware payload (GuLoader)", "value": "c56a8b37ea26f20d94692d97af9799384515535e3809e111ddff04fa56b911f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468470, "uuid": "4fbfdc13-4e3c-4ff4-ace6-4ae309b18a57", "comment": "Malware payload (GuLoader)", "value": "1c387d9d75857ffb5901b32e911d5737227d95c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468470, "uuid": "ca160d54-8024-467f-b6a6-11ce999c25c2", "comment": "Malware payload (GuLoader)", "value": "a4165830746ebec642e87bfd0bca0d5404ea1aa79848d5d1d0b2f27ec8cde64743adce8d1c7a5d126b3244584f38b402", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468470, "uuid": "378c6bfa-3b9a-45ad-af56-2357f467706e", "value": "T1A41533358F46E7D7D22B43B665232B5B4FDECB25E9AA0E0F0398B054344B791EA0B153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468470, "uuid": "abaf8c6c-625e-4f02-9712-fd3cb541f398", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468470, "uuid": "7add5846-2357-4e4b-a3de-4f09196ddb0f", "value": "24576:a7QMmUa6E0ZOLhbhDjoJfMpxXM+u7vR/k4sD:cE0ZMbtjogxFgRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702468470, "uuid": "a2bbd362-3dda-487b-8b3c-b1ec7c7624fd", "value": 880096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702468470, "uuid": "4979bc46-91ee-4f23-863b-4a102e63bb04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468470, "uuid": "ccad1d3a-13af-4342-8491-ad9a4ce6288b", "value": "Sample and list of items 002.Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8727062c-999d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1702461235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461235, "uuid": "9882838f-8094-4aef-b8ff-e5501fe5e1b8", "comment": "Malware payload (Gafgyt)", "value": "cfd453a099b0272a0b3cf3fb40851604", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461235, "uuid": "fe33b5e8-4eed-460a-b0ca-d60ae8a030ee", "comment": "Malware payload (Gafgyt)", "value": "c62359b2457e2eeaa4d74003632babc177e8dd116bc857dcd54a3bf381e1e844", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461235, "uuid": "c1dd56e6-ca36-4806-94ff-269603dd8553", "comment": "Malware payload (Gafgyt)", "value": "c49a0a3d097e927eb2cf961adf5dd4167d8bbbcf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461235, "uuid": "efa2f8c7-63c4-470f-b2b6-0e688a6d7298", "comment": "Malware payload (Gafgyt)", "value": "bcfd4589cacffa82f2da98e827165af37830b68045cada24ec9a31a7e4538bb4539eb1529e28bebbe4bb402f5292fe11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461235, "uuid": "5045e261-a969-4ec9-8114-d1aeb29eb324", "value": "T17FF34905E6408B57C1E2277AE6CF824D33338B94A3EB33155938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461235, "uuid": "593fe032-25f6-4a83-bc61-655d91dd63aa", "value": "3072:T1g2/eINNlzx2kkQCMOaQcvB4YnyLRM/9q3tmFwfBxKQodn:hg2hNNlzIkk/MOa/mYnydM/9MmFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702461235, "uuid": "1f0765e1-f491-44a2-9d24-394e6102d534", "value": 159888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702461235, "uuid": "5b919238-3dc3-40d3-86d9-221d3695940f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461235, "uuid": "d9fc881c-27fb-4ef5-a042-00d5fe8c231e", "value": "cfd453a099b0272a0b3cf3fb40851604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8386fea2-99fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702502890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502890, "uuid": "fc34de77-cac1-4e55-8ea0-a9cd4ae2c9cc", "comment": "Malware payload", "value": "88357c8115dcb7e7cfb8fe30c99fe4a2", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "HTTPS", "colour": "#B27793", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502890, "uuid": "43e81f69-12aa-4efd-b020-e673bbdb98c1", "comment": "Malware payload", "value": "c832462c15c8041191f190f7a88d25089d57f78e97161c3003d68d0cc2c4baa3", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "HTTPS", "colour": "#B27793", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502890, "uuid": "e3963682-e173-4775-b8ce-0f02f3f31ba7", "comment": "Malware payload", "value": "23761328b0f584fb872548be90c8ab4f605f2712", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "HTTPS", "colour": "#B27793", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502890, "uuid": "73b3ae17-b3f4-4f93-93be-b01d17f3b776", "comment": "Malware payload", "value": "b0a4a875e3513b2ae97c0b7ba94566756ca84ca70f43796951b1d67384061e1117c7487007a1a40b72b6e4c6100bdf88", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "HTTPS", "colour": "#B27793", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502890, "uuid": "f077d0a3-a046-4a0f-8dbe-f3f0450d6ea3", "value": "T173C38C7726CCD6FDC80DC33B14A1B46AF4A3A84339DB15F7629666003614AD4EBFEA41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502890, "uuid": "540b57d4-d6ba-4a3c-a756-fe7b8c95ff1b", "value": "a71f9a1c4a1445f92b7bbca6fba33a96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502890, "uuid": "b0322574-ba51-4507-a6b1-14b10e994f70", "value": "3072:yax1D5fgNM3pAIzuNc4+TdcjpMP5NJ7jBq4Fhfn2wjfBAVGx64f1:HJ5p/z+P+JcjIuM/2wjv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702502890, "uuid": "df56b6ad-8038-4f4f-8c82-c54d7f25ee3f", "value": 123904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702502890, "uuid": "8322351b-8c5a-4142-9f26-d18c92c2f36e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502890, "uuid": "fb887738-c051-4b3c-b781-07dc7294ddde", "value": "88357c8115dcb7e7cfb8fe30c99fe4a2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7199e6-99ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702468521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468521, "uuid": "eb2a82ed-be3b-4e57-8caa-6ccd140dd301", "comment": "Malware payload (AgentTesla)", "value": "6706163be8265d3f1d2542d710d29ad9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468521, "uuid": "ad3d0b55-7c45-4596-81cf-fc36ae989c85", "comment": "Malware payload (AgentTesla)", "value": "c971d8ddd27af4e2b0e476a24e40e6422ced3b862499b8692b3a869e035905b9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468521, "uuid": "7f3ae3cc-3a7c-486a-b71c-f60681a42797", "comment": "Malware payload (AgentTesla)", "value": "c37cad780a7271c4b16fa254c9f915e425dfbdb8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702468521, "uuid": "69d53e04-bd6f-44af-99e4-950d5fc7b4f9", "comment": "Malware payload (AgentTesla)", "value": "3df5fbac376f5ff1525a0c0e9d524a2e36b3bcaa50ef8c9a35e02e454da2efa04473ae2e21cacf56cf4cba921823a2c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468521, "uuid": "7a17b498-abfd-4092-9732-1cae102e21d2", "value": "T1BDB423151A90E86BDA438E701EBD67E39F63E1118CB48A0B17506FAEBC717807B5EB50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468521, "uuid": "f1104710-3dab-4c38-b51b-ec727c669fde", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468521, "uuid": "29476194-9288-463a-8f38-fcfe53694596", "value": "12288:AYGvkSaFMOHJU0EQ2C2wrAQMYHa5/+o7Uied75eHdt:AYGvQRpiRYAQbHap+w1eJw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702468521, "uuid": "f3882f4e-1a0c-4366-aaed-5f7bb9b24a8c", "value": 496416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702468521, "uuid": "71e8cce9-f5bd-49dc-b02e-4f46de746b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702468521, "uuid": "c1e9dede-19e6-475f-9237-1c6b34872202", "value": "INQ#876567_AWBMATERIAL_TCW_tresnds_inc_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfd3ede-99fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702502290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502290, "uuid": "ae145624-f796-4aa3-b31a-5208e57a62a9", "comment": "Malware payload", "value": "eda3a4a6ecbce06e837ffcb2e805d659", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502290, "uuid": "ec027e56-3e20-4d23-9132-f6f967c723ee", "comment": "Malware payload", "value": "c9958fe5b8ed78bcad9030837ac66dd8ce804e6b6ab90b8178d46b8de437070d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502290, "uuid": "fd8586f6-c56e-4e5c-a966-8d01c84fcafd", "comment": "Malware payload", "value": "cf943c534402116f008536c2182790f806cd2f80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702502290, "uuid": "bf56195b-208e-4984-8114-35581393be7d", "comment": "Malware payload", "value": "32815b0376d01a2b8024d369453c5da7d816f21b7a799a04730d3efef8f683e5c95c3db16be5f574e5316d2db717a4f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502290, "uuid": "c9368e20-323c-4e89-807d-9aa50427a037", "value": "T1CAD38C17B3A404FFE47683B4C9231E0AD7B6B45116D59FAF03A483891F23B919D3AB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502290, "uuid": "64f12f3e-0bb4-446c-8faa-d6e3ffb57817", "value": "2e065141377c7681c15aa62be2191a33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502290, "uuid": "158ac6d9-4d20-4cc1-abf9-9548deeaf026", "value": "3072:2X98f547Mp2BKrT6t0aCiKmrWfRGlC7PW:C9E54Yp9T6mD5G4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702502290, "uuid": "288ac1b8-c051-4760-856a-5d2107a7229b", "value": 136776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702502290, "uuid": "abfc4f6b-fd9c-4a0f-8c04-547d18daa862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702502290, "uuid": "cee0fd26-cbdf-4800-969a-4877df997084", "value": "SecuriteInfo.com.Win64.MalwareX-gen.24613.27067", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27873126-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480831, "uuid": "e4188dfc-144d-4992-86aa-95bd8e3c47f0", "comment": "Malware payload", "value": "d1adaee8e39f9d7f47e0e87b296c9a7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480831, "uuid": "afb8cbb3-f7eb-4675-9c0d-f185a9c762fe", "comment": "Malware payload", "value": "c9f21f149cc03a043120516a9b25b9746d8a202d3cfb84bb099d30540cdb44d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480831, "uuid": "58683f9d-5fc5-45ce-82a0-c5c5c9f1d169", "comment": "Malware payload", "value": "c48ee0a4c44e54d38c6f1ef7c9cf6a44ca1791fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480831, "uuid": "08ae7f88-7dbb-417d-96d1-5bf2f7ad6a52", "comment": "Malware payload", "value": "82ef8e6b49441708b6da0c09d7c0d60bf49acd720d490fbf9ea3c02deccc9db032590272a26725724efb8ef9acdc146f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480831, "uuid": "79c0f647-d5f5-49c0-9cad-9a5afdbded2d", "value": "T15A846E76F6D08437C2731638CC5B97A8EC3ABE503D25589A3BE81D4C8F397817969293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480831, "uuid": "1e4b8a3e-42a3-45b4-a037-6d8d4026bb49", "value": "6144:oSkVUlstFIaj2yxrVBMGixkx0vv6Cc+002U+1eJJjvgEM5ckkT5Ql:+VasDI8okQSi0/g5YEMSkkT52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480831, "uuid": "2b35c5b2-4969-4685-a894-f80a06e70465", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480831, "uuid": "49a3f560-24c5-411d-92e5-c922b0cded74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480831, "uuid": "c6b25a9f-690a-4eae-9f1e-eb94e4ef4ca5", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.10269.30412", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0cda25-99b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702470849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470849, "uuid": "3fa2f532-df81-4765-b9a2-574f9a0c7251", "comment": "Malware payload (RemcosRAT)", "value": "3f6bc2abe57e042104c80c53856722b0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470849, "uuid": "3496d9a7-eec1-4918-95ca-8852be84bb03", "comment": "Malware payload (RemcosRAT)", "value": "ca014becfb9048a1925705305960d111ac78be8864b1a21b414fab548aacfe23", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470849, "uuid": "015681f5-a4f1-4924-8b04-99d6505ca7d4", "comment": "Malware payload (RemcosRAT)", "value": "4274ac5492b5bddfab1e01e54d87ebf5cc89011c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470849, "uuid": "639f852b-fe52-445e-9794-1ec80ceab83b", "comment": "Malware payload (RemcosRAT)", "value": "a0b9eaee348050bbc0b102b2c53eb8fbe7726dceb71bc91c3d50fc71c127bd9406a1f4930cc881d96558eb901530ce12", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470849, "uuid": "1c3c23c2-7a5c-4bab-907b-5c7e6e599fd5", "value": "T10FB53348FB75CC0AE0B5CA95C2646CA389E805C850236715FA72FAD1F797294BEF1BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470849, "uuid": "2d78dd60-ae2d-4256-8400-4ac55f3e4fe4", "value": "49152:Dvxbc6jRLPJDvcpA3VlxrU6TfxUImN6jRLPJDvcpA3VlxrU6TfxUImb:Txbc6VLPJLRF3lfxvmN6VLPJLRF3lfxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470849, "uuid": "7cddc72b-0c6c-44ed-988a-fd22b2cffca7", "value": 2387570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470849, "uuid": "ec853355-9a67-464c-b1a9-3f3878b9f48f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470849, "uuid": "2c0fc4a1-1b19-4513-8000-28383d0f3d44", "value": "PR9865670008000.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682bce18-99b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702469773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469773, "uuid": "f1d8d6d4-c488-4f3d-95c7-e96ea40ce8b3", "comment": "Malware payload", "value": "b5d0bbe919968465a64a532db0543f54", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469773, "uuid": "2e3d5f6a-d9f0-4706-b6ed-b0d9697da929", "comment": "Malware payload", "value": "ca589ea81ce850100afc0a11356dcc2d1dd5b3c738cf0eecb636eee5018d9423", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469773, "uuid": "e09681e2-8ee3-4f4f-9d61-719f7f54d12d", "comment": "Malware payload", "value": "81890a216f70ded915e78063661891e7afa854d6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469773, "uuid": "4fb36163-5c01-460e-9fb8-b2e1f0a5d2fd", "comment": "Malware payload", "value": "b24549d6f8f3a587ec972c0ab2fb75c3430e3f6b3521fb8bd7e6189d164391d031a50fc4d39e85b5cd74d0c556f468bc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469773, "uuid": "e10cf87f-cfaf-41e8-be7b-dc195479eaf8", "value": "T18CB523A0ADD4A86BE44521FDC9CC6FCE563B0B1DB22E51FB4D3B559182404BC9CB2A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469773, "uuid": "a89d0ff6-e218-4e55-96f6-85fcc7e8d29d", "value": "b9d423ad60dd9e043c2784af177abbe7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469773, "uuid": "cdf5e393-2818-431f-b837-2398986b9630", "value": "49152:fN6/1V/JhjuNMJXy1XnWUOEKQDKmQo99g43nf+j6lDmb:fN6/1r1u7o0DkN8nmj6lDmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469773, "uuid": "c38ef6ed-fb30-4303-aa59-6a93a8783414", "value": 2396160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469773, "uuid": "de884207-07a7-45f7-a5ea-92e4d0b8ed96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469773, "uuid": "0a6c924c-ec88-4364-9a6b-0566e219387b", "value": "b5d0bbe919968465a64a532db0543f54.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fece445-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702470994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470994, "uuid": "abe8b490-960d-4a86-b0ab-eba950c65dd0", "comment": "Malware payload (AgentTesla)", "value": "3738192dee4798f6b85ea619c1d3d4be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470994, "uuid": "907b1039-a2fa-4c88-960b-9fabf65c5279", "comment": "Malware payload (AgentTesla)", "value": "ca6de337c2d6a95d72c31d5c519e3b4e9eddcd2d3e37eb188605ece3c5c5d7cd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470994, "uuid": "def3a91b-e1a8-4d25-9c1b-c8d657326f31", "comment": "Malware payload (AgentTesla)", "value": "c81f37ca084f828b9e4aea41bbcf0ca6b014f5f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470994, "uuid": "fff2c21a-88d3-4fde-b65e-b8f54030663e", "comment": "Malware payload (AgentTesla)", "value": "b956ff6655aae8e375ebf53c1f005dc83c2885ef84451d9ae60c360da365e9a488b48e1ba855118f050f001b57d1ea42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470994, "uuid": "445ee0b0-aa11-4a42-8d6a-1fa858a83ed9", "value": "T161E4230C272BFF07C7B862B946E7148063B8C6F36A32E75B8D94555686C3AF215C178B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470994, "uuid": "91ca13bf-0ddc-4850-ac33-888b90c02cee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470994, "uuid": "e8388749-cff8-41b0-b0cd-f6e7a7593fe0", "value": "12288:znmnkJ4BVucBJ9F2iH2Q57K6muUQR1Y43WpoaIRKrhe7k1gwYega8fH:bmJruW/F2m2o7K6rhR1HWpoaIRKrhokN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470994, "uuid": "8d189ab8-e887-45de-8e5d-dab7bba2ad91", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470994, "uuid": "1b03bc1e-9256-4bdc-995a-5339415618a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470994, "uuid": "fbf02459-d9df-408d-9834-9df6b7f79b58", "value": "odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff70404-99c6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkGate)", "timestamp": 1702478859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478859, "uuid": "d503b1d7-3af1-4b19-b049-a840f0db83a8", "comment": "Malware payload (DarkGate)", "value": "532e3eb934bb4e026de842a3c6f921d7", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478859, "uuid": "bc1862c4-656f-45e0-aa0a-7b7bd766113b", "comment": "Malware payload (DarkGate)", "value": "cb364ebad9d0f064732fdeb4fa0ac5119d7a37988c0d3c44826d8c9ba4bc1097", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478859, "uuid": "8899abec-8248-4bda-8b86-e53c77a294ba", "comment": "Malware payload (DarkGate)", "value": "f2e3413a147100ec2764973fa5b77bbb8951ff1c", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478859, "uuid": "7d996991-d2a0-4078-bd75-6c020d88aec9", "comment": "Malware payload (DarkGate)", "value": "381da5cc82ce2e695d7e4512751b77bf8c295912d5f6e3c195f87f534a9a140183a8f33f91c412ea82ba02d3cb7fe132", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478859, "uuid": "04f28622-ea31-4fc4-88a6-316fe8b73be3", "value": "T1BB053362DE3F4863D6627939CAE8DABCB80B0F842195CF305121F946BD7D86F4778690", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478859, "uuid": "7b9d3cc4-faa0-4b25-a930-bd3deb8fc34e", "value": "24576:WqN4Bsnf0DpIl9Bqo2Tj2T6kDh6GEZf4dTS13Z+9J:msf0Dp69BATST6kDMjl3Z+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702478859, "uuid": "513c4065-0ff1-4029-ab2a-3ecec2e0330e", "value": 821008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702478859, "uuid": "7b4c09fa-029f-4d5a-898a-edaa289d6cdf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478859, "uuid": "c759a3de-2f85-45cb-b06c-57e18b81819b", "value": "DEC-872667-2023.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfce18f4-99fb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702501702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702501702, "uuid": "0b090bf1-98c4-4017-892f-72729e7e5845", "comment": "Malware payload", "value": "46125424b4982c6ae17af821dedb9bfb", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "rsockstun", "colour": "#3B9C59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702501702, "uuid": "53a7a654-c9b6-4192-8695-ef9afe0a6a69", "comment": "Malware payload", "value": "cb83e5cb264161c28de76a44d0edb450745e773d24bec5869d85f69633e44dcf", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "rsockstun", "colour": "#3B9C59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702501702, "uuid": "d688e677-f4b6-40a0-967d-5783dae61f8b", "comment": "Malware payload", "value": "18192bb4aaa1b72104be4d26460b55f31ca65baf", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "rsockstun", "colour": "#3B9C59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702501702, "uuid": "3eb7cc0c-516c-4d24-9153-125e69ad9ef6", "comment": "Malware payload", "value": "2439f1c3519b5e9d0f6cc5ef705148bbc38f1fb9b22f93661160a49f2311c6a11b16b90cc9f6b0d476e5062c0262c264", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "graphicalproton", "colour": "#F1A735", "exportable": true, "hide_tag": false }, { "name": "rsockstun", "colour": "#3B9C59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702501702, "uuid": "3808c138-f86c-432a-a060-4e89c38c1ed2", "value": "T187668C03FC9561A9C5EAD230CA718252BA707C885B2037D32B61F7B92A73BD45F79394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702501702, "uuid": "56feb0d5-4786-4217-ba3b-b60b48502d12", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702501702, "uuid": "b56b54e6-534a-47dd-b0c6-1840b77908ef", "value": "98304:I3Rwim3OrVwFEd+/tGOpsFDmY6SGgrf25ggEx:wE0w2o1WFDmDSGyAgHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702501702, "uuid": "7414e965-5f6d-4e53-a75c-2d4bd9f178e6", "value": 6659072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702501702, "uuid": "4cab4f49-5ef3-4fb1-a8a5-9098ab2c7833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702501702, "uuid": "796d8fed-2590-4a0c-9f18-d176fb0d55dd", "value": "rr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071f23d4-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702470898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470898, "uuid": "9265a376-6f2d-42ba-a8b2-51c203351487", "comment": "Malware payload", "value": "2e0859c912b79da46a04be6b61411e64", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470898, "uuid": "0ec70605-fd89-459d-8656-723a69421ae3", "comment": "Malware payload", "value": "cb97201625b5501f5ad6102f4c85aab4edb2ab7fdf9b71c7bf4760c2505a38bb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470898, "uuid": "f57a39e2-fa79-4cbf-a259-6a1ab603f905", "comment": "Malware payload", "value": "016b558985985cd33d75c576a8ac3d10a9e9924d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470898, "uuid": "6d859c12-01b0-4c2e-8212-1bd1567f634c", "comment": "Malware payload", "value": "58f548bad4cdda4ff653385aec65f82cd5b91dabb6b6e23587e04fffbbcf2e7d104c88a57cdd9542d0b88b0e83178578", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470898, "uuid": "5cc8529e-92cb-4852-94fb-f85c38d030c7", "value": "T10FD42369071E0D65E3BF415732E824E0CEA8B375840ADA18BB44C6913EDAAB1D37DC7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470898, "uuid": "822b64df-4ac8-4d97-91aa-26505d5c9859", "value": "12288:EOV9V7HEzSU4MII4z7L5daK2cRm6BaW6RMSneAIZl2KCp:EOh7Ezzj6z7VoK2Cm6BavRMZbCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470898, "uuid": "73b560a6-f843-4043-b819-5ad60f50e59f", "value": 611640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470898, "uuid": "77347e38-280f-4911-999b-f3da0120d45d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470898, "uuid": "a8778e64-2ba9-44e6-be30-bd7d45825f26", "value": "YATEM MILES INQUIRY INQ526413.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fa7cd2-99c4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702478164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478164, "uuid": "808d7897-8347-4288-aee5-82f675fd914f", "comment": "Malware payload (AgentTesla)", "value": "cf262eb3fb280d9eb218f99c724437ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478164, "uuid": "93263de6-3265-4432-bd2f-3fdf59733466", "comment": "Malware payload (AgentTesla)", "value": "cbfc4a113fb44f752bc2911f4e4cb78c7c03f673061c20ce31bc0c4cff6b85ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478164, "uuid": "4d719fce-0c29-4a2c-b679-1af94ecc08fb", "comment": "Malware payload (AgentTesla)", "value": "ae94b55f84ddf2509d020ef59f7b81c04c524443", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478164, "uuid": "35278c93-0f08-4b79-ac4c-3197b85e03a1", "comment": "Malware payload (AgentTesla)", "value": "2f9c0fccc025c7db9e64dacd413576a37e32906a79c55fb9171d7bd1bc159487ac52eaf58a92e832dff7b4c9164d6384", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478164, "uuid": "795185df-a342-44f0-bde1-e6f5b53afbbc", "value": "T12215CF03B7178AA2C7946B75CAE356000760F5A752ABE70B77CA23A914833BF9F51707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478164, "uuid": "8a2c8936-afaf-46aa-abb2-3b19ca21a19b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478164, "uuid": "b274e8b7-ace3-46dd-8758-bbc9a625f77b", "value": "12288:0WyzRXfVVacmd2nTDxoxOFR5Lp5KjpuSkbdeBPzzQ8xH0g:nyzR9VTmdKTDWxOdYpQpe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702478164, "uuid": "61b734d8-6fd4-434b-86ae-5c08f6dd2efc", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702478164, "uuid": "8226f326-78fb-427e-8fda-04467b1ef93c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478164, "uuid": "e9d3da09-ef36-440e-bed9-2456f5ee4628", "value": "payment slip copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45459241-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480881, "uuid": "cafc7ff9-d914-4930-9207-7cc1ca570c44", "comment": "Malware payload", "value": "d0247b698b14deb493d8cc4e797ab7d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480881, "uuid": "ff4c24d1-163a-4f80-afdf-978f764e70d7", "comment": "Malware payload", "value": "cc2665ffd1bc1aecec30b5025eb73428f7921f0aba0b7b25a692f4918de6796e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480881, "uuid": "7c2012a8-7dad-4ac4-ab1e-5a3850c6aad1", "comment": "Malware payload", "value": "db826dae8d96260375dd41a2469d130ab5fa5708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480881, "uuid": "c4e35938-a935-468d-838c-4b9e22ee7c93", "comment": "Malware payload", "value": "bd6327ff4494ef9e2dea41d3339e50788bc30471c21f4d425ab78dd6dec9e6a0fa3b5a3f6ac10e340d608e43ce7643db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480881, "uuid": "766d91d2-f955-4311-a141-36e2b2b0355c", "value": "T118658D12F3D08C37D57615388C6B97985A29BE002E295E4B37E4BE4C5F3A7823D192DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480881, "uuid": "accccf82-2736-4e55-b2be-23975adb9e61", "value": "d361831fdbfe7016e0a4a5017defe96a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480881, "uuid": "25dfb988-3a6a-4dff-8ad7-63837067aba3", "value": "24576:oBadkIbL6qZvFL1FPo7BQU7KUYM/shsC0m5I3xXgaIvufnXxGXbL:oBADFM0SCt+Xg98Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480881, "uuid": "9b6352d8-f224-40fd-a8c1-ed46d3e726a6", "value": 1547776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480881, "uuid": "b3b2a85c-a751-42ec-ac65-371e8a67868c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480881, "uuid": "a7d4aaf9-9558-408e-92d8-4c0baf436108", "value": "SecuriteInfo.com.TScope.Trojan.Delf.31343.392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231e29f8-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480824, "uuid": "ee0ac80b-f37e-4387-a0e8-131bb714cb4b", "comment": "Malware payload", "value": "ff89080ba3bd917acf882ad9a3b7a577", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480824, "uuid": "60c3eef5-3eb2-4b2b-a874-81b672b70b0e", "comment": "Malware payload", "value": "cdcc2a9f9d862923f92ebd51772615ce0fbe3daaf54a82e5a817f053fa6f78b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480824, "uuid": "d3bf9a94-d175-443c-bcac-6e6c41ef1ae3", "comment": "Malware payload", "value": "6339d91b34883383e537105d9be942600112a1e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480824, "uuid": "bbaae291-371d-48f1-a2df-31815c48cd24", "comment": "Malware payload", "value": "63eb919895e0907cd2a9481e6359a532a6b8324fc6cb189a2119c91c13fb8a5f5cfeb87ff6365de6862181dbe34a7c45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480824, "uuid": "6b8ecf2a-b80e-4d0d-becb-32e62fd6dd9e", "value": "T13E469E379E1D5CC9E90174719C1A8FDA2954EC20B5086B9B76C1B969CCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480824, "uuid": "b49df073-2011-46d6-bd4d-d923cf305ac3", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480824, "uuid": "3157b697-3f31-4906-a2f4-936178cce21d", "value": "98304:l3lGiKYNJKJNIMFvAJg7rNhMqTdLO9X0G8uIqlDC75QYcB73F1+:lsiKiYJ2IAa7rfMI0X0G8uIqlDC75QYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480824, "uuid": "c2a71c84-f8a0-472c-bce8-223199677795", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480824, "uuid": "39feddff-b295-4fe5-b391-0ef09f63aacf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480824, "uuid": "f259cf39-fddf-44f0-923d-fe3a2358bc92", "value": "SecuriteInfo.com.Trojan.Crypt.18560.8920", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437bd555-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480878, "uuid": "97fa44b2-a3b2-4994-9d33-51e1bc86c3cf", "comment": "Malware payload", "value": "78bc046868de3cc95565657ae08a7c48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480878, "uuid": "553a3daa-14b7-42b4-baa9-8ab19f5ebd84", "comment": "Malware payload", "value": "ceea786e2c7f85b55634a5d0031530aa0921cfcf449230d78772a83af0bc6627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480878, "uuid": "96c1cc05-44eb-4ac8-b1ac-ecbff410bf0d", "comment": "Malware payload", "value": "790ac4f6008204bfb6fb460347263e42b1fa0c89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480878, "uuid": "649deede-c3ed-4c29-942d-114a35415fce", "comment": "Malware payload", "value": "b7d7a57a5555e79fd5e5b50a62c34a6476baf2f963b039360fff11fe43cb4c6598c6f98aa0aebf304d8faab63cb5e57a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480878, "uuid": "be6e87f6-f05e-447d-8e23-a55f1d85fb38", "value": "T1E1469E379E1D5CCDE90124719C5A8FDA2964AC20B5085B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480878, "uuid": "26ed0d06-fb4e-44d2-8313-2a6657952aa4", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480878, "uuid": "0e69994b-b60c-4450-8880-404aee4843a1", "value": "98304:CzownoETrCZ66DwKn9gfBNh4qTNCO4xdp+mgulfa2FMIRavYBJS:CJno8+ZZjnmfBf4Iyxdp+mgulfa2FMIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480878, "uuid": "cb324a89-bd95-4926-bbc1-3fba3db1e139", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480878, "uuid": "deed870d-5fd3-48a3-96ec-409fd8460faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480878, "uuid": "7422ef9d-1244-40d9-bf99-54ac0c4b157b", "value": "SecuriteInfo.com.Trojan.Crypt.16794.9247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46baa81b-99b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1702469716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469716, "uuid": "3dc1a07c-ca23-48f5-913e-9b1f1667efa8", "comment": "Malware payload (Arechclient2)", "value": "50125b759c9cbdd96dfd95d180918d7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469716, "uuid": "8cfe8fef-4d2c-434b-be4a-6d94d40f6537", "comment": "Malware payload (Arechclient2)", "value": "cf0c7d8987626b0d2f0115ca56a525762382a4e453365ea740caf733fd8a908e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469716, "uuid": "be12cb99-7c40-4314-9cfe-468b26ff8c93", "comment": "Malware payload (Arechclient2)", "value": "12a19f3229706d5656621c3405fa83a099cff22c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469716, "uuid": "4b7bc4e6-64dd-455e-981b-5bd3a689bc5d", "comment": "Malware payload (Arechclient2)", "value": "638d371b94fdfdf87aabfaa3892debcf99a801232d46d5d4966db27171d33a46fbad9aeffc6afdfeda49f7d6ffd6167a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469716, "uuid": "ba122aa2-1e89-43e1-be0e-68999ff179ce", "value": "T1AD95F222E3D14437D17726389DAB96A86C267E353DE4984D2EF4DE4C5F38B8138352A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469716, "uuid": "0abbdbfe-a473-47ae-817a-09d58475fc7b", "value": "e6bcb2b0731c25c455119c2dd77a5bdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469716, "uuid": "adfe1b48-1312-4e3d-81df-7c62d44038c6", "value": "24576:oh40uiWops0FBbRcpapMVQBdXobhxTSguVBY2wPXMmooObFKDZrrFoR0WrRuPCco:LApLnmVQBdYVxDuVZwPMmoon95+RuaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469716, "uuid": "cc183d33-044c-43f3-9acc-d2949be57c31", "value": 2011560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469716, "uuid": "afca5aa9-9a1e-4886-89ef-b20a2d10ad01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469716, "uuid": "4cd29556-7cc6-4f58-8c1b-b9290a9be827", "value": "50125b759c9cbdd96dfd95d180918d7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22aa6d1a-99a6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1702464932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464932, "uuid": "2ffd8de7-1261-408d-9378-82fcc5e0d496", "comment": "Malware payload (SnakeKeylogger)", "value": "08559ae92a7a9e58fe833f1969a38b6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464932, "uuid": "146951e4-0a52-462e-bf6f-0fc9884e776f", "comment": "Malware payload (SnakeKeylogger)", "value": "cfb314ef0e7a8c97928649de4afea84e896747595570aba76be034e1e05374d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464932, "uuid": "e5d53c47-4946-48c7-b28c-3133d4c7216f", "comment": "Malware payload (SnakeKeylogger)", "value": "05529fc85a5b432fa7d749f7573bc40787a44151", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464932, "uuid": "c9c4cb5b-38e0-4da7-a63a-f14cd742d4a4", "comment": "Malware payload (SnakeKeylogger)", "value": "255342c6c26f95cfcf14155066fbb8080bc02a85596371c99094dc7ff7761a7a915f7c51504b88e61c4ad2a81ac2ada1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464932, "uuid": "188bba97-45a2-482e-b86a-b3037caef859", "value": "T1FEC4D025AFD0823AFDF54A35F97316205F78EFDE2412D72F214879AD2933B1805A3629", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464932, "uuid": "f7e7391c-2fe5-4ad4-977b-e64071e309f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464932, "uuid": "e73e3fa2-95f2-45f9-a27e-ee36d0491909", "value": "12288:QeB/vyNsJqBRT5zAZacaZx+zW5Jgf2fwe/A:oNsJqBRT5mzW3gfq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464932, "uuid": "8ae254b4-75c0-4cee-9de2-5d31bac66084", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464932, "uuid": "79d0e6eb-6e88-4122-8865-edb6d6818c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464932, "uuid": "e08eaa52-7fd8-4483-a3e8-2b74f3a04072", "value": "cargo details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9829fab0-99f5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702499059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702499059, "uuid": "44597c51-ed44-48fe-b599-202148674de3", "comment": "Malware payload", "value": "5bf675183f7d1e7dad9cffb538329fcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702499059, "uuid": "a4cbd141-a5b9-4b42-96ff-13ea1a078409", "comment": "Malware payload", "value": "d05df2f1116d549b84cf6aa3441456f981c6cc77054672381e0118e19cd48c05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702499059, "uuid": "df8732b1-456b-45d0-ab36-14138d0326df", "comment": "Malware payload", "value": "fd556a381003c7191efccff11c3dff86641a1a02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702499059, "uuid": "06c77620-33b8-4947-a6f0-1a83418713dd", "comment": "Malware payload", "value": "98e9be4d81b9863aa2d7301d9724dbeadc3f82d8b23a37d8a7be3c8159cf8818d662716ec48ac75638d93b4e2f1f2dc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702499059, "uuid": "41f2c1ff-68c1-411e-9bf8-39d423aa7444", "value": "T130E423141AA48236C2FA09393EB3C1125770CA21A713EB4B4C87B9DF94777BB6783756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702499059, "uuid": "fb4f5860-bc31-4ca5-adf9-beccb36128a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702499059, "uuid": "2123b1ff-1f08-40eb-9c29-1d10b2dda03d", "value": "12288:vEfJI6Gy+YYUBYcyWnf7qNIRJVbvP0/IdURkSYzmF+T2PqYuEj3O:8oYnC72uNIjBvRWRIJiPqYx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702499059, "uuid": "b4217171-0f14-43ca-8920-af85b8e0455e", "value": 684544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702499059, "uuid": "e5c391a1-bff3-434b-9040-75c20738d80f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702499059, "uuid": "00e0b8b4-6112-403b-b028-4acaae909c51", "value": "r0105-12132023DEC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4879e322-99ed-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702495489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495489, "uuid": "82bebb81-4f6e-4df5-8a17-5ffc1f11d9e6", "comment": "Malware payload", "value": "ddeed658518e9cf2f8666fdbaf6c39ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495489, "uuid": "a73aeca1-384f-41e0-80d7-1cbefb4f3732", "comment": "Malware payload", "value": "d07f7f521c69dbdd6c452d0f64b4f4dd29ea849987a3cded19efbd5c3fc3415a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495489, "uuid": "379897d4-2a1e-4f98-a7dc-d78b24696615", "comment": "Malware payload", "value": "f9646cb74a37638526a0253701dcb58f7229c3fd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702495489, "uuid": "b941dc98-4a2f-41bb-96eb-541ac1404d95", "comment": "Malware payload", "value": "92a5a7fc969d8d9a0d9296c98cb6d510b1eb75048aa93f9ac4eea3c25881b4d3274a3490e5f21db9be76cec772da58da", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495489, "uuid": "b01fc7ff-419d-44a7-98af-1ab1b2da6e3e", "value": "T132432913B9C280FCC49AC134476ABA3E9D72B1ED027DF2A67BD4E6232D99E214D4DC54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495489, "uuid": "d734d702-adc6-4a62-ba45-67bb923fd318", "value": "1536:9c+m1h3a25i5IoSdQ3UT9I2YdhDF9WxOB8vPfYYiho4tw:9vEEQDoSd2UT9I20FAnvPHihoqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702495489, "uuid": "d47ca387-701b-4998-b203-6158e9280e19", "value": 59328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702495489, "uuid": "fb65a709-2718-46e0-8751-163b133240bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702495489, "uuid": "cec80726-31d1-4eb4-9ed7-f4151754db82", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e32f0a-99c6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loda)", "timestamp": 1702479008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479008, "uuid": "a5a24628-7b3b-4116-a33d-10163b0b6176", "comment": "Malware payload (Loda)", "value": "67d527174ef6711243ed32dd642ff82c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479008, "uuid": "8deba013-71d2-4aa7-837a-5085c8e49f3b", "comment": "Malware payload (Loda)", "value": "d0c0a3ed416f60d8f6e420c014334b6d971e628ae39ada7b4778a4e1d13ab32b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479008, "uuid": "7fcd8508-a439-420c-9771-ace1cb783f5e", "comment": "Malware payload (Loda)", "value": "2b36940b524daf764b4ec7284faf7ca1e503335a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479008, "uuid": "ca1929ee-59cb-44f9-af16-cf113a7ac540", "comment": "Malware payload (Loda)", "value": "97b081e32e15043204cab8c3ca36f74e5902c52c3e9fb5f271988f76412381f8bfce1f33e0a8bfb09ab33b8cf48b5b62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479008, "uuid": "554aeb11-8c58-4d52-9c8b-dc9bfa5ad90d", "value": "T1C1652366BDC022DCF8A9CD79B5847234DDAE9CB8DD8CFA79EC8078481F78DA88154C51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479008, "uuid": "6c3de7de-6cca-46aa-9ec9-4cc34c8df142", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479008, "uuid": "8fd8bfc2-deba-4217-8374-ce886732284c", "value": "24576:5gejYfw7hXOl6p5m2AaZUCyLxu01/6ehS/LgQQCLyabZv5Qw6e1RVKczNTtp2:5gesfI+l6p5KaZUrLUqVS/LgQBFbUQ3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702479008, "uuid": "d78009a1-a132-417d-b304-f1056a1e3dd9", "value": 1527296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702479008, "uuid": "a319f2d1-cf52-4952-b58e-b16c3397db3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479008, "uuid": "f70cdb5d-eb02-46bf-a658-1982cc8557ec", "value": "67D527174EF6711243ED32DD642FF82C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6392d473-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702480932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480932, "uuid": "faa79357-d1e3-4bf6-95b7-ca51fa038e0e", "comment": "Malware payload (AgentTesla)", "value": "432749a37b0d57f2681dff49b910f93a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480932, "uuid": "0d7ace1f-29e1-46df-ad26-b6e1b569541f", "comment": "Malware payload (AgentTesla)", "value": "d1637b302478288a64dd847d79fe797e7994cc2fe73e02f92849a8830d808efe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480932, "uuid": "121379e7-6e2b-40dc-9a57-813f486e7c3c", "comment": "Malware payload (AgentTesla)", "value": "7ab52bb8a06d606d3edfd536d6dc488c7bc2e669", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480932, "uuid": "9dd1bfd5-4b01-4f77-80ff-19643e78a011", "comment": "Malware payload (AgentTesla)", "value": "d1b0a30d113c11a1455d572cbe53701c7c955ebca4a850ae013dc2160fe03fb9b5304ff5ed6df4202617a30d94cd052e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480932, "uuid": "a044baf9-3de4-4abd-8cef-d3d3ce2cd6d9", "value": "T18A25CF053348CF20C15F65B6C8A7C2F84357AE11CD45DBDB76C9FE1A3AB32AA6952483", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480932, "uuid": "5963a5f4-9969-4810-9b87-957616bed28e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480932, "uuid": "97f9c5f1-ac6e-46de-920f-77970f4d6fc4", "value": "12288:ECeBNhUiSrq2a8qmrQiR1JE28EZOwEshCxzyvgA5fhX:LSk3a8eiR1xZbEpW4E9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480932, "uuid": "d9b51eb1-f3ca-4595-b4ac-859ee3ef1ead", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480932, "uuid": "9123492a-c2c3-4108-bf84-39dc11118dde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480932, "uuid": "542abca5-1f3b-40f2-9637-bb3d6c59bb89", "value": "Payment Slip (SWIFT)\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffd9f69-99aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702466833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466833, "uuid": "95c9cbe4-9841-41d6-8bae-a0179249db28", "comment": "Malware payload (RemcosRAT)", "value": "be3ae4e0fb6eaaabce5f55ea744e42b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466833, "uuid": "f5945424-5ec5-41f3-8378-b0c2daa9d56d", "comment": "Malware payload (RemcosRAT)", "value": "d18b801304d7360b0e2653ada5e71b50360d01f9b6a79002257b122f48bce1d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466833, "uuid": "22d4b163-5dc2-48c2-94ac-293e4bbb282f", "comment": "Malware payload (RemcosRAT)", "value": "789cfd4656fd675c23dbfbe5fb98897e0bb6d513", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466833, "uuid": "602fb695-e816-45c1-a13c-cae9fca19ee2", "comment": "Malware payload (RemcosRAT)", "value": "6843eb768b67e81c1f8b9b6a59e79ebeb76119a1b2031699b42d15105fde365a91bb37f4b73b6195d20fced6f5254f28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466833, "uuid": "98c258cf-1d1b-4d90-950b-5798ca3b2a9f", "value": "T14EA4E012A3E1A431F62306719E69C7B42A2EF5710F6627DF27949B3F0D741E2DA72312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466833, "uuid": "d3b57b74-8767-4ce9-a11c-7c9a58614ed1", "value": "8ec4136096a86bb9426658d99220fe79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466833, "uuid": "b35ea975-797b-4b73-b7ca-46dfe3d80eb9", "value": "12288:YYBJd1T0KBiJMYhZaJbyYJ1DSNLClNRSuiQX:YYBJ30caMYhZaJTSNLClNPiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702466833, "uuid": "1154198f-e61a-4d83-b36d-d726e4da2bd3", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702466833, "uuid": "b651a23e-4c8e-4903-83c9-ed00cd3c4155", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466833, "uuid": "48209179-5646-4563-acb7-faac4e3612d1", "value": "S\u0130PAR\u0130S450021722274015255.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291c412a-99e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702490712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702490712, "uuid": "f84300a4-6844-4b4c-a91c-32ca5815a35d", "comment": "Malware payload (RedLineStealer)", "value": "0815854d522ad582286fc7469c413927", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702490712, "uuid": "55fdaf05-bfbf-4393-85f3-a0376586b8e8", "comment": "Malware payload (RedLineStealer)", "value": "d212751c76ae2616c37725ffae3e039045823694a1160960081c2129a8935e9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702490712, "uuid": "b08389bb-74e8-422b-bdbc-94b90983f800", "comment": "Malware payload (RedLineStealer)", "value": "b42611b343dfe9581e5bdd4836b30123f97fda68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702490712, "uuid": "286fbba3-bb2b-4246-9b0d-4fbefbc4399d", "comment": "Malware payload (RedLineStealer)", "value": "26a37047ada88298df68f92d8ed09fa3a8cdeed1426194d6d0b2c1d6333950a9a724364eedbe699972aa9e28b618d169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702490712, "uuid": "fbcafae3-2084-46db-a377-6830c36036e9", "value": "T171458D3674C49960EED1317397BFB22E819ED4B4C7A005CB47D806DAD7A03E5BB32A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702490712, "uuid": "688f140b-0950-4fa9-bc3e-7bf69f463b58", "value": "a0251b407d7de47aa199ba86794390c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702490712, "uuid": "f46a447e-7e31-4fdc-876c-866af20b7b24", "value": "12288:gfSAp7Cz7JSajxJ2J4cqtJRYLqVktbk2out9oGXIB3rFSbW94v:YN7Cz7JSajxJ2IfRY2udWBEK94v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702490712, "uuid": "57dd844e-a273-43e5-b5fb-3cc5abc989c8", "value": 1170720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702490712, "uuid": "09e92d80-91a9-4788-a7cf-3a74b9010833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702490712, "uuid": "8bb8c7cb-c264-48bd-8bcc-c8ad62c0a4a7", "value": "0815854d522ad582286fc7469c413927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0221ce1-99b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702469920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469920, "uuid": "2c824244-968b-44d8-a2e6-6288decb319f", "comment": "Malware payload", "value": "d75745c1e3beffb926a02c54ca23987a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469920, "uuid": "e57b737d-e4bb-43b6-8228-6e9db58e9003", "comment": "Malware payload", "value": "d2dcf74e80d9318b6288810492a3ab5f46dab484ab5b5010444ee9f4e332d98f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469920, "uuid": "c8313168-8500-475c-9578-6621ea2ae2f3", "comment": "Malware payload", "value": "76380fd4602d07234eda5304fa3990f0bdde9201", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469920, "uuid": "8c5ebf7d-28ff-432d-b431-7f6f75f45739", "comment": "Malware payload", "value": "ec195aa4946873cf9d69cedc889dfe125d80bb66cd0503c4bcdc6f161c5917bdc43ec2d9b7979a28f4503b255889ce67", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469920, "uuid": "55164876-76e9-49c0-9182-142cd0f28cc9", "value": "T1C413E50172A5C61BD1A94A354ED6DBFB3336FC61EE16830B3199770E2C7A620DF12729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469920, "uuid": "467c2413-9b64-45ec-a92b-e8c0506eb30c", "value": "384:mrnQC44EURg6vLCr8IChLFgELymDUAe8X0jYtm0MnAJ6u6bBC5pX0jFm4pMqCzO:LsLqLChLFgyynuaAwu6wbqptEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469920, "uuid": "ddaf0118-92fb-46e3-84a8-2f13c48c4691", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469920, "uuid": "8e7701fa-2f30-4ca2-8857-c3b3a6a5d663", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469920, "uuid": "43e67997-933a-4683-985a-71f22324383f", "value": "120205 Letter-response A3 2-2.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53fa7b7-99b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702470841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470841, "uuid": "adc92d06-63f2-4145-b71a-b0143d76eceb", "comment": "Malware payload (RemcosRAT)", "value": "2e70c9f3f7f86b7f235b30615bdefd72", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470841, "uuid": "df7721ff-ae20-4285-aa1e-2a6076d81250", "comment": "Malware payload (RemcosRAT)", "value": "d3b3b9636154af35f2311d853b77823f06211a372c44edd939630136ec3ddd8a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470841, "uuid": "bd2f8351-6243-4886-b117-b27e9d7766a8", "comment": "Malware payload (RemcosRAT)", "value": "cb4e546ad80fdc4864fc913bd028bed00559ce7e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470841, "uuid": "ce3e7a8d-8d29-4b36-b3e2-fd5b4a14b1b2", "comment": "Malware payload (RemcosRAT)", "value": "bfdc7800973a4bdcd2686c9cf7588dd386b0e46701c034c1dad07d44e60d98d54b05c10042bdce2b7b3bf3ba56cbf055", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470841, "uuid": "0c181e99-f6b8-42ec-b599-687af9a8c89a", "value": "T1C89533644631C895A61F9C3ADDAC2771C848636F1DF6CD1E3B938F20A22748662DD7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470841, "uuid": "305d5dc4-22a2-408a-99e0-2ed962af74fb", "value": "49152:A/P3VMsE3v6g2JvILPD3vL0eVMsE3v6g2JvILPD3vL0J:A/t5M1vL0M5M1vL0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470841, "uuid": "a0b9bd7a-9936-48c4-8b0d-9e2fe8b20d15", "value": 1899648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470841, "uuid": "066a3b14-9ccb-47f3-a268-e461faf136a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470841, "uuid": "c50bb582-223d-44c1-9d20-39c6cc60b966", "value": "TQW0987654567800U.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2b3844-99aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702466669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466669, "uuid": "e7f284dd-7115-480e-b7d9-54b283fc0eeb", "comment": "Malware payload (RemcosRAT)", "value": "3035a165d6e6114f6a736bf7752721cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466669, "uuid": "bb986323-735c-4caa-b3fc-7bf7714b6c48", "comment": "Malware payload (RemcosRAT)", "value": "d40601f00896725d783baf1670fb0e8b855149b9d4871d22bb4ddfd88b07a68f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466669, "uuid": "2ea82330-f0ac-4b26-a241-40306662ca07", "comment": "Malware payload (RemcosRAT)", "value": "309753f7d1958224877b55a4aa57a8f32de0a0ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466669, "uuid": "67995c6a-d1e4-4999-a999-69ec64d38eb0", "comment": "Malware payload (RemcosRAT)", "value": "db821a078de6c1cd569c9d1a6b6e10b6af05d97f69bfc79ee5a672c38d3d9571df323555165dd08c1295164019aa541b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466669, "uuid": "8e56a5e7-1c91-4e5d-899a-cb3622e27498", "value": "T151152308365A9A0FEA7D47F6A8501A3023B17F15E787E9CC6DD020AFEA71F210B51977", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466669, "uuid": "90b1b4cf-2856-44a6-8eaa-f40a8673fe70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466669, "uuid": "84b0a1fa-2426-4085-aff8-f58c578dd10d", "value": "24576:ypAE51cqBZRGhcDdiqoCD2dCzZqDNTSwWP5EJCuXtZi:ymU1LTRGhcsuIC1WNTnorudZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702466669, "uuid": "a5a5c796-5e7d-4d45-9d55-b521c7c376b4", "value": 943104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702466669, "uuid": "1adbfc8a-289e-45dc-8911-d64202ba7477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466669, "uuid": "101fc91f-7d63-4c59-b678-7d7281ab1481", "value": "Garanti Bankas\u0131 - \u00d6deme makbuzu 20231212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ff2e4b-995c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1702433418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702433418, "uuid": "ac3f46ec-1a7a-4726-8118-5d95e411f1db", "comment": "Malware payload (DCRat)", "value": "281448f5391ba37b5cd9510e03fc0a5c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702433418, "uuid": "2a4fc595-b9b3-4b2c-9ac8-91b1f3cdbb1b", "comment": "Malware payload (DCRat)", "value": "d4836bff71f7f89bac76de2a7ff57ce8a2ee89a6ec92f8e786eae74ca259ce36", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702433418, "uuid": "79aed6a1-64d3-4557-a508-909634c1f703", "comment": "Malware payload (DCRat)", "value": "42080f5f59c03be48f8308b41f82d9167a8f4979", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702433418, "uuid": "56a69674-6ddd-47d8-89ae-edab851570f8", "comment": "Malware payload (DCRat)", "value": "be59800072fb7815018f509e7a5ee51c33a01d0a61a9793ab03e7ab9cc52ed1b3acbbb09b1d7d741c1405065eccc8389", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702433418, "uuid": "adc17327-71aa-441f-ad08-c809ad88606a", "value": "T1C4A5AE01BE448A11F0191633C3FF49484BB4AC516BA6E71B7EB937AD5412393BE0DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702433418, "uuid": "705cdb5d-cb8d-4557-8a3f-54599d383076", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702433418, "uuid": "1ab9a1a0-b62e-4974-90cd-cf397ee41b52", "value": "49152:UbA30SohSSqzoyEEvDD3YsgQRM0vcw+dl:Ub9hS5ozEvDDQQRMCGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702433418, "uuid": "939a37a2-e7e0-4018-afbd-6b8dc570a876", "value": 2189534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702433418, "uuid": "80fa32ad-ff50-4e16-9c7d-ce6e91964315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702433418, "uuid": "2725870e-2472-4fd1-a930-173a2094a9b0", "value": "281448f5391ba37b5cd9510e03fc0a5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed614cc6-99b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1702470855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470855, "uuid": "25b08a40-5ebd-4c59-9834-c509a32191d8", "comment": "Malware payload (RemcosRAT)", "value": "d04502b7c4ff2f549189318b363705ed", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470855, "uuid": "54efd0e7-412b-454c-be62-54c634383eb4", "comment": "Malware payload (RemcosRAT)", "value": "d5da36a2627eebc1118e8b433f42924d413e5d03ee0c1ea4ccb03aac1f2ef5c7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470855, "uuid": "a97f1a47-995c-4e6d-b9a4-c17ad7d9d525", "comment": "Malware payload (RemcosRAT)", "value": "f3cd0322f5e09508cb5bbceea01a382b2478e1c4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470855, "uuid": "29d6bcb8-8405-45dc-95dc-ea55fc08aec3", "comment": "Malware payload (RemcosRAT)", "value": "ad63203ecc5f28f23a6f9578cf3556ae7b8e395db21b96c5d85cd794edae73b183e76d6c2deea1a2fad7527c08baa36c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470855, "uuid": "c58093c9-e3b5-47f3-935a-68deabe139d8", "value": "T147F423AF564FCDE1C3E260F18C01D09BCDA7D889E4511F2D312AB80CEDB5E65B0969DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470855, "uuid": "b65f6488-d7e0-4383-8ca9-343255410881", "value": "12288:W276AJLnNCm/4xFd8vHYO2lrzeDJaLl6k6C4zaBA4Yv8vHYO2lrzeDJaLl6k6C4F:W279JLnWxfsYO2lrkaR6kr4zsAVsYO2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470855, "uuid": "0ea8c878-0532-493f-bba8-54a94689c338", "value": 772643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470855, "uuid": "587d77e5-6051-4a99-b365-62bb33b7ea4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470855, "uuid": "b2ab456d-0154-4ef4-bbbf-bb33648d078f", "value": "INVO98655678900OO.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7087359d-99ab-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1702467210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467210, "uuid": "0cc7d746-61b7-4547-8f2d-a504ad46d5ef", "comment": "Malware payload (DBatLoader)", "value": "efd90dc18ab8b704acc723db684cc55e", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467210, "uuid": "5dbdf815-0803-4c44-a4a0-84103123e8c3", "comment": "Malware payload (DBatLoader)", "value": "d715183696f33d61192d9c7815b099ccea321a0a734bbec82c2963dbc1b37b42", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467210, "uuid": "66b931fb-636e-45d2-ac21-d9bafb5158a6", "comment": "Malware payload (DBatLoader)", "value": "f8bf895f8f2ab82ccf8b2c0ed23f3fe8845d6fb0", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467210, "uuid": "bea25e5c-4dcc-4b36-a084-e7981884c1fa", "comment": "Malware payload (DBatLoader)", "value": "b402d09d1db4f6c809fdc9829b61a9490d73983e6693df14508d0498ea836485a3d971c31d10325436c197f7a3a239ae", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467210, "uuid": "a5ee2643-7092-450a-8b91-4eb48bc20917", "value": "T19375C008FA8A5B7EC1633A349872C255CC3ABD932D18EC1B9BF55F999C71082251BDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467210, "uuid": "1a88071c-fc23-4e08-92d5-31bef48ccc82", "value": "c821ef948e147b24b857092227f5d15b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467210, "uuid": "827b2297-1ba5-4287-87ff-36cbc88953f6", "value": "24576:cpbbeAR9HJiAO7eZ3bXfkGSZr/QTopkgxKJYiTPwQaN:cpyAueZ3bnSZr/QTukKiTPXaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702467210, "uuid": "347ea15c-36ac-4de7-8e37-1936c10405df", "value": 1559040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702467210, "uuid": "0ff8fb6b-7f94-4acb-a54b-584bfecdd3e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467210, "uuid": "ba301432-6cc1-4699-a521-7d98dcf08153", "value": "PO-0927902-27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41365d02-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480874, "uuid": "476792cc-4fae-4a95-ab6a-2c2e3df5b5a7", "comment": "Malware payload", "value": "6cf8ae9e844cd9d4ab75f79feedae700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480874, "uuid": "1a8237d9-86af-4dae-8d7d-57c494b9cced", "comment": "Malware payload", "value": "d716e40605d2cc946be7194417fdba41251f45a38224cb55ac8cd4c18bb141bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480874, "uuid": "2c0460f7-3f17-4939-bb24-a31f7a4b8332", "comment": "Malware payload", "value": "5f986adece4f392fe3492645ac895db416b042ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480874, "uuid": "fe4e28a6-6a16-4f5b-8b28-125ae879bf67", "comment": "Malware payload", "value": "0994ace7670873f4c7bb176999747ef8640bb3871ef54e8a3257f5305744b787f3e6c566421e45c30558d2152100593c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480874, "uuid": "0c826772-c636-4c78-be55-4e71a88b5100", "value": "T11D357C0732915033E6B279364A1B42ADC826FE261D78345A6BF99C483D35643FA76FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480874, "uuid": "0baa7fb7-3068-4e08-a67b-89cf86c3c9c5", "value": "12288:PGB+OVpf2HcuPquvZ6qCUlmF/F0H4j5/AqyXkhgYtdaNPpMFZm9wKY8rT3m/aw35:PKvzcrnyaLO+3Yb/wQeAh/7R/lgui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480874, "uuid": "9d5b4a97-b65a-443c-806a-086657a7ddff", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480874, "uuid": "845cf76c-fab1-4f0f-85d5-afc1b97edd98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480874, "uuid": "d85e451a-e03b-407e-bb09-e7d7f20f6a30", "value": "SecuriteInfo.com.Win32.TrojanX-gen.3697.17905", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ecfe772-99ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702503231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702503231, "uuid": "175df139-298c-44ea-944d-1933ce1d8bec", "comment": "Malware payload", "value": "0d1cd6a6b7279c8c30554718858545a4", "object_relation": "md5", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vcperf", "colour": "#E43CE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702503231, "uuid": "9908d00f-e86c-4f40-90c7-1a2d3875d2c8", "comment": "Malware payload", "value": "d724728344fcf3812a0664a80270f7b4980b82342449a8c5a2fa510e10600443", "object_relation": "sha256", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vcperf", "colour": "#E43CE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702503231, "uuid": "473618a5-b3b3-4846-82f8-60e77724570e", "comment": "Malware payload", "value": "67c4cb66cae506aecfb7f9fb819305f11d036fa3", "object_relation": "sha1", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vcperf", "colour": "#E43CE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702503231, "uuid": "a606ef6e-c965-48c7-a7dc-0f448fbe1247", "comment": "Malware payload", "value": "d5935ba1bc108ec37572f891c02b4086e1df374458cb26d0b9de99a5be33b7681c57996c2ef4bc47c6b41997d5b6d4eb", "object_relation": "sha3-384", "Tag": [ { "name": "APT29", "colour": "#A35B8D", "exportable": true, "hide_tag": false }, { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vcperf", "colour": "#E43CE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702503231, "uuid": "54a680be-4de8-4746-ad05-35ae21df8da7", "value": "T182A5D023779908F5E4AB937899974712E3B2BC120361E3DB13A592262F277D0AF37711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702503231, "uuid": "3fa7cbe2-5539-43b7-9ea1-8fceee1ddc88", "value": "1127d60ddf543650fe68a12c618a80c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702503231, "uuid": "a8d3e039-8023-4035-9963-1bcceab18968", "value": "49152:EiURbeuHZOiNJSvwMHhcaKSTyLHCm3turm9VOtTgqY7bEkyQ14tKBv:7Ucu0g06VOtTibr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702503231, "uuid": "83de6423-998e-4737-9c03-22d09d7d3e05", "value": 2235392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702503231, "uuid": "29383999-e2bf-4301-8f7f-5ff5aa5b5b70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702503231, "uuid": "43cd0ec4-bacb-49b4-bdad-573e8b7acff6", "value": "vcperf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df159774-996b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702439907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702439907, "uuid": "de277f84-2af2-4546-8002-583e709f4b74", "comment": "Malware payload", "value": "63554173a47e7910e0dc39e9fdf0678e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nigalulli", "colour": "#BE9758", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702439907, "uuid": "24e0de2d-e7d3-4c6b-83c2-57f3b733e81e", "comment": "Malware payload", "value": "d86def64033ba62bd4d1ce411876ba2caf2aab65ff129309c5d1f04a6e51b5f1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nigalulli", "colour": "#BE9758", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702439907, "uuid": "2300272d-4bae-4b16-9c6d-7cb8d4f815a2", "comment": "Malware payload", "value": "d6f2465c715f4b5c9ab7c3c8e4bf224cefd0c9e3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nigalulli", "colour": "#BE9758", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702439907, "uuid": "7e7892ed-559b-4df9-80b4-efcf71a6e293", "comment": "Malware payload", "value": "8949cc1819e64c9b62daabda064753415891afa86d768e98f6a2bec469b175218b359d50b7e7655b526fdca4331dd2dc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "nigalulli", "colour": "#BE9758", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702439907, "uuid": "874351c3-2024-4adf-a2a9-bb74e86a6303", "value": "T16F71DD0697E88667F0A64B30AEB347572BB0F8909B728B6A19C443197DA12641E71FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702439907, "uuid": "4d8dd269-b361-49bc-b4c1-4fd96f8b0cfa", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702439907, "uuid": "9d185f38-c915-400d-b977-3eb09c71e29c", "value": "48:6N/zxHUQLXK1tgu0OVgJY7Dib1ulua3qq:WVx8VxwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702439907, "uuid": "3d0668a2-0f22-4e3c-83cf-c3986581479e", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702439907, "uuid": "331c27e5-32ec-455e-97ba-7f5665d82a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702439907, "uuid": "f66fd258-30a2-4f8d-a7b5-f3afe6c27a33", "value": "jrmvqbdn.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ad9464-9961-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702435535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435535, "uuid": "8c57c99f-f66a-4a72-9ba2-f2ffe495f5c0", "comment": "Malware payload (Mirai)", "value": "8c7e774f1f5fee1f445dbe1581511855", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435535, "uuid": "01d3b262-c417-47eb-b726-2f876eb080f2", "comment": "Malware payload (Mirai)", "value": "da7a31dcb360f47a64213c7270fab2c765120af222ff8b990b5a78941a7efc7b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435535, "uuid": "ca999f02-f3db-4df5-9ef9-2d89044d4e06", "comment": "Malware payload (Mirai)", "value": "bb56201b6315806041373d47f38839d78fe933f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435535, "uuid": "1efb75ce-634d-4198-b526-990ee4891660", "comment": "Malware payload (Mirai)", "value": "086745d395d59df714918935cf4cf68f88258c8f9e35f7cc397b9cc5ba7d7881e259d6cdbbb6b173488abe90d770c415", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435535, "uuid": "339e07aa-142d-4dde-8d3c-683ac81bb6a1", "value": "T1F5331881BC919A12C9C423B7FA2E01CD372563A9E2DF3207DE216F1177CA92F0E67556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435535, "uuid": "cada9d02-26dd-45bf-a0d4-e094a762e33e", "value": "768:aYQhosc6moXSWmfZ9hcQEhpnwecESfq7ZAoONn0VlyTBNOS9JVm+vMU:qhosc6QWCZ9hcQGBXSS7Za03yV91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702435535, "uuid": "5fa4a703-9e98-436a-96b8-21d821578529", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702435535, "uuid": "cba6f9c4-bab3-4c37-b894-d2b4b8a0738e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435535, "uuid": "33c8b606-7111-495a-aa7f-e29a901e38a8", "value": "8c7e774f1f5fee1f445dbe1581511855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2448b0be-998b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702453338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702453338, "uuid": "ca6a2ba7-5520-4d0a-8a39-754d100a92e8", "comment": "Malware payload (AgentTesla)", "value": "a01100cacc11e18cf9a83769482dae09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702453338, "uuid": "1ad1dcec-63bd-4b8c-9b10-40ed99383b1b", "comment": "Malware payload (AgentTesla)", "value": "db43a9c81339b049a202446b1839d6bc2561f1e337de20848f3b3966bb121313", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702453338, "uuid": "e41892a3-592e-4090-8dca-e6444a281cdb", "comment": "Malware payload (AgentTesla)", "value": "16066e56906c272f25f37bc8d2da6b424a642e9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702453338, "uuid": "95894023-8b0a-4ce4-a2f0-f1a7f67e2f92", "comment": "Malware payload (AgentTesla)", "value": "9857d04eccdbdc743cadf17d8fb23565637260172f00247c456c97083add9b9a4af0da7cd04c46e6f2a93a0556acafe4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702453338, "uuid": "9174b941-5d8f-40dc-b28b-5b9bb843d352", "value": "T11A05A23D19F92227F175C7A6DFE0C527B260A5EBB052AD24D8D243960307A4B79C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702453338, "uuid": "267c275a-e852-48cb-adbb-02621e350175", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702453338, "uuid": "3827eccd-cac3-46e4-ba2b-9c50b05dab6b", "value": "12288:wYjtg+5INetZdF0YjYzY+3K7yOMN6eaNdhdfx0TDvnko:wUtg+5IN6ZMYjMzKheedwD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702453338, "uuid": "4ede9541-23c2-48aa-8853-a5980f84c4be", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702453338, "uuid": "ec97d3be-255c-4013-b11e-a976bb3b71cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702453338, "uuid": "bbdc5fdb-5f4e-4b73-aa91-90bdd5a960a0", "value": "Request for price list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c0942d-996e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1702441184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441184, "uuid": "f4e5f0ce-81f5-4629-b36e-d0d2a47c10fc", "comment": "Malware payload (XWorm)", "value": "c806d2f8605f2c41ab7ebadc7849e524", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441184, "uuid": "f99b30b4-4a9a-432d-ba83-1eb78b48909e", "comment": "Malware payload (XWorm)", "value": "dbcb7e0540764d286b001b2a935a021019474c43ed9b209d8d527c40bfb62db1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441184, "uuid": "63ef01df-8781-40d7-8531-12c9cfcb37a3", "comment": "Malware payload (XWorm)", "value": "d6602dcb53d426b4f1281e405d26bcd3708f30d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441184, "uuid": "1342ffbe-6b5a-4155-9278-9b636fcff014", "comment": "Malware payload (XWorm)", "value": "b71cef590811e50130fa525a64413888266027ab7d07392347f49b219f93b36f34706b937f30957bc43ce4f620363a8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441184, "uuid": "e622e9c1-4f9e-4217-a037-e62cf2f51a98", "value": "T1A4435FC0F7F44EA6F0FBEF78448A157801AFB54EFA12864658A415AE4993FCB2D05DC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441184, "uuid": "dbf699e5-20fa-432d-9988-d3444d44c858", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441184, "uuid": "a8b49bd6-85b6-49f6-b855-0ac4b5c0cc99", "value": "1536:RoUc0YqHSgVrtHNxa4m5Fgo5d9Z635LhlEDSQX:RpN8/5Fgo5d9Z635LhlEDSQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702441184, "uuid": "18aa5055-6220-49bd-b472-8e9c6f3a5d42", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702441184, "uuid": "f8b06137-c8eb-48fb-bf06-5e315eef992d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441184, "uuid": "5e12ebd0-f1ec-4cda-8719-c73d03d7f4c0", "value": "SecuriteInfo.com.Win32.BackdoorX-gen.19351.2821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d19b10a-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480894, "uuid": "21b76547-f12a-4aed-9610-8e8137808e7b", "comment": "Malware payload", "value": "a890275b3cdb8f50cae9311bd56972d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480894, "uuid": "dde9b351-5225-4b04-a0c0-b7772d87f5d3", "comment": "Malware payload", "value": "dc237c9b4435e4dea5a96801f3099b81e66be5eb6e8efe4457a0a59bdc8aa757", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480894, "uuid": "02daf3d6-a24e-4028-a605-2e2b95e541d8", "comment": "Malware payload", "value": "af1bf1cad9ece1f7f9348d23484b9aba88c77696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480894, "uuid": "b3b500ec-d901-4035-a7ca-a40082eecf27", "comment": "Malware payload", "value": "d6432b6784702b1fa858c4d75a7efa981a5dfc4054f04db16c3a552d18be670a28f5335382c49026b8fe59e770c886ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480894, "uuid": "0917e0b4-3161-4e4f-9a38-abd23ac1017b", "value": "T106D49F22F2904437C1771A349D1B93A99C39BF102E28A8977BF47E4C5F3A7513E2919B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480894, "uuid": "e11ad383-a055-4d7d-8841-b35c24dbf5ae", "value": "476e02453ecefdf9f87a8ec75129108d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480894, "uuid": "fff78d3b-00a7-4479-b5b3-30e4c00bd0f9", "value": "12288:4u3D6zC3iSeE/W6BDDyOgo5smK2Pj/DtABuvKsv+UlAR2j9YtCt4nXH3nXH3nXHF:1zq+eE/fBy3hvKjpAQyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480894, "uuid": "3ea5576c-dcbc-4493-8265-af2c19aa4d85", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480894, "uuid": "4da6c5c9-0408-4946-b61c-d38400b566ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480894, "uuid": "21b42cbe-4648-4329-8bba-c524b0fe6bca", "value": "SecuriteInfo.com.Trojan-Dropper.Delf.20309.1628", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d0a44c-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkCloud)", "timestamp": 1702471297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471297, "uuid": "9b2c5dcd-e420-4fb9-a1d6-e7fc60c73286", "comment": "Malware payload (DarkCloud)", "value": "978375d469322aba3d49f5e2d0e22046", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471297, "uuid": "bddb45a9-b019-4570-8e4e-380cd602cd5e", "comment": "Malware payload (DarkCloud)", "value": "ddd8bcbad0bb4ae8b8f449375feaa647a6fec7e791b686a266a88265a8752faf", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471297, "uuid": "52218065-e50a-4a58-abd8-36a1da236def", "comment": "Malware payload (DarkCloud)", "value": "8ccb934e6b445ae593f84dd65dfd076d2b428913", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471297, "uuid": "04e8e31f-eb2f-439c-b1a1-af353fcbe982", "comment": "Malware payload (DarkCloud)", "value": "f49460a44603ed9f0c6bb808f17d9bc7ac52374d28729ba029d71624fd3b63b8e0cca369dc3b96402acf466a26ecacd6", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471297, "uuid": "0266d744-3940-4cd8-bc8d-0b5ac50eecff", "value": "T194B423169E4B5480CEAAA2F9C17BAF771F216C23153A8AC61584331B1D36797603FE0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471297, "uuid": "cb71488d-f667-4c33-acbe-3480a9443edf", "value": "6144:urXPdNSInoetXPmJvJMwiPexjeuOkcG6JK/rFDe7c27tedz3ZotQh+prBhy7x+2V:upND5uJBMARBOu6J0EtedStuOPBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471297, "uuid": "7d828402-f672-497a-b079-171cbf20d461", "value": 500624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471297, "uuid": "0e303411-341c-42b8-91de-cbdb91cf0e70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471297, "uuid": "3af36e44-1cb8-40e2-8549-aeb6592210f4", "value": "OSTATNIE ZAM\u00d3WIENIE 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6956c0b-9961-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1702435571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435571, "uuid": "3e32d9bb-ef99-4781-86dd-deef0dbb3113", "comment": "Malware payload (Mirai)", "value": "460f37a6f1f38f4b584ce042dc83c96b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435571, "uuid": "9b77685b-713b-42b6-9e28-e3f41f707e97", "comment": "Malware payload (Mirai)", "value": "de940aa8733d9e103b116a2888bf3dd1a7b8efcd913eb7dc0aa07f23d5ed7bca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435571, "uuid": "e1569c2e-cbf7-46b8-a584-32c1f8c31762", "comment": "Malware payload (Mirai)", "value": "a7641ce88efd480c173dd04eedf84cb5b972b975", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702435571, "uuid": "6423457f-5040-4102-a8c6-0d1cdf932340", "comment": "Malware payload (Mirai)", "value": "6f78261739b60ab9db285eedc9732e6d2033dc57f1c5024230c39cabda505257ac59cc82b3f69a873c1de7840b5fa7ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435571, "uuid": "b1690008-652f-44d0-ac3d-665529afa478", "value": "T1FC63975D2E219FACFFA8863447B35E60924C33E626E1C945E15DEA011EB034E741FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435571, "uuid": "1ac3b4af-20c7-4ddb-8073-44be656f5c5f", "value": "1536:p8Rs3DOpSxUypP+vntvnCEvnNo8mINMJoZ9t0plDZRcMWZ:aK3DUSqE8BXt0pJZRcpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702435571, "uuid": "cf2390cf-0033-4fe2-b121-4aeaa2325979", "value": 67564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702435571, "uuid": "c7c5609d-0152-4d5d-a074-83addb1d4d14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702435571, "uuid": "acb2fab6-fb2a-422b-88c5-8250697ce3a0", "value": "460f37a6f1f38f4b584ce042dc83c96b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703bcee8-999d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1702461196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461196, "uuid": "148d68f6-b5d0-4336-9930-4cb3531f386e", "comment": "Malware payload (Gafgyt)", "value": "a09be45257caedde5cfdb0096603c0e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461196, "uuid": "05690e5a-5741-450d-9cd0-f368291c7e80", "comment": "Malware payload (Gafgyt)", "value": "ded53a88c07c6db6c4451e126f4612eca58059238c021761eda27b9bdec0f9ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461196, "uuid": "ec31166b-5c11-4912-9ddc-1fd652552a0e", "comment": "Malware payload (Gafgyt)", "value": "10a06082416d11fda27aeb29bda291952bd05886", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461196, "uuid": "c5a50a23-19b4-4f8f-9ef5-f66ea613211b", "comment": "Malware payload (Gafgyt)", "value": "029b27024003568debdfb8910f1149158f370396882cdfca580f3cb3e05a5aa305db26ca7594852932581b3bbe1957d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461196, "uuid": "09ad2540-acca-4d0e-921e-676d86e81642", "value": "T1B4833C02E743C6B3CC830BB2029BAE665931BDAA1E269F49F31D7DF45B128C47116F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461196, "uuid": "037a4ca7-770d-418c-95a2-6ca5e656c367", "value": "1536:W35b9Vc4N3J6lreu5r4hWj8LtWDloRmF+wVOz+sXcfW7k:Ab9Vc4JJ6liuq0Yh2oRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702461196, "uuid": "87692dd3-22e4-4777-8ce1-b27040f619b0", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702461196, "uuid": "f9222329-006e-496a-908b-889c242c4ef2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461196, "uuid": "81ad405f-64b1-4ae4-b279-c23bea5824a6", "value": "a09be45257caedde5cfdb0096603c0e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c48363-99b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Sliver)", "timestamp": 1702470861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470861, "uuid": "cc7109ad-c033-41fd-abd0-2475941afd0d", "comment": "Malware payload (Sliver)", "value": "dce640964d039358c93bc1d3f3ffd946", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470861, "uuid": "1cb975a7-7814-469a-a88f-3c7df9bbad37", "comment": "Malware payload (Sliver)", "value": "df7e7e6acbaab1b7d008117080c07520b0cf339be0b753691f9bd006bd9330e3", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470861, "uuid": "75e73d6e-53c4-49d8-9371-5cf061222b2b", "comment": "Malware payload (Sliver)", "value": "49a86c1d133fc5dbb0f4be412dd7a200b4d25df8", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470861, "uuid": "d3eff9a7-8b47-415f-a4c8-c620eae2ced3", "comment": "Malware payload (Sliver)", "value": "058da7e7083513c7705fbe8475e54217d6bc7530ffd29703eb087fdf6600feeccd5551c9f22d4b5fe434fcaf5509655d", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "sliver", "colour": "#F89DE2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470861, "uuid": "c4771ede-14ec-44f1-a464-096590742971", "value": "T17067333CB2C8D3F7F4A9257411D62A08C79D52BF9E6D418AC7A7B2F149A70E40F6249C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470861, "uuid": "239e47dd-55f1-4753-88d4-5268c02e2789", "value": "786432:hGJDXdpGkQCCP/PhdLxrnexJUsIK4t1gaBmCS:gXdQp/PhdLdnex2sgtaaBHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470861, "uuid": "93e876eb-b087-4070-8fbf-dc8f69c89b69", "value": 30946533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470861, "uuid": "a3e7eaa3-e215-48c5-8334-a4855296181f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470861, "uuid": "a9d88117-eab1-46fb-8782-8898db2efbe2", "value": "Skip Attachments (4).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f88844f-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480844, "uuid": "ebef1501-f73e-49e9-b1bd-99de999014b8", "comment": "Malware payload", "value": "7f3398e9936c55222febc28800e69365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480844, "uuid": "ad776982-d4eb-4a0b-904c-b134262f5cd7", "comment": "Malware payload", "value": "e00189ace020a3ea0e7658666e9827cf35cc711372a47415a4ae60f115097bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480844, "uuid": "2438469c-3434-4da4-a75d-5ac58a680232", "comment": "Malware payload", "value": "b5bc47c2f82832284f2afd77ef28b463ebd4a0b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480844, "uuid": "d8953230-c42d-43fb-b3db-1dc322e90c63", "comment": "Malware payload", "value": "8dfc4c70d08df82e1d2345053650012232c543d114f1fae3625f6ca0c8a9c1a4ae3155607c7894eb8bb1ccfb948fce97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480844, "uuid": "f993b76a-547d-46ec-9ef9-f3602323de7a", "value": "T150469D379E1D5CC9E90134719C1A8FDA29949C21B5086B9B76C1B96DCCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480844, "uuid": "9542a201-dad5-4ec2-8077-f441048fece4", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480844, "uuid": "9f63907e-ecc9-4e72-a243-6007db9ba74b", "value": "98304:2Fy9zHc49PyE6wB+LSgSHnh+qTGTOMlpxeeoiVLiiR44GqmIgdy:2AzHL5yfpLrSHh+ThlpxeeoiVLiiR44f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480844, "uuid": "c893e9c6-8c06-4bff-986d-97c18fc685cd", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480844, "uuid": "3e665a48-8141-47d1-bf30-c09d173ce2c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480844, "uuid": "31af5250-d3e3-402e-a2e5-5f64e0ec8a56", "value": "SecuriteInfo.com.Trojan.Crypt.32482.596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2cc46c8-99b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1702472502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472502, "uuid": "1b746fc9-bb5f-496d-be56-176c5fae5bb6", "comment": "Malware payload (GuLoader)", "value": "342e0ad16ed51c7f353ecc0378ea02d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472502, "uuid": "8917e91b-8baf-4873-bbaf-fe5d2274ad9b", "comment": "Malware payload (GuLoader)", "value": "e028ec06b305b12ae0084a95ff95118dfc97c1870337742446d6981951119c16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472502, "uuid": "3e96dd33-8a99-4ea9-892d-31f81b32376d", "comment": "Malware payload (GuLoader)", "value": "18761dca3edee976bce4455e0d25fa93d1efbb42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472502, "uuid": "5ebf1355-e8b4-4445-9bf0-cfb3ebfef245", "comment": "Malware payload (GuLoader)", "value": "a24ad1ca1d8d5f71b864cf4412b15edc5c1439c4dff39c5db082df0939c08c9bf3e9872b8b19438c8c1e1a316a249da3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472502, "uuid": "121a923d-521d-4742-b9d1-4d613dd98c32", "value": "T1911501C0FF948AF6CD6289758F93DBE1656ADD00DF129213A630731A2C33597B6202D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472502, "uuid": "de0091e6-dfdf-42a0-b861-ab2143b3eddb", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472502, "uuid": "1c9db831-469e-4e0d-ad5f-3651c6d363e3", "value": "12288:DkM2vTR4iLTnw3CVfQZZs+znFLJ0uh2Wo6GQUMs8TYamQOSm4Lq0:xg+iXMqAVxn3GQUUsamBS/Lq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702472502, "uuid": "efffe4b3-9711-4328-ab58-8873b2231523", "value": 943711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702472502, "uuid": "5ff178c3-e9f9-429a-811b-48440b212154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472502, "uuid": "ae241cf1-fd9f-4bc9-a80a-0d5e7423db6c", "value": "342e0ad16ed51c7f353ecc0378ea02d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fe7bca-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480882, "uuid": "992ba6e5-40d8-4ef3-8820-e58b5333497d", "comment": "Malware payload", "value": "500bf3140d7f046027dbedb88568d84a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480882, "uuid": "a3070303-b7ab-41d8-82ae-a4397049a33d", "comment": "Malware payload", "value": "e0c00ef5abab3a569eb2798e0a91cfef61e8f1c926be4863a8deea2416186229", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480882, "uuid": "f731ae8f-4e01-43ef-b2a4-7414a506f062", "comment": "Malware payload", "value": "f27cf83615c546c29d3d45db0acac4bd5037b4ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480882, "uuid": "fb36deb8-3a7e-410d-8af7-a453f4302ba8", "comment": "Malware payload", "value": "03b209c73109aff9293a30a31fd09c41810c84bff95e7773f826ee7c44771445961cc56e50fbf85608148c0bdd9dc93a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480882, "uuid": "727dccbd-e0b6-4b99-ab99-58589a0b537c", "value": "T1F6358D1732A15033D67279358A2B429EC92AFE261D79345A2BF91D087E30643FA75FC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480882, "uuid": "0c6c08ba-de0c-40e1-b752-4b3b4a26d3a5", "value": "12288:50obR1MRlUDB7+mJJ/IYaQ+subM909S7JwgfpaAcLB1Qamq6DOYf+7cacjk4OdR:5tVGlUDXJDrVi9SVlYLBd6Df+7cdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480882, "uuid": "56bbe543-3be7-4e51-b2c6-0109a088ef6c", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480882, "uuid": "576811ea-d81b-4d73-8cc8-5d06cb211141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480882, "uuid": "bd1168fb-dbfb-4775-8a94-7768adef1a39", "value": "SecuriteInfo.com.Win32.TrojanX-gen.22196.12088", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f09ab20-99b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1702472200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472200, "uuid": "c90ef15d-5183-4d57-aa56-d617a9d36beb", "comment": "Malware payload (DBatLoader)", "value": "e50760a09ea9cf00b918b5bd8baca76b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472200, "uuid": "7cd232d6-9998-4681-a630-f1179e67634c", "comment": "Malware payload (DBatLoader)", "value": "e0c0872bbed9389356872d44567f12603714894cc9309a1ec4d295c035f10f97", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472200, "uuid": "77a80073-e6eb-45e9-8688-b0b0fd4e0052", "comment": "Malware payload (DBatLoader)", "value": "d8e3ffff49d6feed73056129b7f117c929739323", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472200, "uuid": "5450db84-3622-46b7-aaac-689da916312e", "comment": "Malware payload (DBatLoader)", "value": "1c77e8c88b8be2004c98a85cb4235157f69f5b32c77552ba4a48a5de73004c98653faab35a148587ab6b0ad1a693a201", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472200, "uuid": "40a0a283-9445-4f50-b144-353e722305af", "value": "T18BD33499C34F41A1CB64A37703178E4986F8B33EF61052A674AC477437ED93E582A93E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472200, "uuid": "a7c069a2-7fa3-4c8e-8391-11206da03a7c", "value": "384:x+aVZ4imV+XsP3P770Mxw50k4wR3OXpWDnW609j:xXrg+8vDYfHTp69j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702472200, "uuid": "5f63f2ff-8de3-470c-b20b-80658305778c", "value": 137529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702472200, "uuid": "e4294872-f4d3-4dbb-a582-37691bf76cb2", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472200, "uuid": "de3324f5-d650-4897-9574-fedd94a47755", "value": "CONTG. 0992-19.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b298de8f-99b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702469897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469897, "uuid": "3e6390c0-ea37-4b27-a71f-cd7a7a435498", "comment": "Malware payload", "value": "9a6023f380a3ca9497b58c03af489a46", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469897, "uuid": "d74755e0-7ded-4d30-849f-ace622e3c6dd", "comment": "Malware payload", "value": "e0f39aafb9e7336243e6e7474a8dae1eaef0d47f18cf248647447de68025419d", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469897, "uuid": "fa2ec8c0-933c-4679-ad94-ce87034e8da1", "comment": "Malware payload", "value": "b0c3f4a422bdebb69ae2b23a02ede3d4963a2f1f", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469897, "uuid": "e1ef481d-0ba7-4e94-8d2e-15fc177fd5fb", "comment": "Malware payload", "value": "597b9ae266d5b38eb5be1d87ccca9be850d649c5e40f223bb9d32aeaf13527d9872bf72669f06c2a6f5f150ce7cb5a4a", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469897, "uuid": "1acfd4ed-c6f6-42a5-86a2-b74bcadeaf09", "value": "T1E8C41214B6D6EB2ECC93557088D8B8D7C22CEC296F44D29B71C6334E16B45E78833B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469897, "uuid": "ed3ee98d-291e-42d0-ac4a-2179526575e5", "value": "12288:OMe0yk97XV2bZ/HEIR01GF3CxBfL9DeHp/GilMD:OMeo9gdvR2GFupxCHv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469897, "uuid": "07aa52a8-ac7a-45ff-ae88-ab2743e2338d", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469897, "uuid": "3776e623-7688-4693-bb42-84f261506157", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469897, "uuid": "ee583d88-5947-4894-8089-b39bd60cf759", "value": "PO_Copy.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bcc5659-99e6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1702492542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702492542, "uuid": "fba472d5-606d-4d0b-b515-15aa5f83ccda", "comment": "Malware payload (Smoke Loader)", "value": "a1b49d2ab459bfba34d28474e74eee34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702492542, "uuid": "64d05370-e603-4fc3-992e-025fa89e7b72", "comment": "Malware payload (Smoke Loader)", "value": "e360e3ecdf794036366f3fe87706bb60812a4444fdd88d0b8c663bb623111f6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702492542, "uuid": "d6a1fd39-ba4a-4b1c-a644-b18d5d5c6315", "comment": "Malware payload (Smoke Loader)", "value": "86bb7eb1e35fa6feb432b8fa707a1b1c05917165", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702492542, "uuid": "3375e779-4f6e-4505-ade3-a9194f012c26", "comment": "Malware payload (Smoke Loader)", "value": "93ee5adf5ea5b3849bb0a276e54cf47a81c71373c06cc722850764fdd7ec282909969a29aeaece72ee5d0a1206e28b4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702492542, "uuid": "83baf324-6034-4995-a0ab-e1b901214b04", "value": "T183449E22A7D06472E52346319E6AC7F42E2EF4718F6576DB2794DA3F0E712E2C671302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702492542, "uuid": "eaae01a7-a8b5-47b0-ba8d-2196f7d04279", "value": "2d67bd3588d47d895c2fea44b0a5f529", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702492542, "uuid": "ff1d0021-f311-4303-9e17-0d7f559fd689", "value": "3072:d1/07vNZqFbUWntfW2pwUUBAcZT5WNr26oavoF7/uDKoyf5TmSsgSBJh12Y:zs7qLn9W2pwURcxwM6oawteJyArp4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702492542, "uuid": "cc3f1735-c015-4539-af17-273803358016", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702492542, "uuid": "881475c3-5139-457f-9510-cfec113fb536", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702492542, "uuid": "7960628f-6493-4b4a-9e24-394f43bf3b17", "value": "a1b49d2ab459bfba34d28474e74eee34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b9f1ce-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1702470893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470893, "uuid": "19c8b4db-ee60-4277-b069-7e4e8c2f8050", "comment": "Malware payload (GuLoader)", "value": "9bfb1962cef118532d74628191d6a7aa", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470893, "uuid": "bdf0886f-9e5d-43a2-b41f-86fc4dd63045", "comment": "Malware payload (GuLoader)", "value": "e378454ac4045ed2dd5be18e73e282498b313b0063720fed2aa83ba992557002", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470893, "uuid": "afcbcf2b-eed0-4b86-ab95-fcbb58b1c149", "comment": "Malware payload (GuLoader)", "value": "cb0afbb100fe28e0420bd59fc1051c413d654b30", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470893, "uuid": "d773d088-d972-4896-afdb-c8d24fb4a787", "comment": "Malware payload (GuLoader)", "value": "9d001638254e497a4a348564d1949eeecbe372d29fdeda5b25437c300aae9e6f55547c82da9cfccac687218266ed09c0", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470893, "uuid": "dac946d8-2f59-42e1-b4a7-2823591b4ec8", "value": "T1ED83C6F1CAB71534484A128CEC036CD1BDFDA0A6512D31B5FEA9164F51C7BB843AE68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470893, "uuid": "c39c8b9a-771d-43a6-bdf7-8721049d146c", "value": "1536:vIL/RrkxWhcHUQajj1Y7ZhHHJYaSJs24Lvap9+/w19LT2NhJJ7293H:grRrkxWaHUQaFY7ZhnJYaGs20vycIrSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470893, "uuid": "6ada0d8e-772d-4bd8-93e4-0f11f608241f", "value": 84836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470893, "uuid": "eae62f23-5199-4f74-8619-0b553319ee96", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470893, "uuid": "b47dafc6-cd58-4f38-bf16-819b1b74815a", "value": "WLL-PR-23-0001074.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44750e95-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480880, "uuid": "810efe21-fabe-4941-9def-42eb441b79d2", "comment": "Malware payload", "value": "d78f50cdbabf652587e7a8ff35827c9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480880, "uuid": "9a7fcfc2-438a-4383-8b4f-55db219414ab", "comment": "Malware payload", "value": "e39bb0fb838f37620008c90d96e1e19fbb001d6e60d1c1bae2ae0d13644a16d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480880, "uuid": "6c0f2d75-95b9-457e-955f-6b042fc69b00", "comment": "Malware payload", "value": "d9b73c715c0dc732b95bdb569811fbcce3148324", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480880, "uuid": "44d20923-e5d7-46cf-9cfa-a92da1e44973", "comment": "Malware payload", "value": "236b8e0621d873b4f744702dceaf27eec12072393cc93a216381657e61dfb093a96a6d1edc5760e1e2a4b1f9bf4d8ff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480880, "uuid": "db8217b3-913c-4b13-823a-0b9979675b70", "value": "T127E55B15B2E19832C47B4E345D1B4BEC2AE7BE043D34298776A83E4C7F76341B9A4399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480880, "uuid": "81d5133e-5da2-4108-a26a-901b0fdd2eea", "value": "24576:XXqhaFSclb2RCopYdUUYt8o2auV3Cr49I+ypbceW5r9xkojeGEB+UMDW4Q75XDjq:nqVqo9Y+4i9bcxxhs+wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480880, "uuid": "ecb6f218-3911-4e1d-bf3c-9f4dd7785e7f", "value": 3244032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480880, "uuid": "81e9b5b9-0931-4d88-baf8-097b6c43b7ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480880, "uuid": "e153e4ef-3b6c-4e75-a0cd-da69c3db7500", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.31758.30990", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8e2655-998f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702455258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702455258, "uuid": "d84eb7dc-7747-463f-ac34-9392224a4669", "comment": "Malware payload (AgentTesla)", "value": "a3222ba355db0291508a92f11feadd1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702455258, "uuid": "2657cb1e-0bf6-41a1-bd76-5dbe6d379af6", "comment": "Malware payload (AgentTesla)", "value": "e42b0ae4e264c685e8314d49f942606669d0b7b4edf0b2268ed75011fbde2ecb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702455258, "uuid": "9e4e2016-843b-422c-a23c-153d51061e5b", "comment": "Malware payload (AgentTesla)", "value": "dc56d7a8d4cc57f9f18f394a5c1fbb5b9c6119c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702455258, "uuid": "ef02adb2-5296-413a-b4b8-ae0590527521", "comment": "Malware payload (AgentTesla)", "value": "5bbaa9c574ad6b661e5edbe88861b1b6dda10a96d36347a0a418fead6ac2b519ed0b5a755d0ac3be5a90b0d6f9dda05e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702455258, "uuid": "64d4baa6-a1c2-4818-a454-1d083c91e82a", "value": "T17F05A03D19F92227F175C2A6DFD0C527B260A5EBB1629964DCD643DA0307A07B9C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702455258, "uuid": "967a91b9-4961-463c-a5ea-87fe094e9cb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702455258, "uuid": "27873e0e-dadf-4f78-bf1d-3193b23aaf2e", "value": "12288:Nfu8kWhyQShx1E4JLDNAPF90WsLoXOKP9Xv1WtF1BtX8wMZT:FCjQqrJLDOX0toXOGktBV4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702455258, "uuid": "0565b503-12f2-4903-808a-c5cf055f03b6", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702455258, "uuid": "b623e738-7321-46f0-a4ae-a44edfca1377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702455258, "uuid": "789854df-89e6-4a41-b34b-2d19bc65fe08", "value": "Attached Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56aec1d3-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480910, "uuid": "01d29858-dca1-4ae9-bb59-0974f42a0ffa", "comment": "Malware payload", "value": "25ce6eb289b270d7d45d91acb3039c14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480910, "uuid": "9d6e87a5-b14c-4488-8d3e-5b0cbba5bc30", "comment": "Malware payload", "value": "e5a808c0d99fe1c2cb742444dcd08cc14fa3751dc08dd3797529ad9a5ad089f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480910, "uuid": "9093e9b8-4a44-4652-ae24-0f963f035b18", "comment": "Malware payload", "value": "fa629bdb1c5aee9cd9200631e8334d020656d2d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480910, "uuid": "a55eb79e-e45c-4e49-baa7-63e8af6354c7", "comment": "Malware payload", "value": "927e9b26ee623581ec8bc02f51ff241c21162fd77fd1d986398f8f7b0d8af924bacaef54192f5ff810eb6e582e32cf92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480910, "uuid": "c474a53a-c9d6-45d8-8712-db343acfb9f1", "value": "T13C469D379E1D5CC9E90134719C1A8FDA29949C21B5086B9B76C1B96DCCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480910, "uuid": "2a218af3-f9ab-40c9-bb5e-2ca10022c9d4", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480910, "uuid": "083152fa-57c2-4128-88c7-c50c42172b05", "value": "98304:/LLVHi8nXnh96M9IGxgRXPhMqTnsO/lpxeeoiVLiiR44GqmIgdy:/tHiUXh8TGyRX5MWvlpxeeoiVLiiR44f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480910, "uuid": "b38d4130-776c-41e6-bd99-88ced6df0c66", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480910, "uuid": "28f9c66c-6718-4d9d-94d3-10a680ff2025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480910, "uuid": "85112456-6a99-4650-8b04-0f711df03c15", "value": "SecuriteInfo.com.Trojan.Crypt.18612.24707", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10492af-99b8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702472874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472874, "uuid": "d57b9b9f-59ff-41fc-b1a8-332924be009b", "comment": "Malware payload", "value": "9846e2e45000984719804ec2236405bd", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DLRAT", "colour": "#A301C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472874, "uuid": "f6a1dcca-5d83-4518-91f2-9c330be3a7a3", "comment": "Malware payload", "value": "e615ea30dd37644526060689544c1a1d263b6bb77fe3084aa7883669c1fde12f", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DLRAT", "colour": "#A301C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472874, "uuid": "706b3d70-afb8-45ab-abaa-dfc8a6593508", "comment": "Malware payload", "value": "f1b325a6b927f62a911dd3bf199262223983fbb9", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DLRAT", "colour": "#A301C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702472874, "uuid": "d812d753-4c39-489a-9d57-821484d6673e", "comment": "Malware payload", "value": "0508d2667f41e1e9e8e3806597f2861645d101dc5e23e1ff3e75be2de8f7b755503dab0e553de1f8239e7caa54844225", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "DLRAT", "colour": "#A301C3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472874, "uuid": "916b7664-e5d2-481e-ac33-2c6f73132ec5", "value": "T1E995193AA240A6D4D05384B4CBE1DA91D2607C385B3533DF22D17BA69DB5CD1AFBD283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472874, "uuid": "3d528c1a-3437-46e6-ac0d-1b1ddd763df8", "value": "c4a0213bb099203c783857a5e2fe3edc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472874, "uuid": "bd910a43-09c5-4e5c-aa99-b1e1c993f060", "value": "24576:Y4ENdUyGCaeU3wxE3ICbhYrC2RQdyrE8SQsg2XOfjvJpbPTvYRrJGcti9:Y4ENdi3ICbhYrC4Qd2XwXOfXbPT2t1t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702472874, "uuid": "cd8c821d-8c58-42ee-a49e-d68c53665347", "value": 2027008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702472874, "uuid": "c1f8587f-b9b6-4252-b0dd-c03bfc35a66f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702472874, "uuid": "055e8bbe-dd43-4234-8f95-d93abbce3319", "value": "sgrmbroker.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0f172a-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480916, "uuid": "02218ce1-d2d3-40c8-94d0-28121bb1c58f", "comment": "Malware payload", "value": "2acffff8f37dd789773f576876601042", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480916, "uuid": "cae811ed-cfd6-4908-b397-6683349a1af9", "comment": "Malware payload", "value": "e6dd2ae9a990b72ddd7c5af7925501a9460c09aca456cd60ecce946ffa82b55f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480916, "uuid": "74df1318-5e2c-4f30-b914-0e7434cb483a", "comment": "Malware payload", "value": "5981d85ec8d47e1abb841f50128611a20eaee59a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480916, "uuid": "eaa0ec30-47c1-48c3-84a4-6a6cf66c7263", "comment": "Malware payload", "value": "c9c939e6626c8650afd2583e22e26140dafe91f4f8c944b89e41f931634b493955575d51c63b7f6ee9d276995ac1f393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480916, "uuid": "2cb09e1a-6655-4f59-af07-5c03944b64d9", "value": "T162457D4AE7828190D59721F01963673D7EF89D472A318BFB42A9C9697E23731AD3F1C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480916, "uuid": "23bb29fa-8a17-45fd-878c-0dbc98bec9df", "value": "12288:ncHshgllKNbKrVqtI0DwZmVnHVFUjGwLAEe0gMq1ldrw:ncHaglKKAtN0wVHVmjBngMq32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480916, "uuid": "03fcb4ce-5659-4f6a-a49b-b1add789ea01", "value": 1212416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480916, "uuid": "7513b664-a2d8-456e-bbcf-b1422a27eeef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480916, "uuid": "1938cded-80c1-4298-beac-8bfa050dbe98", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1FX883P.26630.17415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc3ebb7-99c7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702479311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479311, "uuid": "dd589d4a-b127-4c9f-982d-5c73dd4ac541", "comment": "Malware payload", "value": "32866b8e848674b21c927d5441d087e2", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479311, "uuid": "38d01986-7cfb-44a2-a3ab-edb035a905da", "comment": "Malware payload", "value": "e96c11180d14c041a9d06d3e60e6111e8e05df3b7247c3fcc508771f08e622b9", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479311, "uuid": "83d15766-2ee9-42cf-af23-67083c628ef5", "comment": "Malware payload", "value": "b5e2499e17f22725ca972d31e0914647cd84c848", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479311, "uuid": "85973b1d-003a-4f67-81aa-3f2d5616b7a7", "comment": "Malware payload", "value": "e5bdbe1231e011b8ad0e8648ea15d66393d907978c3a875dff0dc2c20fa50552771c23a0a45bce618ac6a0b2bf9a8588", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479311, "uuid": "2818f4f3-eee4-4a0e-b420-ed71ff5f8733", "value": "T11B842354AE19D90CEEE6B0B4B42A1EC855D206E27C273315EB47948877EDC720DE7AF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479311, "uuid": "7c7eabdc-9e35-48cc-a3e0-10f01654d0b4", "value": "6144:4F/c8CaLWms4BN4Cc946HEpsQs2OQWGFMbc1c+1y0GLLefCUmys+UJa5yPpgfz/d:4F/ciVBmCeKk2ObG5GXys+6BgLRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702479311, "uuid": "206fb4e0-7606-40c8-9daa-4701e8843f46", "value": 392705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702479311, "uuid": "98256ef9-daec-4bcb-818e-c9125a8be227", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479311, "uuid": "49a532da-900a-4668-b788-2d7f0d69b8d3", "value": "filactery.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687cfdcb-99c2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702477075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702477075, "uuid": "f7a3932c-7329-4132-9e6f-3aba4ff173c4", "comment": "Malware payload (Formbook)", "value": "20b23e50aff829a53dacecdcb8e08006", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702477075, "uuid": "6f7962e7-4470-410b-873c-879e1a1d0464", "comment": "Malware payload (Formbook)", "value": "e9f92ccb189d223ce2af186e3d984aa80afdb0594aaf13c8b824b5b232f7dc0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702477075, "uuid": "65727419-c9b7-4da0-a032-244560585889", "comment": "Malware payload (Formbook)", "value": "681e5726e0f1651a6f598c37d7be2fc908cdf34f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702477075, "uuid": "8f40aa3d-a551-494e-a6a7-72442a24edf9", "comment": "Malware payload (Formbook)", "value": "cf484434f4ba6bf0df69f49a640528275c4a8fbfc4297273ca6cc6f38c8b0074d83a9efe185877c92c035d4d1d04ed02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702477075, "uuid": "a7de2e96-b86f-479a-936e-7afa65514c23", "value": "T197A37B1376E2C075E4B3463A19688A100A3FFDA25F708D9737D8168E2E742D09F76B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702477075, "uuid": "c120f624-1c13-4628-a946-14a6f67733d2", "value": "a2b237a3d4044533f93cc953b769baf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702477075, "uuid": "7d93bb26-e954-4389-b728-4f6c9dbf31bd", "value": "1536:vBnCrnqpsh5MhzF/e36E+1coOXKPzKs8jcdsqVscxON:5n8GsTyFE+ROXKPzPsqVsoON", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702477075, "uuid": "5a6bd2b5-3783-4de5-a4b6-737c1f04c723", "value": 98304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702477075, "uuid": "710b79ba-5b7e-4056-8b90-61244e791024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702477075, "uuid": "8a2528b7-cb5a-4b8b-85ca-3538aeb81021", "value": "SecuriteInfo.com.Win32.TrojanX-gen.28489.15653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecbe487-99b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702470750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470750, "uuid": "96b39497-b671-4392-a390-a904b30c9440", "comment": "Malware payload (Formbook)", "value": "f3a124708ce76052cf7eafacb0ddb989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470750, "uuid": "288fa7b5-a060-4da2-8dd1-fef7289b9e2e", "comment": "Malware payload (Formbook)", "value": "eaabbf2674a70aa254e89b831eb0caa7599e6fc3747e3380cea1ae5b4952d7db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470750, "uuid": "d9838f32-e37c-41b7-aa40-26927193a954", "comment": "Malware payload (Formbook)", "value": "99ff397a358415219106f67d5e690ff3abbd92f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470750, "uuid": "0a4fa8d3-1b7b-4e62-a3d0-6ff8baf345d1", "comment": "Malware payload (Formbook)", "value": "716e8fe6f1dfded71cd1625946531894eaa98bc064104737cbdbef67a181973fafbe3a5256fc312ec672e64e9bff78b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470750, "uuid": "539167c1-0413-4661-b076-f525ddbaacbe", "value": "T11FE4230023FFD77AC1AD15B52D23821937B6E563A10AD3CB14626EAB897774F12C16CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470750, "uuid": "906f1509-5886-4ca3-966e-3838e96ef5c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470750, "uuid": "f9902e89-b4e9-4e06-b0a8-bbc731d62471", "value": "12288:9EfTIBGy+YYUBYnX+LLSoHgcUlOEF6euCEK5X16kbKgQlc0nkATkhWa:8XYnCnwmZ6q5YkbKg2cZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470750, "uuid": "bde9c505-fb03-4a3b-8c52-785795d2f8f7", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470750, "uuid": "46c9027e-2ff4-424c-9a50-b820fbfae598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470750, "uuid": "02a3d138-8c05-4595-a359-8efaaf543d2d", "value": "SecuriteInfo.com.Win32.PWSX-gen.6107.4370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78771e95-999d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1702461210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461210, "uuid": "56e552b0-70ab-42fc-a4ed-50370890c8f6", "comment": "Malware payload (Gafgyt)", "value": "d2e0a6dba9a42f319f50229a4ae9913a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461210, "uuid": "94eaf891-b7c7-47ba-bfb9-9575cdb0df56", "comment": "Malware payload (Gafgyt)", "value": "eadcf1d14f205781b33b744a9791cd6959199250d0b11b24fe7ce3e05c7bf70c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461210, "uuid": "fda6fa4b-1343-435c-8851-d612bd5ffada", "comment": "Malware payload (Gafgyt)", "value": "af20193a5a1454004adc4bfb7b9a3f390ec3dabe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702461210, "uuid": "cca8844f-900c-432c-991b-c2050fcacf01", "comment": "Malware payload (Gafgyt)", "value": "42e6c264ab99067ee340c00739f10fe8c50fae2ea87273254357d3109ac8648ddff1801491de09eb15edfa6d4aa83b05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461210, "uuid": "5351a521-82df-4e7c-b252-67e0fbfc6585", "value": "T168C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461210, "uuid": "c2611f98-106a-4d67-80ff-01c9f26c9067", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8EpC+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8Eg+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702461210, "uuid": "f4034a59-ac28-43f1-be92-2772d4642bfc", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702461210, "uuid": "ee22b069-2396-48c1-b936-3d7ad991ffc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702461210, "uuid": "2f161e6c-7e48-494d-a1b6-11107cece964", "value": "d2e0a6dba9a42f319f50229a4ae9913a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b55a5d5-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480837, "uuid": "181084d2-a873-46d6-ab90-264b1b09fac3", "comment": "Malware payload", "value": "6cc235962a754999192c8eba4fd2751f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480837, "uuid": "9070ffc8-17d7-4760-98a5-2f4a8ba9db4c", "comment": "Malware payload", "value": "eb47d60ff87a8812e58b93f86cfb8ea8175e406c51ce747d875097520a52296b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480837, "uuid": "5058056b-b256-4999-b527-3d197ccc2a59", "comment": "Malware payload", "value": "2e3b37bcef8d73fbfe5458a64f4a88899a79a341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480837, "uuid": "8d93df0f-62d7-45d9-9150-22eb1e7b5b46", "comment": "Malware payload", "value": "ab528d24b0958713b2f8751a1e6d79ef2ae9cfddba6cdcddb52df7c93e33c4b5b0191b4abf5edc221ab57424c68ac620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480837, "uuid": "4b72b854-a277-4ea9-9e50-448081ff9084", "value": "T14D457E62F34150D5E55711F22DB323393FF0A6460E21CFEB1257ED59BD223A2AE76228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480837, "uuid": "594f5e60-f3c9-4288-9ca9-17673696f3d7", "value": "12288:ZC9q7xBe8CeV1ogYyWEDJgBLSYHC5RHdYpzis5o8:ZC9q7XlYbEVg9f6RHdYpzi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480837, "uuid": "90b4f41e-b554-4bbe-b132-5cfe9d23b0e0", "value": 1220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480837, "uuid": "11782725-78bd-4500-bea8-8842582bea88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480837, "uuid": "d8e2496e-692f-4967-978c-21c64a86f2cd", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1FX883P.28070.23639", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10516a0-99b3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Guildma)", "timestamp": 1702470781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470781, "uuid": "f2dcb3f3-976a-452c-9037-7e8d5a648861", "comment": "Malware payload (Guildma)", "value": "94b42b622e9d8c3a580dca9b7406292d", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470781, "uuid": "c39ec0c8-45d1-4045-a1eb-be61691e090a", "comment": "Malware payload (Guildma)", "value": "eb992737ce5c2e2d1bb3e1063207cc30071bb6ac22e281773d30336bc70d2df5", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470781, "uuid": "ce61326d-9157-47cd-acf2-4b8431d7751d", "comment": "Malware payload (Guildma)", "value": "8fca30d76459875a55205a4d1bbcbb6bba84bf53", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702470781, "uuid": "8c0704e2-941c-4343-a525-4fa379263ea3", "comment": "Malware payload (Guildma)", "value": "f2b87ffa73526c561c035017d1f19388e9c4d0b5da05ec27f57d7e9c54a4974f0d1cdf185c326f7af70fb65c78fd388f", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470781, "uuid": "9940bd66-063f-4958-8a2e-03f837fe8423", "value": "T1DA11E5A653391E7ED87363B5CC396E5C8CB68DB20E9ED09ED9633144C8386A12F84749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470781, "uuid": "6a9138b9-67a3-4d8c-a109-4d9a864513b7", "value": "24:8rBJlO+AL+JaALb5kZTdIuS5240ueITf0APcau/b4X:8VJw+ALYn5ki4UTf0APcau8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702470781, "uuid": "3421dd3a-de17-4be7-abad-c834f24ff9ec", "value": 1056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702470781, "uuid": "85d38675-d822-475d-9de9-ffde53461de5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702470781, "uuid": "e412d264-5bb8-437b-adb6-90234b70c94b", "value": "417176707.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4926aa0f-99ab-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702467144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467144, "uuid": "e966c716-94a4-46b9-8df0-a8e28c66d2bf", "comment": "Malware payload (Formbook)", "value": "f232fba40897d53925b023cb27475162", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467144, "uuid": "8389514a-03ad-490e-adeb-169937b9d17a", "comment": "Malware payload (Formbook)", "value": "ee139262ecdfb63fc9b2c0d4eaad48abf3a382243f640f41d192d127fddea24c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467144, "uuid": "c34fb10c-325a-44c8-8e65-9c9c3c01a192", "comment": "Malware payload (Formbook)", "value": "e464cade3372285b11c5fbf27bc498320b3b2336", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702467144, "uuid": "7c9d840e-fbad-40c5-a625-63ce9c8df198", "comment": "Malware payload (Formbook)", "value": "ef6840a0e99ba9de09a5abd255a4f9e2a7b4b585483006cd82aa2d2f697b0a14964dc4c7cb952eb0593197908dcb6972", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467144, "uuid": "ffd01011-b701-4dea-87ff-cd3b0f5f62d7", "value": "T14865A13D19F92227F175C6B2DFD0C527B260A5EBB1629924DCD643960307A0BB9C327E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467144, "uuid": "30a00f3d-7898-4b8d-bbec-53816534abf4", "value": "12288:tfuhXlmL8ZoyIqpZA9LkllZ5fmYlgur+FVcBxBTBICSLnSPlSHDsX:l7L8LIqP6LkxaUuutBICSzSPgIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702467144, "uuid": "c7c2b19c-3491-41bf-9dae-a72b6c0059e0", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702467144, "uuid": "29675ef9-8895-43dc-93a8-2150fd8d3700", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702467144, "uuid": "58caead9-599e-4d84-ab0a-5619fa3f1d06", "value": "n3306-20231212 DEC.ISO", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217ec504-99a6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1702464930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464930, "uuid": "2a4617ba-8f7f-43e7-9e96-aa2269be346d", "comment": "Malware payload (SnakeKeylogger)", "value": "fc293452dea8de40c71933bb96338256", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464930, "uuid": "e5d3d83a-eb5e-4870-afb3-c4357b31d618", "comment": "Malware payload (SnakeKeylogger)", "value": "efc775c58c7eae3c979f2548bad92d3665733aad94ca3977562aad3c098d28c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464930, "uuid": "aac1c497-0f11-4ca9-99cd-6b8c3c731adc", "comment": "Malware payload (SnakeKeylogger)", "value": "57261558b79a698dde70d1184031f0c8cfb66333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464930, "uuid": "3a34c1e8-a883-48c4-8445-a2f211bae71e", "comment": "Malware payload (SnakeKeylogger)", "value": "187c0a451ae17ee91c91af9a18276ce363bfbd19eeb45f603d0c606f2c2a50c3c5c3627f4593f7baa9734acadfe9a482", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464930, "uuid": "bbdfb1d7-8b41-4479-a842-4daedd300303", "value": "T1B8F4813D19F92227F075C3A6DFE0C527B260A5EBB156AC24D8D643960307A4B79C327E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464930, "uuid": "adf80526-dd69-4df1-ae86-c0fd301d9d38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464930, "uuid": "7dfebd34-7ef7-423e-9523-20b861f36356", "value": "6144:LINI5ttwxBORDGiDjQvoLB0EPrTq/RJF+rhO3jEwDmkcnCxU317WRfwQlkVHgWiO:N5ttL3DjQCK7r+s34emVnUIq5DJMK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464930, "uuid": "8c9871a4-5957-45b9-914c-a71762fdb967", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464930, "uuid": "d024fa07-b43b-4ffd-9769-e68985b52003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464930, "uuid": "6ed06c00-637e-41a8-92f5-d92e8693e800", "value": "08A256D6-6GC4-6C43-9A49-3DC23673T744.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10849d65-99b0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1702469196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469196, "uuid": "f233e95a-083e-49b3-8b73-a86da893d25c", "comment": "Malware payload (Formbook)", "value": "9a1b77d1856a7fa970416220dfc0f988", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469196, "uuid": "3807d421-9fd6-40d1-88a7-60b99f399be3", "comment": "Malware payload (Formbook)", "value": "f00b5fbe46481ef64e67801d8c03ac4166ab7758fb5faea3d66987f9e09c4aea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469196, "uuid": "76155dd0-25a5-40d0-b960-78e94835d4f8", "comment": "Malware payload (Formbook)", "value": "35f7257d9347d744de2dbcee87b1662682c21356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469196, "uuid": "74a8c507-f061-40d9-9b61-181e8af834a6", "comment": "Malware payload (Formbook)", "value": "a2a15bda365b8c2a78046105344d46aacafec00b57fd8d5a53ec9b59015454adbba0d812d49069ea2fbcff364a8fb30f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469196, "uuid": "8182b882-761b-472c-ae02-0e42c455d197", "value": "T1E8E42320E35AF25BC2F9EA3578B2012322BA5E5D7C06C75334AA4E9C2576F043653F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469196, "uuid": "05982653-77ed-45aa-aaa4-9085d465fe27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469196, "uuid": "0f2981e1-3b19-43d3-8646-fd4551a5ec12", "value": "12288:vEfuIhGy+YYUBYbrRLZbBbZu3FwTIdJd/fIyXN/7mBtKD4idggJe2JMMMDMMM:zHYnCbrRNbzwdnR/KPYdPJeSMMMDMMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469196, "uuid": "0dc443c3-9aaa-4399-89c9-3c6c0b437c07", "value": 690176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469196, "uuid": "c8619d10-bcc6-4483-b024-b21393036be7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469196, "uuid": "06a3a0cf-aec2-43ab-b98e-009131d372fe", "value": "rfdJHFYTjIOzuwrA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6859306c-9992-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkGate)", "timestamp": 1702456459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702456459, "uuid": "c6f5585f-d0eb-4697-afd7-c0befbdfa53e", "comment": "Malware payload (DarkGate)", "value": "7c9cd9d42744eb519569a27364ed7387", "object_relation": "md5", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702456459, "uuid": "a25e2cf2-bf63-4a11-8ee4-a04d304bcd26", "comment": "Malware payload (DarkGate)", "value": "f0eed58c85832e5a694d9e842de938e5500cb3617d16f7597af00c67d8df7d8f", "object_relation": "sha256", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702456459, "uuid": "6ae60303-dd11-4fcd-be43-0b39eb5da38e", "comment": "Malware payload (DarkGate)", "value": "152f6c1b0c94b8a09b58fc3c87ba728050c22e64", "object_relation": "sha1", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702456459, "uuid": "70f7986e-b558-485f-994f-078552c2e179", "comment": "Malware payload (DarkGate)", "value": "8ba51a4873d93b4525748acbbd5b7d6160f16343e4d97f2558f82b62a97c17f6d24d671b1adb7d6e7de7316ae1860f42", "object_relation": "sha3-384", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702456459, "uuid": "f1997545-ab1b-4dbd-a852-7d080fa616ce", "value": "T140B4BD30293968B85E4C7918D992AA0F3BB758949DCD47CE2C311F8E9076D82F7B47D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702456459, "uuid": "fed7334b-ea69-411a-b2fa-3661a0ddde25", "value": "12288:4yBMp866I8yG80cCS0qFuOnMoTMNNZcC4TLe+GPEf9fYqfllnBGPA/0u6l4sTRVY:TW6I8yG8WSSjomZcBLb959N/j6ThuBNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702456459, "uuid": "cea053a5-e7e0-4262-acce-c2bfefb1ecf2", "value": 511998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702456459, "uuid": "20384123-162e-4017-b953-4d4074ef5d7f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702456459, "uuid": "f4717fc5-92c3-4192-9833-c01abfaee770", "value": "gfcbkah.au3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a99d712-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480836, "uuid": "1f44165e-cdaa-4967-ad52-336e27b44ca3", "comment": "Malware payload", "value": "8c2a5e704b36430a048e63020f518a5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480836, "uuid": "d31eb9b1-3e91-4cc9-838c-6649c14bf46c", "comment": "Malware payload", "value": "f232194a424f572a4ddbd670b7f8ad78a60226ad794f41bd5bddc8146a561661", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480836, "uuid": "46a1172b-b321-4a99-bc67-7b0910fcb481", "comment": "Malware payload", "value": "138efde128b8c53ed9eb9f6e34aa48a24760ae1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480836, "uuid": "258af1b7-8751-4d7c-8447-c0d2a6a96ef2", "comment": "Malware payload", "value": "125056c2915cecacea928545bd875c888ded769d938ff785982b8739ea4cf73ed138e439bddedfdd23baeb7088d1d471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480836, "uuid": "b0db4a67-abb4-4977-aba4-a468884e2b05", "value": "T19C263310E2D8CCA3D23EDE39494333AC397A75AE9C0795E94B522ECDDAB564109C1BCC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480836, "uuid": "0217399f-dc61-451a-986a-ee9635c1a50a", "value": "55f3dfd13c0557d3e32bcbc604441dd3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480836, "uuid": "a9f35833-b38e-477f-932a-57a9a7002da5", "value": "98304:kYI9XmfvfK1nUjPP2n8zqe5T8k7qhbG9uWGNmaIHvvJHqTjuU4+KwlWEyW:kYI963KnQPP1z/TlGhS9uu5HngTj0wlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480836, "uuid": "d748598c-f2c5-4bc3-bee1-60a476a1cf89", "value": 4612874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480836, "uuid": "94a64f15-6350-44dd-87ba-0a1bb3154498", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480836, "uuid": "fae097e3-c51b-43fa-9b2d-130db0aba990", "value": "SecuriteInfo.com.Win32.Application.DuoteSearch.A2.22263.13343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a031613e-99b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702469867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469867, "uuid": "1f249cbd-33bc-4443-bdce-947094bedbb6", "comment": "Malware payload (RedLineStealer)", "value": "ed4c557ca13253bf5a33fcb866cc3c16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469867, "uuid": "8f905c75-e7c8-4d3c-85b7-bf38b496f187", "comment": "Malware payload (RedLineStealer)", "value": "f397b4b0b21ef612271da1c3a7919688f86f205ab334303a7903034beb427a80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469867, "uuid": "358ab5d4-1fdb-4f7e-bd8d-eac53c58ab2d", "comment": "Malware payload (RedLineStealer)", "value": "6dbda3effbc714f24d0fa35c19fefee2e53eb515", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469867, "uuid": "4d987f1b-6ab8-4eeb-b811-d9c77de20445", "comment": "Malware payload (RedLineStealer)", "value": "8872276754ad9cc35e4523e3b8a74c8312d329a57ab076c3ce22145b11acd84565a33829fe5dc9c420aa79eaa798ab21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469867, "uuid": "e0045f98-327d-4e15-b1f4-281f10cac470", "value": "T1A484AE0178D0D436C83332334EE0AB74756D6527C9D48F6FB7B64FAA2A24AC18DE9536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469867, "uuid": "a3a5915b-7f06-4495-9a10-c2e3db0e1c61", "value": "01e0558b547a7e50f5f08b4243934e72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469867, "uuid": "c3cefff4-bb5f-454e-bca6-da513b782e3d", "value": "6144:BgkLA2fblWUK2LNjbAOcdYcEDDjl19o9IrUKm9vWCE2SU:TLA2ftb2y1DPlmcCE2SU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469867, "uuid": "0b60af5b-aaa4-42ed-b207-c9edb0a355fd", "value": 384288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469867, "uuid": "126a5db9-c7a9-4920-94ad-292a336bc662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469867, "uuid": "b8f6855c-866f-4779-b990-659cae1bb356", "value": "ed4c557ca13253bf5a33fcb866cc3c16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5b55cc-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480893, "uuid": "d3edcb3a-ea3f-4511-a16c-0faaa994085c", "comment": "Malware payload", "value": "07a8681ad33dc7a8aa0ef4132998c54f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480893, "uuid": "01e001aa-c7c9-44aa-bb0b-74717cd93c83", "comment": "Malware payload", "value": "f515b4525554293dd3efa45c8797294429b1e2ca60696420705d0a28f0ec27a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480893, "uuid": "0b3ac17e-36e8-4310-aefe-64a6804a8d26", "comment": "Malware payload", "value": "86017c33ca0d8456f5546abca1036397c869fc93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480893, "uuid": "fa132cfb-350f-4ef8-940d-84c43b343b5f", "comment": "Malware payload", "value": "a6c8dd187c5d93dc8dc185dfa697b542f5dbd82b0acd6d1d792fc44dbbf0f42fff4ed0e4d57953626f35c2c64c489524", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480893, "uuid": "e3105bf4-0c4a-4899-a0ce-2671feb86510", "value": "T1BE658D53B68180B1DA15217105B72339AA7CCBA54F228FD7F7A0DE3C5D32AA1E63721D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480893, "uuid": "d22726dc-8121-4150-a4c2-6fc2a70f6add", "value": "12288:rTQr8ElhWwg8EIhJIzZdLzvfi116tn79XL3/9KaLp98H/1mFI6:rTQr88hvgAKlZz3iD6tn7SaLQNmi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480893, "uuid": "34afad25-6ba2-45c8-b16d-a8e5cee002d7", "value": 1433600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480893, "uuid": "e5405e82-9c84-4a59-aaa6-07573c01b7f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480893, "uuid": "0914c77d-fbe2-452d-9b81-33131ad13ab2", "value": "SecuriteInfo.com.W32.Xpack.E.gen.Eldorado.27812.26106", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d049c357-99b5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702471665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471665, "uuid": "78f1376c-7c0e-4de2-9073-ed5ee10d6054", "comment": "Malware payload (AgentTesla)", "value": "3415d0d8eb2143284827fe443a317dc1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471665, "uuid": "1174d684-78b3-4889-aa9e-987cfc13e1c3", "comment": "Malware payload (AgentTesla)", "value": "f588b64b0a34f38e311c2f45c234968f4f974ac4649c25e19cb20587de895f6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471665, "uuid": "e2555908-6ab3-4d7f-b467-e179834927c7", "comment": "Malware payload (AgentTesla)", "value": "ae927f104a4755cf28204e1818a7f7cdca484485", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471665, "uuid": "fecbf8b2-17c9-4896-99ce-c7d3f16e85be", "comment": "Malware payload (AgentTesla)", "value": "ca3462ef9561e61ca89e34d04ce37dd361979ec0fd32bed8990e1419e250f6c2ca58bcb53dc2439b07119ddf7f1bff2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471665, "uuid": "dae08949-fd35-4616-8c71-b0c12d4924b2", "value": "T14D86AF01ABE68A3EDA3F8A31D1D1616F07F1CD17B312DB9A9144F665BD03B409E091BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471665, "uuid": "b91a6356-c2ac-4f85-b6fa-0b81d8807a51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471665, "uuid": "428028ed-ea8b-492c-ac84-36ac76690f17", "value": "98304:AddhXpr5FO4qPdudczq7a/e1QCyTxvDWHQg2RMYKqUrNqEK:AdXXpr5FO4qVudrIxvCj2RfKqUrNqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471665, "uuid": "b47ab347-f3ed-47ae-912f-df2ab80fb0c9", "value": 8397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471665, "uuid": "35f1011b-7c99-4917-8140-ee28116b66d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471665, "uuid": "095e29d4-dc38-45d1-a4a1-47b8c3557c5a", "value": "INVOLVED No 548HR-BHDFH4571.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8f08fd-99b8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1702473001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702473001, "uuid": "016dcee9-3e04-4830-9392-fcb8990fc6a5", "comment": "Malware payload (NetSupport)", "value": "e0513cff99bb7b3acd1412295e499bc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702473001, "uuid": "fff57cf5-976e-42e6-ad11-7424b69186d8", "comment": "Malware payload (NetSupport)", "value": "f59c840544616b64fec28c914cb8e8132ad54980e80070f649a38b6bd387d6b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702473001, "uuid": "ec9c72ff-6d13-4089-a02b-0a745ee4cf40", "comment": "Malware payload (NetSupport)", "value": "96bb297d825579606cd690ad6ffc39b7e4c8a73a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702473001, "uuid": "dcde0c39-9dd2-4940-85b4-fcef4ff6b21f", "comment": "Malware payload (NetSupport)", "value": "dd8a397c5f03a676872201dd4df14531e307e90666f1a4d6234490fced442f3d1e246f84dd9da815ee6f9d4408a526b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702473001, "uuid": "60934040-8e20-459c-97bd-2991819ebdbb", "value": "T191B52312B2C68472C47327354E769F689A3A3C301EA185EF5744395EFD313C2A636B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702473001, "uuid": "1f8903d0-12ed-44a7-9501-1b73bd1feacf", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702473001, "uuid": "b857fbd8-ba45-496d-80d6-034490544e78", "value": "49152:pveOOVj3gu9SdZ/ufvr7TE22qqpE+OVbbk+LUqxNoWeJbxBEmVXH:pto3bEd9ufD+B0Y+IrzbLPZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702473001, "uuid": "284d1aa9-0a84-4c94-b178-6e2231d80c96", "value": 2325217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702473001, "uuid": "ccaba9a5-b300-4d62-bf8e-56306b8af267", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702473001, "uuid": "867eb8bb-3729-4245-80fc-8f872774de0e", "value": "f59c840544616b64fec28c914cb8e8132ad54980e80070f649a38b6bd387d6b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34dee9ef-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480853, "uuid": "6a7da67d-ee87-4126-84ab-58cb1d2aa7dd", "comment": "Malware payload", "value": "296afac6e6014eb8b46f7cb94db8e3a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480853, "uuid": "7bf16694-1c88-4499-ba31-eaed4690b847", "comment": "Malware payload", "value": "f6099493a58bbba753de2ffe889fd988275c4256f65db0f226e391113daf11f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480853, "uuid": "6e4f9e66-ea8a-449b-96eb-8afd624e1798", "comment": "Malware payload", "value": "266593142d3ddd0c490204c7b036ca67a59668a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480853, "uuid": "ff47434b-398d-4358-aa85-b0ea0ba1e52b", "comment": "Malware payload", "value": "9a8a8ccdabefca1cb0573cc25ee962a2308d946edcde44990b0b2ddc5a7e9cae573d0bb2730dd84ba2927f611f59adde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480853, "uuid": "8eda99a4-6625-4d8e-8b13-f741970d615c", "value": "T188469D379E1C5C89F90164719C5A8FDA2964EC20B5086B9B75C1B96DCCB0BC3BCF139A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480853, "uuid": "d0370b18-f247-44f1-ba14-bb4f3d94f83e", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480853, "uuid": "46a79bb2-bdb1-4571-a9fd-666fb91c63f8", "value": "98304:U7PsnMXzGW56CCmP54gLIzhAqTieOURV5+GwDVnqZ90oyf/oMNW:UInMD/5Rf5hLI9AzGRV5+GwDVnqZ90o5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480853, "uuid": "27d64605-6508-4391-84ef-495f99a6080c", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480853, "uuid": "13872646-e35e-4249-b212-fda7b10156b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480853, "uuid": "df5b4774-20ed-4b6c-a8b8-ec42c929a4bd", "value": "SecuriteInfo.com.Trojan.Crypt.31135.5879", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b66ed72-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480891, "uuid": "0ab1313a-5416-4d07-91b7-beb7c300b041", "comment": "Malware payload", "value": "fd3b3c86c63150d35f8f8f635ce35730", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480891, "uuid": "edb5fa92-29e5-4a3a-bf0f-da0e48633ab8", "comment": "Malware payload", "value": "f65929e45d857425234632cd7e8d01cc3c095a1b595755d3ccbbd51b8010dcb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480891, "uuid": "3215c30e-8836-4134-b7bc-45e1de640f5e", "comment": "Malware payload", "value": "f0cae2874f29e32a2e35f24058ce647e171f1a21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480891, "uuid": "cfc5ba9a-6166-4ada-bf04-f25805742baf", "comment": "Malware payload", "value": "8f15df453f288e83fc845542bcc15283731c9cbb5c79594016456a4baa6658a1e823d8663959d40ce015612c4ac65a11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480891, "uuid": "0b22dc56-48d2-42da-8aec-2590e3431c3d", "value": "T1A8057C1AB5C250B5EE212530046A7737AAFAEA47AF14CFC3DF54ED2D1D33291983B216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480891, "uuid": "d583f5cd-a297-488d-b92f-6db58be14740", "value": "a0315e76831bb6ad9b499f50121a8a82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480891, "uuid": "78444cab-7cfb-4ab8-88ec-f43e0b49c5db", "value": "12288:zkkAZLwVyrva0+500aXWW9vdbhjF4q8KC16Hkf:zhsUVyza350Xbf4v19f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480891, "uuid": "43d20ed3-2564-48ab-b931-2dddb633a98b", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480891, "uuid": "e5563279-0b0b-46f7-b0b6-bbe749f9d8c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480891, "uuid": "9a189d89-f6f5-41b1-a1c0-51fd7d602755", "value": "SecuriteInfo.com.FileRepMalware.25356.10779", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54668acc-99aa-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702466733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466733, "uuid": "a2016e1f-8954-431a-bcb1-dca27916d795", "comment": "Malware payload (AgentTesla)", "value": "a581c47618837c5a902b6399ec7af567", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466733, "uuid": "bfd503fa-2956-4064-9cca-ab5847585f7f", "comment": "Malware payload (AgentTesla)", "value": "f77457a79ecefa2f12d0ed50fa208259c89c10a42857cf6e397c73d7a7541922", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466733, "uuid": "663514be-3d56-4a03-88e2-71224717d56f", "comment": "Malware payload (AgentTesla)", "value": "68c467859d8e52ebcda5c801210c3d7a36e3564e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702466733, "uuid": "a5012215-b656-419a-afca-ee2a28a1ed06", "comment": "Malware payload (AgentTesla)", "value": "ebfe5c6623ce7e054033a7b303130ec44f0d66e33e456ed12080b0b0d821d3f7e46454f95a084c3cbf15e45746e86209", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466733, "uuid": "582f6361-20bc-4fcf-9996-7d3128254384", "value": "T111E422007B59854FEAFBA7B660E42A0223B0BD1797A6E3CCBDC130DB14F676129C0563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466733, "uuid": "e00c07e1-674d-4b8e-9ad1-48f156cceae4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466733, "uuid": "84319db8-f2f6-469c-9c76-9e93d9168c12", "value": "12288:YkQ+4WpAETw0BCmHNOdXgox5iVjNUDSMuimuMgWnTU7lo7BaznT2Ry7K+:xpAETw0Mdwo4QmNU7CBaznT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702466733, "uuid": "54d2cef5-09ba-4b5d-bd0d-97993bb2fa84", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702466733, "uuid": "e5014a79-7e9e-4d77-af91-8b323af6cb22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702466733, "uuid": "a5701c03-0312-49d3-9ac0-1eccfb107d25", "value": "chima(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4409851-99e3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702491429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702491429, "uuid": "8659c5ff-3d7b-443e-82b3-831d4fafb6f2", "comment": "Malware payload", "value": "25556ea1df965ccad41e65db9e255866", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702491429, "uuid": "17eccf13-bd96-4134-a145-58810d73123d", "comment": "Malware payload", "value": "f77971b5d75d97a322a2c2a4a3fd3269c4a32388c8ad7ae80b7dcc7cefe321d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702491429, "uuid": "7c54eaf1-1b1b-47dd-b0f5-bf5244ad3a09", "comment": "Malware payload", "value": "674b8f7b2f60f4a43ccba17c4608d3f6a15e4b79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702491429, "uuid": "4fb74856-df65-4690-8bd3-f0767de7cc69", "comment": "Malware payload", "value": "b26272becebcf117669fc53aaa246787981f845b414d53065996483c3a89b58fb96661d0906273864f749e7bc5117e27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702491429, "uuid": "517caed1-1b85-44ec-ae15-4904baaf1bb3", "value": "T1FED59D17E2D214EDD16BC13087666B33B931FC6406317EBF29A0F6352E31EA06B5DA58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702491429, "uuid": "a9330872-bbec-4e71-bf30-fc61ebaf29b8", "value": "dce96bc6319a78e5eaf9315128c98209", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702491429, "uuid": "ff73c4cb-b73f-4f77-99b7-ba936300e520", "value": "49152:5A9qEelmNGJRcsADizpXtBOlXBAUZLY6sEZGaXBuQQ9eyr:Aq8fRXBAUZL3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702491429, "uuid": "da071fb6-12fb-47aa-ae31-f057ba72b628", "value": 2806392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702491429, "uuid": "f32b75b6-fd04-4172-906e-39fa19c3a36b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702491429, "uuid": "692102db-3f16-4b4d-bb72-742a5604ba14", "value": "SecuriteInfo.com.Trojan.GenericKD.69225775.30738.27347", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c249d22-9987-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702451714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702451714, "uuid": "36544fc8-d150-4ee6-a4c2-bb7e9583dff7", "comment": "Malware payload (AgentTesla)", "value": "fb2853c7d12653c71eba4c498a42dbee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702451714, "uuid": "8ab24c97-7fc9-4fe5-a88f-b5ef7868c47c", "comment": "Malware payload (AgentTesla)", "value": "f8ee8795b3fd842a279823aa8925cb2c681457194f6d0bb5e392ab1b24d360fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702451714, "uuid": "1ec87d8e-2953-4397-a9dd-e1f076d5cd4c", "comment": "Malware payload (AgentTesla)", "value": "b8cfc97efdde5544922afd7316b4328b6db3c7fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702451714, "uuid": "7eaf0c60-53ef-4c8e-b467-d2eecb6b751e", "comment": "Malware payload (AgentTesla)", "value": "3e97579e120bc33ff30bd34ea5b034575ba9863319e5c7552bb9afc641c06d8e8e6f3d4de2d74fcba1ba79827a51cc68", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702451714, "uuid": "b632b7f0-0cd9-4887-8b9b-9acb7707d0d4", "value": "T14EB18101A3C88732E9B30777ACB39301537CEB619D66DB6F2898611BAC517584962BB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702451714, "uuid": "af041c96-2be9-4c6a-a332-f85b5fff9571", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702451714, "uuid": "28ec0d5a-fada-436b-9e0d-308ca1fdc8a7", "value": "48:6quSbbcVO8BaB5rNzqDorzwxtP+EG3cbRqaipvCtiOl+HqFKpfbNtm:lPurw0tj0ctqa9gZzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702451714, "uuid": "555ee2ad-1138-4f56-82da-df81bf5409c8", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702451714, "uuid": "464b3815-ca49-4d8a-898d-02304a33bf55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702451714, "uuid": "13a03130-0135-4013-9a16-802f04f87845", "value": "SecuriteInfo.com.MSIL.Generik.FMUPQYX.tr.3045.24667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff0cecc-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480899, "uuid": "04f95fdc-f0ba-431f-8a7c-858ac3f4a2ff", "comment": "Malware payload", "value": "33579345323f0c2f9fdd3207686555fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480899, "uuid": "445e4b12-c169-42af-b86d-0ac7e089b724", "comment": "Malware payload", "value": "f924c3af8210c19e84111b212cc1717c2141bf886d896cc30a79a9f132b09159", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480899, "uuid": "c924f6ae-85bb-42a5-b2b4-866dda942223", "comment": "Malware payload", "value": "7bafd95f6f743e115be8414718da3633354e5d2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480899, "uuid": "70700dc3-5844-4cc9-a282-89f75aeb856d", "comment": "Malware payload", "value": "7ebefdfa29f6e040aaac8cd98c853093928eee7df0a9b449585502c2f2fa32de6d901c41f5496a36ebc02833af5a5c90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480899, "uuid": "bd506551-8461-4020-8628-4a3aeaa62037", "value": "T115469D379E1D5CC9E90124719C5A8FDA2954EC20B5086B9B75C1B96DCCB0BC3BCF239A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480899, "uuid": "9c671c87-cf5e-4eb1-a860-4b6fec5c6910", "value": "5cce7b16b62042c52da7192bf1c43000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480899, "uuid": "0f98dbb8-47ba-4ce6-8e77-a119661f0517", "value": "98304:RUSRceNdGGXBwG0gL9Jkgks/h+qT+FOAipOVGwB1nKXtbbPxzrqA2:RUSJNdfRw/wJFksp+v/ipOVGwB1nKXtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480899, "uuid": "1deac108-84ae-47c8-be3a-e64670138dae", "value": 5378048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480899, "uuid": "24708032-dd9a-44c2-b4eb-bf2033205633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480899, "uuid": "cfdbbc9d-3b09-4813-83bf-8d27a4dd551c", "value": "SecuriteInfo.com.Trojan.Crypt.2174.31735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed1b71a-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702471287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471287, "uuid": "bb7933d3-d649-414b-a745-ee8aacd9780b", "comment": "Malware payload", "value": "bc4e0a189157505f7ffa7f5327cbaf3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471287, "uuid": "faea8c9d-506f-4960-a4fe-2d218d35e32e", "comment": "Malware payload", "value": "f9a4c25657cd8713f1cd6c2d040bf642f5ecae769bb5a8d8cd63eb3aab0c0733", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471287, "uuid": "95a493e5-2cc4-405e-bd40-d9cb6ed9bd75", "comment": "Malware payload", "value": "5e9d83b71b8c49c7b5c41fbf730f1a4b9a9e16d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471287, "uuid": "e99ea223-208d-4fdb-8792-281f2ee6e1aa", "comment": "Malware payload", "value": "1de6bf473cbc009e32cb4fc8abaa5ab2ad0e00340b6ef2f5b992d7c4180fa5dcedfe949890eb3996bf3a3360dc51656a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471287, "uuid": "e69f92a1-7528-4a51-a1de-47a4c467c93b", "value": "T1BE634D19AB57A4E1C49CA67984F35B180B72EF53D123DE8B358832268E33387546ED4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471287, "uuid": "687f687d-441a-4671-8b7f-8988c035c02e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471287, "uuid": "0ecf574e-7ee4-43e0-ab0c-4075f2cc6f03", "value": "1536:+o4WarhmVCgc7WM3CEF/7GmqbMY7usiY9hk:+ouVm0dv7GmCMY7pdk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471287, "uuid": "985d580f-7121-41e9-b48e-5ef6191a9a23", "value": 72192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471287, "uuid": "4d040ae0-a1d4-4a43-b84d-93fabf5ced3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471287, "uuid": "abe36591-062a-4753-83bc-aa5b6fbf7878", "value": "bc4e0a189157505f7ffa7f5327cbaf3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53ed6b72-99cf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1702482624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702482624, "uuid": "8a8a2863-8e0f-4ea9-9de7-8c2ac355190c", "comment": "Malware payload (LummaStealer)", "value": "05457bc1d8b90d963e615bf6efbbf73d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702482624, "uuid": "025dc9a7-238d-4f66-a269-c31da3395f8e", "comment": "Malware payload (LummaStealer)", "value": "fa3a8bd3a30eb7f3311fb8b69d3713550dc2d1f5383dcb8329c02f4c1b75b693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702482624, "uuid": "a13811b0-7fa1-4d3c-bb32-f5175fa3101b", "comment": "Malware payload (LummaStealer)", "value": "a6041758a5f89cdbc763d5ae05982ee1947d488b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702482624, "uuid": "21e18a74-bae5-4bb3-b11b-e40b6b9abe07", "comment": "Malware payload (LummaStealer)", "value": "42a862cdd4be56f0a772669e58c62ac414517e45b11ba742ef2d990c840d8391c3bafb6f50ccedefd0c850fcb21a7b0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702482624, "uuid": "ff2129fd-5f0f-47b4-a8a5-ca616dbedaa4", "value": "T1F3D47B17592875B9EBE3E23622C28EF194DE4111FFC60F8EF61DD1E8B738358858A518", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702482624, "uuid": "b514c5f1-996e-490b-be56-702c19cf9c61", "value": "59737f231ef329f299654331c80b5130", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702482624, "uuid": "6ff884f9-2b6f-44be-a738-f4ad26dee861", "value": "12288:GaSuuy9cTGJVKiLuvQg4N7Sy2ze6LVR0Z+gssjB:Ga6y9cTm8i9SyqLVgZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702482624, "uuid": "d3901522-6994-4c39-b1fd-875aeb8cf8e6", "value": 630088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702482624, "uuid": "14c1ffa4-9db2-4af6-973e-b86f5b3a15c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702482624, "uuid": "8a792c0c-debf-49db-a2bb-f39723300012", "value": "05457bc1d8b90d963e615bf6efbbf73d.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e88de0f-99c8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702479527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479527, "uuid": "39f6b4fb-5618-436a-bcdb-cc88d4e7f9a7", "comment": "Malware payload", "value": "bb3c9046b8f9e104308b96cbb603b8fd", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479527, "uuid": "37d972ca-f540-45e5-bae0-753941c10441", "comment": "Malware payload", "value": "fae85ad14e4729c19a5b1a7195d448a292c5ea4232610cac61ea8d81a9e9d989", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479527, "uuid": "1c92b1e9-82a4-4ee6-8470-80dc4de6026a", "comment": "Malware payload", "value": "0482da98ca50567a03d9677260dc11c95f417168", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702479527, "uuid": "3f5b4bde-638d-42ff-abb8-89bc3a372fc8", "comment": "Malware payload", "value": "fa2d3259215a1e5a75f99e5c0dc04877f5d750b3ec14d7eaa81535308c3fbe817a0cf1c66a89d582c157af7fff99c0c7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479527, "uuid": "8f238d34-4755-41f9-a1b0-e674b77474ce", "value": "T1F5C56CC9F3D2509FC62B8936C69BE7B27730B81801549D6A32C4EB3B1D6AFC15D19B24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479527, "uuid": "c750d1ad-1ee7-4d43-974f-04b51c8bf58b", "value": "4ef4dae210e27ea2bf03dfd3ffcd5282", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479527, "uuid": "3ed54215-019f-4853-9c53-e3f73b65c894", "value": "49152:ZrwzuNY02yiFrnySHv1JXziYrA1OnWTYkEquCAiT2RLa/r/fHc/d/xHq/z/Xwoc8:ZrwzZtf9HvpxUJMvN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702479527, "uuid": "6252ab4e-65bc-42f7-919e-31a7a760d011", "value": 2702592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702479527, "uuid": "e1de4229-51c2-4b0a-ae38-28481cb77550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702479527, "uuid": "86a4245b-8bf2-4548-8f77-f9fbc9928f5a", "value": "cleanhelper.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e27629-99b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1702471292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471292, "uuid": "746e35d0-3816-47a8-8e72-1cb3dd41dfb6", "comment": "Malware payload (Loki)", "value": "3f6c8621bb7f5f301e23b85847486d74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471292, "uuid": "4a41ada7-9be3-42d5-9087-a6c76ab8295b", "comment": "Malware payload (Loki)", "value": "fb1879185d39f7b99bf487094ae69ba1d5616853876df4f9676eecc3fc7c7a89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471292, "uuid": "a3112b60-4fe1-4460-82e1-54111ebd926a", "comment": "Malware payload (Loki)", "value": "5e44f19cf7af1e12ee13f3616c5d46cd5671dc3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702471292, "uuid": "35d357f6-fff2-4771-85e4-0a42fcb0236d", "comment": "Malware payload (Loki)", "value": "7cd526e2a55f324e05592087e6af2ff6680494f51c9c1934ff608d3dc1f52890ff3620d7b1d0a3205ca939a6866e93e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471292, "uuid": "6c652d49-65e1-4650-94dd-04baed894278", "value": "T18A14018BEF5F6182DE5A69BCD0ABEF570FA2A8A75562C0C7225072170C02357543FA0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471292, "uuid": "a5b381b1-65c4-45ae-ade6-d4c14a7608ac", "value": "3072:ztMNN/vE/gDVkLTI12xt2POLLzkuycRAKzTv6RMGRYIU/DqxGOsV4c72HQT7GmCk:eQ/gDgL2Gw3cRAKzORhNxKV4KQQOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702471292, "uuid": "3688d40e-fb89-45c3-be6a-651a9895630f", "value": 205712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702471292, "uuid": "1f5c3e52-4065-49b9-9644-0cd3ccc6ac8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702471292, "uuid": "a3cf558d-a229-40a1-a748-3d6bfba15625", "value": "Payment_Receipt_028170_____________________PDF_________________________PDF____________PDF______.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82406911-99b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702469816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469816, "uuid": "1098b902-a22a-4306-aa8c-a7f7edebdb19", "comment": "Malware payload (RedLineStealer)", "value": "d80de89f68f8cfbd743334eee1e947af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469816, "uuid": "9a7a5e85-1416-47db-a261-289c7a70c5b8", "comment": "Malware payload (RedLineStealer)", "value": "fb9dfb7d5eefbfd5cc86238812def0a3b9e10bfca6e315f6459ca4d59d3d0cb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469816, "uuid": "5f4b87ae-844a-47e6-83a1-561ec72119b7", "comment": "Malware payload (RedLineStealer)", "value": "4dadb1549b31f9262795d46d9107354acb24b165", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702469816, "uuid": "efea52af-5eb6-43d3-9dcc-b0f0d47e50ed", "comment": "Malware payload (RedLineStealer)", "value": "58ba4a0e257f83ee3ba62bc20be4037458429184925ba746f01e0ffbab524c3fb9ffb4eb3f529f44af9647cd13f03cfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469816, "uuid": "8fd07b08-0919-432c-8fb2-ff7d960e4770", "value": "T159C5239953ADA44EF8F74BB1AE3507364D323EA7787DC82D22A6890D5E50F0079B1363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469816, "uuid": "727b8d61-cdc0-41f4-be87-5d128c2bb0c7", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469816, "uuid": "1ea3ed9f-6c12-40ef-b2e9-cbf1c345dba8", "value": "49152:rb+muPB3Ght7bddhOg/RU7H8uezodl135EhMP3qk:/+N3OtnDhAK83OhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702469816, "uuid": "4eef4e68-9317-4767-aafa-ea9d6217887c", "value": 2503584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702469816, "uuid": "ab0d30a1-031f-4c65-a254-47ff848d78ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702469816, "uuid": "67414404-b0a1-4a70-818d-797531404ece", "value": "d80de89f68f8cfbd743334eee1e947af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92471ef-996e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702441186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441186, "uuid": "b7411eb6-cfe8-4b4c-bfe9-298420a58d83", "comment": "Malware payload (AgentTesla)", "value": "f16a1170d3c3c3309f696f0cc89f10bc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441186, "uuid": "99495c47-b67d-4f30-aaa7-b8f4e3a47ba4", "comment": "Malware payload (AgentTesla)", "value": "fce3081250a1b49ef21150350ffbd671118d3c253b3353e7880b857ff1b29799", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441186, "uuid": "629fc858-51f8-44fd-a56c-99c83002077e", "comment": "Malware payload (AgentTesla)", "value": "82cf31846cf1c4bf946552c6e848f371be6929bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702441186, "uuid": "d2cfff4c-758a-4621-963c-096decabddf4", "comment": "Malware payload (AgentTesla)", "value": "e823e51fc22112ff31127618747535f56ba22e18b269c616ff310eaf073baeab6ef2250fd7c708a7af90d8f6b48e0d2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441186, "uuid": "3ab7c1c2-f709-408b-9b31-028b11c73ebd", "value": "T14915B13D19F92227F175C7A1DFE4C523B260A5EBB1629924DCD643964307A0BB9C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441186, "uuid": "76ee3dcf-4f87-49b4-ab5b-923c443d2863", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441186, "uuid": "0f8a9719-ef26-4e75-aeab-e0a114e9c383", "value": "12288:zfu/PdW6GZ5b7Lx18J7De4bidemh69ztyt5f5UHAqO1SonXkX9:Lsc6G3LxmVbidemh6F4hqcqX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702441186, "uuid": "bd8a98a1-2b8d-44a1-a4e5-b06f688f729d", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702441186, "uuid": "cbd4c680-1df4-4252-a7dd-895a4e9fdcee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702441186, "uuid": "bd76ff3d-331f-440e-97d5-0ec034ba31e4", "value": "SecuriteInfo.com.Win32.PWSX-gen.6974.15345", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b513f6-99f1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1702497312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702497312, "uuid": "a14b5802-5962-484c-bc00-439619f39f39", "comment": "Malware payload (njrat)", "value": "16c7b2832ce255d5da4a5d85a4089758", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702497312, "uuid": "1bca2132-0586-442d-82a0-3bb167d8638b", "comment": "Malware payload (njrat)", "value": "fd13ed8d469c4cb5507716feee5c7139c38957b48a4ebff2d40d7a9269884387", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702497312, "uuid": "3b3a65f9-8bfa-491d-bf5f-ee4d92045d8e", "comment": "Malware payload (njrat)", "value": "80ed8b75ae30bc4df6671c5bca8084aba2148ef4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702497312, "uuid": "526bd229-5803-4a94-a581-e8546ae74180", "comment": "Malware payload (njrat)", "value": "0a493ff375c188df81b99d757070dce6b28db527152575c0febe96ac315e30e976c4cbae0ff48755a702ef92e5ed802d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702497312, "uuid": "6975ffbb-b442-48d9-b0ee-dc184ae96980", "value": "T13B643C572B5A8C87D13667FD0441E3B987132FC8782AC3129AF1EC63F5E2A472D5A6D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702497312, "uuid": "5ddf6538-2b18-44d3-8566-c5af71b7d680", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702497312, "uuid": "4c423c27-9712-405d-8cb9-c8bc9a659cac", "value": "3072:ONwjqcl+yJ516Vl5m7PF7OE7u/vDR1GK5WwiuGK36yUG9XV/VwMM:wwjqZxl5mQS+mwic3Xv/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702497312, "uuid": "9da32ab4-ce51-4c0f-b284-77d102375095", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702497312, "uuid": "7ce58d55-6cc2-4904-b394-c481b03ca163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702497312, "uuid": "d3beab43-0c7a-494e-97de-142863c1cb06", "value": "16c7b2832ce255d5da4a5d85a4089758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd06688-99cb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702480865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480865, "uuid": "4960af51-db1f-41e3-bd69-652310711935", "comment": "Malware payload", "value": "ef175cc49f1c36878753d296b81a9910", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480865, "uuid": "8f9933e7-bff9-4200-a3ab-1dc3a8292380", "comment": "Malware payload", "value": "fd486a4d08ef11b1c924a1eeae2f861b452307ac441e3a0e91006f3e2078825e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480865, "uuid": "9636e5d3-e47f-4f17-a35d-3f337e116489", "comment": "Malware payload", "value": "ee4dbb21753e7f6c8f2abf751d979886e6333c45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702480865, "uuid": "f2d7380a-7f68-430f-9f4c-63221dd51557", "comment": "Malware payload", "value": "b17b57e0f67afe0c75d2447acf8bfa695ac426b36205d6e60ee702b4a5f88b60f3efbc16c7585c1cb5e3ef352fa2c64d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480865, "uuid": "219bbf78-561a-4b5d-a7ef-dcd78663bb73", "value": "T1A9968C01F29744F5D7461AB014BEB73A9A358BC90B26DFC3E338EE695A325D0A83711D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480865, "uuid": "44128578-67d3-4920-a97d-f22527d3668f", "value": "3890c2abd524a4e33ee98b98367260a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480865, "uuid": "70177e03-a4fa-4ba3-9db2-1ab00823c73d", "value": "98304:Wt0obh00SHokkr7+sokZ/N2FYCAj6OtqeTB9OATfMgiZXGAM06NfJRXvnpQ:Wt0obh0/okG7+snZ/N2FYB9tBPmwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702480865, "uuid": "c3056f3b-7c1a-4898-9d58-eedb9ef2c30b", "value": 9310712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702480865, "uuid": "f8408fd3-66a8-49b5-9b74-3279d770ac41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702480865, "uuid": "a6ac8656-362a-4897-bc50-84969c2cbdb7", "value": "SecuriteInfo.com.BScope.Adware.Presenoker.10001.6975", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b2c9e5-99ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1702503234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702503234, "uuid": "68488d3b-1111-4701-899f-3e69661d578d", "comment": "Malware payload", "value": "5c41434ed2e606b6bcee0ddee5412470", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702503234, "uuid": "13025d11-d1b7-49d0-8a69-79ef7c4e1d81", "comment": "Malware payload", "value": "fd989c7e73593cafc00e19c27828ff5e2dcca7e9eaee9fedf287fd29ac6be906", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702503234, "uuid": "ceeee4e2-3d64-4b72-ac64-02e1e621cbf6", "comment": "Malware payload", "value": "a2c2d065e44b6067ebfde863edb33b8c146bf4e7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702503234, "uuid": "f06e8198-f590-4f6d-b6b7-495d948a0c7e", "comment": "Malware payload", "value": "e180df0cbe12798dd6eaaddfc654ffdff80c32f909a0218de06fa4b6c58fec035dd6b5a2000935020ba54b1b020a9b69", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702503234, "uuid": "03473df7-10a3-41d0-a232-7b028037d5cc", "value": "T1BC356C25A3C78522C51D027BFC79FE0E1538BE63473481E7BAF6395F88B48C152B9A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702503234, "uuid": "a9a3ba2c-624e-47ba-babe-cf9258888f55", "value": "12288:BB6QxN5pNYmk0Og0UO+HgTFjKaEW5B15NF:BBxxNXMg1O+HmV5B1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702503234, "uuid": "e5afb5b9-dc00-4e7a-96ad-d995273852cf", "value": 1096704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702503234, "uuid": "a4ac30df-24de-4025-bd89-f6a1d4e39b04", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702503234, "uuid": "95f334fb-862b-422e-8bb1-827637104d3e", "value": "4Bjyw1Vv.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f11c5167-99c4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1702478163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478163, "uuid": "071b2ea5-0e80-453f-93eb-1fc40a7b1c65", "comment": "Malware payload (AgentTesla)", "value": "f554d132828ee844b78e1e106512158f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478163, "uuid": "b5e04ce6-060d-4cdf-bcbf-1467868aa165", "comment": "Malware payload (AgentTesla)", "value": "fdd7d3c48ac3a0754ff4105c58b7bd3bd05166a50c8a4754bfae483cf968fd37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478163, "uuid": "3310ab20-216d-415d-8915-4b0b63ec9919", "comment": "Malware payload (AgentTesla)", "value": "c4490ad6ef476da04f5f2d7cbec1cf89967ce752", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702478163, "uuid": "0b2ac178-54c0-4221-8573-7c319e784574", "comment": "Malware payload (AgentTesla)", "value": "c5ef4c8fa9f8b582b3b0e8c03f2e2bf5b1ddd91821d02d026f1da40b168d0dd8f0a4f2b7dd9632fbea498484dd3dd28f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478163, "uuid": "8aa47bbf-d232-475c-9342-4922d7d334fc", "value": "T15C64127A95E08477F4132F702F709A76D7BA1224520297971B79CFFA2C60AE5730A1F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478163, "uuid": "cc935299-3580-4f8f-808c-85c88994758e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478163, "uuid": "d03acdfc-bfa3-444a-8862-7c0848fc23fa", "value": "6144:KBlL/XbDt+Hy4AcldYzROtufWiW+LoEO7imQ/BmDS8Buqpt:wRt+Hyjcl8JfWbN7imSdiuq3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702478163, "uuid": "469d1f65-76f7-49e2-b504-8aa94a102965", "value": 322340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702478163, "uuid": "f5f3124d-910d-482c-b3f8-d67535b0eae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702478163, "uuid": "4dc91d1b-696b-4aba-a319-7659defbed7f", "value": "PacMarine Singapore Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea53a8a0-99a5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1702464837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464837, "uuid": "6f23bd5c-689a-463c-ab0c-d97c748ff1ea", "comment": "Malware payload (RedLineStealer)", "value": "f15e47e14874774e3d521392e0d45c1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464837, "uuid": "a376bb28-a98f-4d45-b952-965e697582a7", "comment": "Malware payload (RedLineStealer)", "value": "feb081ccb2e6f34b3aeb6678ae9ad48ff911b2a253cea7c153faf0dbfe235b10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464837, "uuid": "0bd56f41-3565-46e1-8d6f-dacb12be9148", "comment": "Malware payload (RedLineStealer)", "value": "5aaade0c93c81fd08302c0574c8988c8dc9d9ced", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1702464837, "uuid": "1c423ed4-cadd-4e5d-9749-647771f9d413", "comment": "Malware payload (RedLineStealer)", "value": "c05770106b006f267450cadd46bd448c4ca22b7bd0cb704420a5bb5f54f0ffa162fd6ec65d136c2d09931b26f6ac0b1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464837, "uuid": "e7392792-665f-47ff-80e0-9c77b241f158", "value": "T166347BF22805F477D58091F9647463E733BC231F63D187AA2B9D8624BBF47A0493A6D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464837, "uuid": "d8270860-38b9-40f6-a81f-fd520a1ed9ac", "value": "59737f231ef329f299654331c80b5130", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464837, "uuid": "f7e8e29c-27ec-4e60-bf07-a5301dc66e73", "value": "3072:S8VtrGPfMFyyiLXwUc2LsLh3q3zMnrjjiPXua2ZAmUOx7c:SirGPfMwLTbLsLh36cjOXua2ZvU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1702464837, "uuid": "f2954807-8d17-4b8c-9cd6-06eb94322aaa", "value": 245576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1702464837, "uuid": "c4962559-423e-489c-9313-7610915e93d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1702464837, "uuid": "267d3c36-17c8-4331-a5a7-3f248c96f9e3", "value": "f15e47e14874774e3d521392e0d45c1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }