{ "Event": { "published": true, "date": "2024-02-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-02-14", "timestamp": 1707955381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "02e4fc07-2692-4120-b425-09b2ff2d9061", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18231a31-cb12-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707898906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898906, "uuid": "4e094bda-1694-44a5-aa41-8e52dff8348b", "comment": "Malware payload (Mirai)", "value": "fc748185dc9ee3b7f7e5fec08bebba51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898906, "uuid": "912b97ae-26f9-43ce-8443-accb0cc40ed7", "comment": "Malware payload (Mirai)", "value": "00649729140933c64810bb5223582fd380332ac4adaa89fdd25b39f75e8ea9a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898906, "uuid": "a4e69829-ebaf-4542-9dc0-7d0dbf833cf3", "comment": "Malware payload (Mirai)", "value": "c2e37a3d47a2920c6519e523f75378f521cd47ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898906, "uuid": "b82c53c5-1bad-4eb0-bec8-ca11b52fe5ca", "comment": "Malware payload (Mirai)", "value": "718208eea8d29eccf3fa5ceb15ad8ba4f34b80e325c605dadaa395e523b0c8cdd11402f73138083bfbfec263aa5c841d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898906, "uuid": "a6db8b92-1479-4262-a021-3b0a701bcd25", "value": "T138638D66D419AC94C4844338D4F28B792BA3B80883771DB6AED585BA4047EFCF9193F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898906, "uuid": "59c15328-94d6-4641-821e-fbb30d45cee3", "value": "1536:2a53jIp+aFCZZl7wtkjeYUVawK/NMPZIGZ/j72CLK:2gUcaEZZl7EgeI8/j72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707898906, "uuid": "45837592-deba-49be-8f0c-c32d711182c6", "value": 72264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707898906, "uuid": "d937ee76-ad8e-41ad-bf9b-91110eb16794", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898906, "uuid": "27644d08-2bd1-416a-965d-41c5bf389b28", "value": "fc748185dc9ee3b7f7e5fec08bebba51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c623b5c8-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707915949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915949, "uuid": "28c15555-c791-4261-ba1e-fa689d68bc22", "comment": "Malware payload (RemcosRAT)", "value": "f1551690d0c190ea424d9a011c2b1210", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915949, "uuid": "e244bce5-cf57-48a2-8135-5446672b7cae", "comment": "Malware payload (RemcosRAT)", "value": "00dbd62914f7287ec0c9b4b08aa16e74c60b1872d1c9676c32ccf2466c81787f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915949, "uuid": "2fb57422-a4cc-45c9-957d-15bf88198b5e", "comment": "Malware payload (RemcosRAT)", "value": "f5552e349c8359d9a1234d49447555bf2d0aba2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915949, "uuid": "c01df4f0-0c63-40cf-ac0a-230f86818a9a", "comment": "Malware payload (RemcosRAT)", "value": "db34dc0b13d016bd7f1e4966204435c16921c277e62571585d48415f9e66d4333e8b1932017a0db2fe853a551bbe4644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915949, "uuid": "202269a9-c6f0-4f1b-88df-6c3c1f46d6fa", "value": "T150B4CE85EB509268ED3ED3311936CD7102237D6DA172AA2D79CF3DBB3EBB6529002417", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915949, "uuid": "428f3a76-7341-45a2-a57f-272977219b17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915949, "uuid": "3092cddd-752d-4929-928d-7dc77a9a9dbf", "value": "6144:oClMw2Xp5wLj3OcbQxfxtvm2vJ3L1h0sQbugpDmI:o8Mw2XwLDTQxfx7vepugB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915949, "uuid": "42eeaa0e-d28b-47bd-9790-e7d3d808c10e", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915949, "uuid": "7ca4ae6f-8410-4445-8924-fd6756706831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915949, "uuid": "12304181-5e3c-4cdb-a547-d8d2836a6073", "value": "3PDFfdp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56153466-cb3a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707916190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707916190, "uuid": "b2d3db23-b39f-43ec-84fd-47b318a75a66", "comment": "Malware payload (RemcosRAT)", "value": "1664885f055e52e20320abe1e2d6748d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707916190, "uuid": "e153ef46-c15b-4c35-814a-5a1fa7031654", "comment": "Malware payload (RemcosRAT)", "value": "0180ff6061f280ac6c5a2bf84dde5f6ea4a056c7cbf14f796d48c62f2290fcfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707916190, "uuid": "ecc7ac24-dfc5-45bb-984e-7c42a0c8d5ab", "comment": "Malware payload (RemcosRAT)", "value": "91c461e040f6c00437e8b703c39014f612a72508", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707916190, "uuid": "2ab081b0-9d21-41b5-adc0-88202422f974", "comment": "Malware payload (RemcosRAT)", "value": "8cbe9da02097dba2342050b47f059c91458948ec6542c9931d020fc645e625a2db5e59cfda452c3539f61d6a0d9abc28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707916190, "uuid": "d79aa297-a01f-457e-b689-5907b2428f6b", "value": "T11D233A01B3EC5732F9EF1F7768BA51000370F6A67903D64E26D562954CB37508AE27AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707916190, "uuid": "9d5bfa48-7e6a-4f93-ad5a-189d4f3e4fda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707916190, "uuid": "dc793881-67ac-4a1e-8878-cf9900c365a6", "value": "768:p+TeBcj6u6tJ6IBBc/gyOD6elCQ8DySUrPFS7Zw6KZsLbVNkidl:p+TeBct6y/gt22Q05T6KAVNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707916190, "uuid": "f9280dca-ac38-4c75-b822-1997c64fbd0a", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707916190, "uuid": "9e96a280-c6c5-441b-a4c4-4b37cc18a03c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707916190, "uuid": "ddad107a-0e2e-4ef6-8ecc-465988edfedc", "value": "Sign.2024-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e5efc7-cb3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707917660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917660, "uuid": "d9e29dd2-ec5c-4359-8489-b56435d2f460", "comment": "Malware payload (RemcosRAT)", "value": "593b0fffb2e0cbf4a6a5f2290700749b", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917660, "uuid": "32ea3a10-b642-45f0-8d00-19d3a778d52c", "comment": "Malware payload (RemcosRAT)", "value": "01c263beaf06d750792cdd8f6208c5ae11a832b052b4460ca39befbb1a8f2680", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917660, "uuid": "401c2cc8-ce67-4276-98ed-9ed595fe8390", "comment": "Malware payload (RemcosRAT)", "value": "696bf13e938751b74310a9af45f4a156a057a5b4", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917660, "uuid": "11871ceb-cf5d-4410-bc46-f9b818092192", "comment": "Malware payload (RemcosRAT)", "value": "c0452e270ebe3d12e9774d2ba1b7fc40cda091b883a0a901ca94f2e43ddddd899d3cb05ce9f22e4ad589e385a463ec5a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917660, "uuid": "91133167-0e47-4b3e-9dcf-82e44818c47f", "value": "T1D9F423AB324E74B473229DF3CC48251554387DB86D9360025EA57AF2FF39425BDEE00A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917660, "uuid": "3cd8d926-f9f9-40cc-8185-2dab0c0d9e9f", "value": "12288:s0no5xwgZ1ueWsTtZu+KYo7nI064UFgHlYuOso+FSYdrchlLMiN6InwGLk5LoPIG:s+ORZ1uTsxZu+D06HuQ+FSYNI1ps5kPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707917660, "uuid": "0957ef2c-e7dc-47c5-8383-18c96e1e9b7a", "value": 774509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707917660, "uuid": "b9e23f0d-b6ea-4bd2-901a-bade6455385d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917660, "uuid": "09cbbc60-99b1-49ce-832b-e335583cfab1", "value": "nNordahl_Andersen_Order_no_106673_xlsx.Tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c735f480-cb3f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707918528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918528, "uuid": "cade1de2-ddd2-417e-9d99-2a36fe679d9d", "comment": "Malware payload (Mirai)", "value": "5388dc3b63a194d2c85e610ced234074", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918528, "uuid": "5e7e4c45-11ea-4d61-ad45-35510387c4b9", "comment": "Malware payload (Mirai)", "value": "01e4635e9d8bd74edfee86b69d8daecc6ce6f7eab189f9439a98b1de1eacfeb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918528, "uuid": "3826c0fa-efd7-4c60-a3f0-53e86cbf4d1a", "comment": "Malware payload (Mirai)", "value": "c52bde97834de59d24e57009f97132b04e165495", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918528, "uuid": "11a7800d-d508-42e2-ae8e-8995ab75caa1", "comment": "Malware payload (Mirai)", "value": "d39d0cf333d5d2d71083b0f166753aec0a71d14b68913f7275bf9ea8fb3b52e7e5af69f59ac36f93646cc2a2061264ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918528, "uuid": "1b1c18b6-391d-4138-b9e7-e7aaf346cbe1", "value": "T15EC33B08EB40575BC1E237BAEA9F424E33339B4477DB330A5A3856B43FC5BA94E25505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918528, "uuid": "4d48c16a-f345-447f-a777-9d8860213643", "value": "3072:tFacwnuNC96TiWGyW9M9xFrMMbMkOM/9Z1g:tFOnuNCovGyW9MTFRbMBM/97g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707918528, "uuid": "39e8e313-906c-43c5-ae48-ec52b591eaf5", "value": 127212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707918528, "uuid": "354b2a66-53a8-4135-a1d1-f1107b2dcd91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918528, "uuid": "02119cae-0468-40a2-877b-6702dab5887b", "value": "5388dc3b63a194d2c85e610ced234074", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55918c0-cb20-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707905156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707905156, "uuid": "d1b35228-a357-435e-8b66-a5d33120f067", "comment": "Malware payload (RiseProStealer)", "value": "9d8e423bec95b9b19304c29b7a4078cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707905156, "uuid": "ead83c5c-b3c0-4c95-96c8-90cbfb2f2c7e", "comment": "Malware payload (RiseProStealer)", "value": "01fa5d9465ab9c7793cc728cc75bb80f3edbc98454c6d5694fe370463fce4c66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707905156, "uuid": "5dcfc25a-dcae-4a63-b037-70db8eeefea3", "comment": "Malware payload (RiseProStealer)", "value": "a6692db1f8b4044596961777fe8dbcaefd631eb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707905156, "uuid": "a72a1305-64c9-4804-93dc-f0bf59bcbf9a", "comment": "Malware payload (RiseProStealer)", "value": "9ac73c78c8b688c6e832f2435f3833df84852b705ce0a60c41cf695296bcf5097ed923618a05bd4cd5289b7d50954c94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707905156, "uuid": "ea14031e-fd1c-4ab5-bb35-e6eff7ac1f03", "value": "T12C663316AE54C5E9C28EA0788427ACBC7A740E254125190BA5E9F7CFFCF39E4D8F1643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707905156, "uuid": "ceee9141-4952-4442-8ce6-d35b821f520a", "value": "b8a1a21d6eadad214c544e8876c5812a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707905156, "uuid": "503ce4b9-6e61-49ec-9ad6-5e59ff166028", "value": "196608:JcNzkBoeVDegxKHc9+Go0EuSLzuF11B5PYWCpZLz0qr:ZzqlHcDmJAPcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707905156, "uuid": "95fdc30f-7297-45e0-9086-98546ce1b452", "value": 7080024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707905156, "uuid": "81e02e33-c590-43a5-9e43-1f489eb0bb7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707905156, "uuid": "5c4cce30-48ad-4986-9c1c-969cc9d2c66f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c751832-cad0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1707870621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707870621, "uuid": "3fa2c208-a3f9-40ab-8647-82984c0c5d8c", "comment": "Malware payload (RecordBreaker)", "value": "cc8e457b1959cd9c12fef55fa6fb94e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707870621, "uuid": "b2898559-e366-4d41-bf94-9707d330edf8", "comment": "Malware payload (RecordBreaker)", "value": "02dcc8f72ee0f683718e52a9e7131e9c823a36149e38bba5aaa2da602630c15b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707870621, "uuid": "42fc7baa-e777-4f54-aa00-7706065a4e70", "comment": "Malware payload (RecordBreaker)", "value": "5b8e55ded804ab465e2767cfb8524b1b343d3cb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707870621, "uuid": "8477b0fb-ce1f-4cb2-b1c8-56131d9f968b", "comment": "Malware payload (RecordBreaker)", "value": "eb7bad34d4bcfc659e52873897d54f1fbbe1de9d3ff00b9930750bf9648ceeea38ebbd71e60c06e11f1f1dd22bf09f89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707870621, "uuid": "ae4af57f-30fc-4ca0-bcbd-107d29ab0ed2", "value": "T1BE86F119CF7C86EFE818D2A685D2E719A56342B8D7F4A301E4A72CB31BC1741925CBCD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707870621, "uuid": "b5fe13ce-9992-4a31-953a-990ffb8c3cf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707870621, "uuid": "5d818df2-ae1b-44b8-8f29-f18a7e92c487", "value": "196608:A00dVPsBzR8M0KG/Vzf6r1rfye9UxrgBk5tK:AQNeb+tdUJgwtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707870621, "uuid": "a11beafe-0672-4a66-8882-4a94a0e527a6", "value": 8210864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707870621, "uuid": "7a8efc60-da08-43da-afaf-e6bdaedc71ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707870621, "uuid": "656bb4e2-55eb-45b6-8835-84a8a9ab0f69", "value": "cc8e457b1959cd9c12fef55fa6fb94e2.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46070c75-cb0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707895548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895548, "uuid": "89024c30-81e4-4349-911c-5c10c4d0f59c", "comment": "Malware payload (AgentTesla)", "value": "174bdc4012dd42c4288976b5720199a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895548, "uuid": "af1529b5-1026-450b-a001-5f5cd3e493da", "comment": "Malware payload (AgentTesla)", "value": "034178a5764f1284ed08d895dc08bc6779531bfbbcfa57f5a4761f777d887418", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895548, "uuid": "6a9948f4-0886-40a6-b73f-c0551cc3fb65", "comment": "Malware payload (AgentTesla)", "value": "658da9a05d35d5374ed9ad9b705ffc151f54c56c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895548, "uuid": "32ba08fd-7c6b-4a7e-a583-81be47c974ff", "comment": "Malware payload (AgentTesla)", "value": "b91b8b93c8799f5ec640a14bf27a48681ee7d0652a35f7ea5816dcd2dd005ed7478ee39e1bae609f2f2d4597c2301f6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895548, "uuid": "567b58a4-a5ae-4f52-b1be-f44ddbc46837", "value": "T165F4024172D4C59BC91A4AF20820C1F16B796E9A2E71C78F3DC83F9F3AB6B825741647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895548, "uuid": "517ce4ad-cef6-433e-9dae-dfcc7aef5299", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895548, "uuid": "dc64b0dd-5632-48a8-86e6-9a86c113702f", "value": "12288:eyzN64m86TsXq1xfXig6oXIGJ3qOdT0H4LXYG0uQmBJ2RDnIHEmqepTd:eyEt85Wx/t6IIC3q86unL2tGTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707895548, "uuid": "7e0bb13c-8344-4626-9140-f42ce7380913", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707895548, "uuid": "636c8542-e094-425b-8548-078f6472c78b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895548, "uuid": "8e47024d-413d-42e3-b3f4-19db0b322b83", "value": "SecuriteInfo.com.Win32.PWSX-gen.8372.27537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e4d613-cb0c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1707896693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707896693, "uuid": "0941886b-2492-48b7-bb64-27574f4b4b69", "comment": "Malware payload (Glupteba)", "value": "a4a6e7fd67c483d2ea78f53d71ebcd8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707896693, "uuid": "44f31433-c8d1-427d-a868-014e037460df", "comment": "Malware payload (Glupteba)", "value": "04fa155376790acfdf519d9dffa4027af4f0e6702ccc30ef012623f3e950a599", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707896693, "uuid": "31d1f507-061d-4e61-a939-3f595a8a1984", "comment": "Malware payload (Glupteba)", "value": "ef90ebfd9c51c8b9aeab044a37577dce7b2de480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707896693, "uuid": "34c32a76-8696-4c75-8929-6d34e7d517ef", "comment": "Malware payload (Glupteba)", "value": "ad6293eefa118846046577314113e540dbffb220f7a005d4c068b885ccdab5026c461d8f5ee93c37cbe3ec926aee1c31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707896693, "uuid": "2bc7cd79-9ab7-487a-ab03-aa670ab5c6e2", "value": "T1001633502318E475C3530AB08B31FFBA5BE97871E546A98B7EC9E13F27742DAA027714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707896693, "uuid": "88cfe0dd-436b-4eed-83a1-eef77c576fc8", "value": "7b013929d49f752f683cc55db1700a48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707896693, "uuid": "da497439-094d-48e8-b811-32ccd92c3586", "value": "98304:aEjjkXZnkh+JGMdCSzVA+LaH2pMf+XGtEwdJc:3Wkh+JG9axXeiGHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707896693, "uuid": "dfa36072-291f-41cd-a430-7f842b28e4ce", "value": 4403088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707896693, "uuid": "bff00b2d-bfd7-4080-8ba0-342f5a2b933d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707896693, "uuid": "8002c38b-9858-47d8-9973-2289ae74c395", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0437ba6-caf6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707887136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707887136, "uuid": "efc4648c-4199-47ad-9b78-a65a803f1a53", "comment": "Malware payload (RiseProStealer)", "value": "d5e7cf22aa7cd7157cb7ff6193d48b4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707887136, "uuid": "0da301c8-be38-4ecd-b135-46168e747b3d", "comment": "Malware payload (RiseProStealer)", "value": "05cee19e393591f4e1ccd40c525a5a6032d8eebbb44fd6da28f2e28e5e1df733", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707887136, "uuid": "7174f97a-815c-4f4e-b4cd-52efe1b96717", "comment": "Malware payload (RiseProStealer)", "value": "3c396a6b5330ac3d4a1f288b9dd26503be444e89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707887136, "uuid": "5548fcf9-11ad-4d01-9220-4631249fb466", "comment": "Malware payload (RiseProStealer)", "value": "82c7a8b2ff0407178ee1d9f91cdb13e899ec3f17920a95bbc9e8b2ba795dd582035214eddcb2890a36d7e0852708886e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707887136, "uuid": "1b9b163a-858f-404d-8a47-499436f9a88f", "value": "T199E533CDAD4050BFE7C0377148E1F7BA162EEC81A9A055D86CC8BBE7F73261E5912129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707887136, "uuid": "ddf23be0-e68b-44fd-bfc8-5ef277d0e47e", "value": "59aeb10eab81e92b5597d86d6e338bce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707887136, "uuid": "d076888b-ee4f-4e5b-ae8c-d9a3293819ff", "value": "49152:7GMDCe4LTnxu+AXGFFN8b5qdvsqVxD8/LQMyxRMrCsj09m7/E99krhtEnSMU:71DCeWOXGrmb5ql/DD8/jIMrCsjqwO9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707887136, "uuid": "41016e73-bf6c-42a9-b0ad-d0cffe9e8b3a", "value": 3108864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707887136, "uuid": "2a1a0ca8-2cb2-4b26-8b07-ebf921970822", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707887136, "uuid": "ddfd6ac3-9078-43ec-a516-d480dfdf1359", "value": "d5e7cf22aa7cd7157cb7ff6193d48b4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da1de77-cb6f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707938832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707938832, "uuid": "72cc5d63-5d7f-426e-9d58-b973a3bb7156", "comment": "Malware payload", "value": "13243e7f9982eaf3acf24da04cddf739", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707938832, "uuid": "edd6b28c-1c55-4330-9ae3-d33246b091b4", "comment": "Malware payload", "value": "08ff8a6500d623b062dcef8a2ef6fc141c1871f7a84b42f842d470fee26070c4", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707938832, "uuid": "1996c018-c7de-4ac8-9bcb-6b7147508303", "comment": "Malware payload", "value": "45932fec9aacbd8daa22f9a5dcc7435277c391fc", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707938832, "uuid": "27df1c00-01df-4acc-8f77-1927553ae80e", "comment": "Malware payload", "value": "1ac7708530eca1e9033ec8140c93c1bddf02782cbb04840dd83c6cde47e77df60ff5967c1870d2413a1889a8cae95e3d", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707938832, "uuid": "9063955a-9584-44e7-bac1-71abc94f863b", "value": "T156E423BC1A450561ECA0A2768871F89D2EFA1DCBB7C561D3DCA1B8C864E471833358BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707938832, "uuid": "4bd410cc-06c9-4ae6-a343-ee047ca97c0e", "value": "12288:aUqYFDAVAQu3aSSS0855Ev6Lx60Enm/hwRHksn:/9FOAXu0PEv6LxREnm5Mksn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707938832, "uuid": "d869906e-ec47-40ac-a903-eb87eab13b21", "value": 661658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707938832, "uuid": "01dd5a63-dc99-4a6d-8be7-b0e7b0509652", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707938832, "uuid": "911e81fa-0173-4f68-a49d-f9eb08f6a3a1", "value": "application_v1.1.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15b0b30-cb3c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707917202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917202, "uuid": "4c83e1bf-b858-46d2-a18a-5f9a818c4dc6", "comment": "Malware payload (AgentTesla)", "value": "d32c9c88afca6a42aab81a66cac07931", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917202, "uuid": "34e2e79f-ea02-43e6-aea5-77593698e554", "comment": "Malware payload (AgentTesla)", "value": "09a49cc736a6ce08d600c8cd8da495290c3abe6f8c4d1b54363fbc7c6d9ab575", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917202, "uuid": "fa52fc12-c405-48f9-8b10-a47ab61b02d4", "comment": "Malware payload (AgentTesla)", "value": "ffcd66bc160b11f8083df4a8cced53e47f25c3e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917202, "uuid": "fd8b55db-c1f8-40e8-9571-7322b865cd39", "comment": "Malware payload (AgentTesla)", "value": "1666fc4928610bf27ed3250c893c01a61acbefaf573b44746aa07c2546a6c36c7cec3ec93a6748f62883046632be42bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917202, "uuid": "dc7bfb52-65fc-4c63-bedd-1adca6e2f6a9", "value": "T1F8B2F1BD322D23D59DC7D6321064FF12F5305D0A82A9FA33EABB77093B18112562E948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917202, "uuid": "df1ec4e2-772a-4cd2-bd6d-6f466ac22d5e", "value": "768:M79Mi8ajke/48gFs4JcluQI5eiHlze7IG:Ecajp/4HbuuQxiF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707917202, "uuid": "f621ba46-f1ee-46a5-b63c-2b57204ea20d", "value": 25495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707917202, "uuid": "5e616ccf-b3d8-4e69-89b2-8c61b704634b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917202, "uuid": "42371fbe-4883-4102-ab08-e8eb55b1e0e0", "value": "DHL STATEMENT 009##22.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3896e0f-cb42-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1707919756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919756, "uuid": "3731df2d-aa3d-4de6-ac84-1017bad46500", "comment": "Malware payload (Pikabot)", "value": "f1d0370f57f1dffbce1b665e45483da1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919756, "uuid": "c2e064a4-9a0f-4867-916a-ae85f335522b", "comment": "Malware payload (Pikabot)", "value": "0a0e0d2f9daa0bad25c3defd69a3a6d96a6ac5f325a369761807c06887d3bd9f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919756, "uuid": "654d7053-1803-4303-8c19-2224687284b5", "comment": "Malware payload (Pikabot)", "value": "5cf0a176fcb31e091099a3b661b4bd8eab418cf1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919756, "uuid": "5a6e32a1-0f84-4456-9bbf-c7cac23096ac", "comment": "Malware payload (Pikabot)", "value": "484e2c1e6bcac2c4daa0236c097ce1faeba8164315f18424d35962fad2abef75db3a11ba5e5ff1ae521e064286037387", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919756, "uuid": "65d05b55-28fe-4e91-8952-adb3cf95e7a3", "value": "T111742341D97E8280DDB6E772709A293C180AA8F692E3170A3CD77D5BC17C9B589C1E73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919756, "uuid": "85157674-835c-407e-b23d-12f59eccc92d", "value": "6144:1ieAn4qfVev93QG4B9XQdKuPKwdWBsw3eO8RQrFXg3iWA5iHDX0:1Ra4qfA93BdTk3OeFXg3iDWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707919756, "uuid": "9deab3b8-db80-4883-9743-b4ce7fd7a046", "value": 337512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707919756, "uuid": "7c2f8d32-cdc9-4abf-97f1-e183181f2f3f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919756, "uuid": "e644177f-b337-441d-9814-b5484618ec13", "value": "VOLUPTASYK.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a7c2e8-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707915953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915953, "uuid": "87f16b73-76d3-431f-b617-9639f716cb1a", "comment": "Malware payload (AgentTesla)", "value": "8cf829a4100bb0d3097c6e9ede335256", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915953, "uuid": "8636b1ec-52c2-4b56-9655-01dc097de875", "comment": "Malware payload (AgentTesla)", "value": "0a4cdc59ddec746d90858c1538d20838fdbc80c11ceb39cd5737313cf9d94263", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915953, "uuid": "c9ad1449-5657-4afe-85d4-ffa7efd85a54", "comment": "Malware payload (AgentTesla)", "value": "85200c5da2d0de043f942025a7f315db62e0a89e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915953, "uuid": "2d8dd999-c941-452b-b998-14ccdfdc0a1b", "comment": "Malware payload (AgentTesla)", "value": "701476861b25f63b85c0fa614929d1df2d9e77ad11f88f456f51fc70e3eb0e8508355256c4f2d3650c5ff81db9cf9a78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915953, "uuid": "503096fd-ec17-4ac4-8268-59ec10d2f2a2", "value": "T11635E119375C8B1AD19E0674E0B24A38C3F4C20BA69ED75B5D87E4E82DD37518B4E0BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915953, "uuid": "e1a1b5fc-3f32-413d-a4b0-9a0aaed3e13e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915953, "uuid": "a01a8f8c-4a3d-4ba6-8502-a5375855ed32", "value": "24576:xkXrRnKCvulMqdMimWHyRy3ieQ7jyOx+1XAd6WRILScC3dRFS:uEl5MidOh7jyOKxKImB37F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915953, "uuid": "370deb19-2b10-4493-85cf-a006e96e80c4", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915953, "uuid": "b333c742-4db7-4dc2-ba96-22377294a511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915953, "uuid": "d540f5fd-4859-45d7-a079-19e23bece5ac", "value": "ODEME 2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c99cf67-cb34-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1707913597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913597, "uuid": "556be578-32f2-4964-ac3d-eaefa747aaff", "comment": "Malware payload (DBatLoader)", "value": "5c0bef5a43084cceca3663e7f5178ca1", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913597, "uuid": "1bb03766-6930-47eb-b168-b9ac1ef38f6c", "comment": "Malware payload (DBatLoader)", "value": "0b1beeeb23515855ee30bb641cdf142ec190cf11a227a3e889e411b058152ae8", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913597, "uuid": "04a39543-a73b-495b-acbd-a13f0c1e08b6", "comment": "Malware payload (DBatLoader)", "value": "59b9d21cdf4b9b544cd1c2659eec9373ec0e84ce", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913597, "uuid": "a1c8e785-bdef-4be7-aa78-6c2ee1978694", "comment": "Malware payload (DBatLoader)", "value": "130f738da99567f64aaeefb31031993fe1e2767888fee0baae7618afef4803fbe25187df0a169481e62965989320cc01", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913597, "uuid": "c8544e92-9d3f-4724-bf1e-61085a7bd922", "value": "T1A4F423DF631830743343DAF28C54686960642FB96C93D1818EA83EF6F69E4185FBD91B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913597, "uuid": "dea38015-0179-4352-bea7-d5a9bad3e26d", "value": "12288:y0no5xwgZ1ueWsTtZu+KYo7nI064UFgHlYuOso+XLDxAJZj4D66QfgV31QQ:y+ORZ1uTsxZu+D06HuQ+XLDSjuVFQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707913597, "uuid": "1f25b4fc-0696-4dd1-8a59-7527c6d332c0", "value": 772601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707913597, "uuid": "86896f6d-aa74-4ce5-a954-711e2321a98e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913597, "uuid": "2ea89a53-bd3b-4b55-96a0-73c3aa982e0e", "value": "nPO1_Invoice993.Tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffb2a9d-cad2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707871808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707871808, "uuid": "29aa0832-ef3f-4e9c-94dd-e3de1b0d0239", "comment": "Malware payload (Mirai)", "value": "98317f907b08ca0e031e395e54d879af", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707871808, "uuid": "824ac80a-bb2b-4eaf-bdb9-c130f4df0117", "comment": "Malware payload (Mirai)", "value": "0b62aaa378c52e115e9b0136ab31649f67aee72c53fa886aa368cdbedb1be521", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707871808, "uuid": "68b789bb-e6cd-4944-9551-c7c8192e1447", "comment": "Malware payload (Mirai)", "value": "e575aea4b80da379537ba6682754d43301e5bb7d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707871808, "uuid": "cf9d4092-6888-40a0-b674-f1d2dd8ce139", "comment": "Malware payload (Mirai)", "value": "a53e8757cce029896ac0668662ad5d18bcea29dff8823cc72d394fd43dd645acd63f41173b122a0296e58c45587fe118", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707871808, "uuid": "5963d799-3398-4134-8408-97580928b6fa", "value": "T10853F8C27C81AA25D7C05777FE1F018D3319A798E0EA73438C191BA17A8ED1F0D6B65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707871808, "uuid": "c6acfb60-12ad-4b2b-af18-47a1cb635c89", "value": "768:RYinm+8+ecZ2NfGIvLHhYkSGVi41RxmHv6zJpq2TevcJK5VQHiLwCVy/Jx+5H8he:aik0ZTIv9YkbE41KcmcJKLJeZWW9xnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707871808, "uuid": "05df00cf-3e99-40f6-a9d7-97591c223a0d", "value": 63948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707871808, "uuid": "79fa008c-8d27-4b4c-97f0-be2f22e6475d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707871808, "uuid": "7ae156f9-2c9c-471a-8e47-581097266118", "value": "b3astmode.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75080f1f-cb63-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707933852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707933852, "uuid": "4083e76e-ebd3-4d58-8f23-1258d8e1ff87", "comment": "Malware payload (LummaStealer)", "value": "645e8693d7b547526c7b2269521d87a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707933852, "uuid": "9e502a40-6cba-484c-8f1a-83d99b0a375d", "comment": "Malware payload (LummaStealer)", "value": "0c2f0b304f7c7ff46ce7ea4480b6fdc37bdabf9b98e0152f68fc787e8872023b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707933852, "uuid": "19081ed4-a071-45df-88f1-fee78ce0ccbb", "comment": "Malware payload (LummaStealer)", "value": "bb073ccda2d61405f5e68917fc78d7e54839561a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707933852, "uuid": "39baa380-001e-404b-baee-c4af4793bdfb", "comment": "Malware payload (LummaStealer)", "value": "70eab0ae86f67a06d9f7c66b15ca3afafb9a842f4cd6713d0c4a46f076c9e07a78319451d105103e0a1ffdd33ab036ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707933852, "uuid": "7e0d7223-a2c8-4284-8778-e33e0dc246bd", "value": "T11566123F5A044395F8385A7278DB5B331DF0BCAB4AE3252A275EB21A0571107BD0B9BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707933852, "uuid": "a7de6cfa-6c9a-472e-a4c3-87d968c55337", "value": "49b6343a7e296cc33dfa349b97649cac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707933852, "uuid": "1aa46ca8-4040-42b0-aa22-b25db148f49d", "value": "98304:8lppo/C4Qtv9vScvqUISTD3AXRPU9sg+8igFkgw+mE6qDnHh+A/lM3ytWd7eY+1N:8pP48BZ+8iYkgwh/qLzS3JhKuKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707933852, "uuid": "369488a1-52e7-4e99-9821-50b808c4c7d2", "value": 6727626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707933852, "uuid": "168b0907-52e3-47d0-8df5-2b341e36c691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707933852, "uuid": "7502787c-3c6c-4649-819d-230c86620004", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd13be1d-cb04-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707893170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893170, "uuid": "5b8fc86a-c965-4af9-a222-aad20ce1c06c", "comment": "Malware payload (Mirai)", "value": "61c3f0af836912a141600d6b7f7f5f0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893170, "uuid": "0d8e8309-4357-4e5f-9a36-7930e0206e08", "comment": "Malware payload (Mirai)", "value": "0cd9fd6357aed1261d2933f5fb2f9e24a51665258f8d09f4e6d5ed8c072319fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893170, "uuid": "387a3818-7509-44fb-be87-496982a77199", "comment": "Malware payload (Mirai)", "value": "81fd90299f1a5c7112a47c9e85b806fe72317e3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893170, "uuid": "59d427c0-2468-4808-9b21-f823772abd7d", "comment": "Malware payload (Mirai)", "value": "30390ba50fd922184d36d8febebe4a461db4ed2e07ad0500f3541bd722125f155cc004196f58f52ec802b077ee0f6281", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893170, "uuid": "a9616d3c-6fe1-451d-80a2-22f32542db8f", "value": "T121332ADAF8028D3CF94BE67E54174A08FA3163D51283172627BBFDA36C731992913E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893170, "uuid": "3da28bfc-1c24-466e-8d23-8cb08c588aa3", "value": "768:GFeN8oOR+OfzRX1nR3Mcb8+PX5OCerv6yVjR1kj7TLXe84CdGD:EyaJfza2PXYCeeyVjRC7Pu84bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707893170, "uuid": "97fe4db9-a2ef-48d8-a9e4-ea138a2241ea", "value": 50172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707893170, "uuid": "be10e143-e966-44f4-855f-52e14fe8b317", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893170, "uuid": "2681c3db-11cb-4f80-ba20-d8090c8b0985", "value": "61c3f0af836912a141600d6b7f7f5f0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1bcfdc-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707947446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947446, "uuid": "af814c7b-cc37-4dba-b182-c6a885243fc3", "comment": "Malware payload", "value": "19df9b39fca565c4791b18ac58f7a8ac", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947446, "uuid": "9c1d3e39-09da-4f08-a252-25ca9da72b34", "comment": "Malware payload", "value": "0d7baeb0fd189b788393c0d1d9931f1dde05dbabb9820ed27703dc683a522001", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947446, "uuid": "60e6cf2b-883a-4deb-9ad9-d142d7599027", "comment": "Malware payload", "value": "3928875e43b90dc7562fc6d0c1974b780b68c9e1", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947446, "uuid": "6b74eecb-7dc7-46f4-9b17-5c9fe93aeffe", "comment": "Malware payload", "value": "696def4ef5e8074770d8a2db4cdb89bbb8592ab61439e2543889a1438e6cb3cdea00060c06121caf01ca283796b82045", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947446, "uuid": "16bd1646-a310-404a-abfd-0af0c808aff5", "value": "T1FAF423BF82F29B40FBEE361C85ABAF062DD6244B5695D2CE644F0CF15D4182E4913DB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947446, "uuid": "2ec82341-9f6e-4180-83ef-a5a7e3834c37", "value": "12288:x1TEpw8aYCeSHwiLNe3dZMpk2WIAVikhC/5GUroeQMs0X0iu9Tb5M/whpMaocDGh:xOpw2CeFistZMDWvikhcjoEput+8ocDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947446, "uuid": "47cc8486-b2a6-493c-8716-d08850c9a2f6", "value": 737906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947446, "uuid": "1e759220-6f3d-4270-ab6e-ccaf6ce527d9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947446, "uuid": "0375910c-ad98-4889-b695-ee87a630efb8", "value": "RFQ_588202411200ILC004923.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e93668a-cb3f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707918459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918459, "uuid": "8fbb6077-cbbb-4f8f-8fad-ad591983ed26", "comment": "Malware payload (AgentTesla)", "value": "437b0781f1491dd01826aada6c6b68c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918459, "uuid": "6a5e87f6-9e7e-43ea-8140-bad7e6a8db6a", "comment": "Malware payload (AgentTesla)", "value": "0e69df025ef85fec4166eee3a0f9e110e9857731da9601029981d2ee7485526a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918459, "uuid": "5c8ee5f6-77ae-4b17-9cc9-d3cae40a10bd", "comment": "Malware payload (AgentTesla)", "value": "979f5c055f78285c4b28595660131c0e00663e14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918459, "uuid": "8669f06b-e071-40bf-a49d-5532dbcb9834", "comment": "Malware payload (AgentTesla)", "value": "7ce1e57b0a213801cafed9a19d08e4123a3fcb3241d33dcde5f2d475ee6bc368016637b37966e372635a467dd0bc9e68", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918459, "uuid": "dba138d4-7110-4eb0-86cc-fa1c802e5b61", "value": "T14DE4122072FE9118DCB697B21E7446C5237B7E6B2E54CB4F3949120C8D326538B61FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918459, "uuid": "a5539441-5283-42ee-af87-c478a6d2877f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918459, "uuid": "bd354cf1-1855-4d26-bff2-f5ec2d93f665", "value": "12288:CeQ5vzi8PoiBFJqGJM+SQz6aODCGq0LgiZnpbbpTrMaZ:CriHuCGu+5eaZBiDbbpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707918459, "uuid": "2a69b262-9d55-4ddc-8a50-385cfda7d4b0", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707918459, "uuid": "5f7bdfb2-1edc-4f00-aedb-39937f5f9eb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918459, "uuid": "b38b42da-93bb-404b-bc55-3a9626f78635", "value": "rNewPurchaseOrderNumber4400057425.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1eae08-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707947450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947450, "uuid": "2215080c-319a-45af-aeaf-34dfb418e528", "comment": "Malware payload (AgentTesla)", "value": "986728fd75cf1fffecb3f7b6be059879", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947450, "uuid": "d2f0bf4f-8c95-48be-8074-12c183b61d2e", "comment": "Malware payload (AgentTesla)", "value": "0f6277003150db53fa27d99e8afd768f79cee72af6b4867eaf41b7c5cda65236", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947450, "uuid": "7c4e0f77-df02-447d-b8f4-d16c1a8fec40", "comment": "Malware payload (AgentTesla)", "value": "5e097b5fd30940e2497b5f886f5dc61a55783dbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947450, "uuid": "fb2d8929-55a6-4b30-a06e-aba66538f508", "comment": "Malware payload (AgentTesla)", "value": "ec78b56302e635dcfcbc012314625a061bd6cdd4839c6c80ba1c7b2fe3976d8ae5ad0e983cadd7cb0480436c752801fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947450, "uuid": "d2376f59-42b8-4206-bae2-34fa9b64bbe4", "value": "T1C7C42376C0D23865050E478C37729A830138BAAEE532EE45FAD4DF158A0B2E6D77ED35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947450, "uuid": "9cb7bb02-7479-46af-9b5c-5fca1f3249c7", "value": "12288:rs1voLqCN36+mAPN0478nw2RKI0N7/ul7fQUgDitGRpH07N:A1vKXxN044RKI0NLr7it+98N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947450, "uuid": "0cdbd122-7319-4cd6-a9ea-43f7b62ab2f8", "value": 578042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947450, "uuid": "b8702f28-e5be-4eb5-9890-76d16ecd94fc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947450, "uuid": "1041ba7d-1be9-476e-9e0b-771688ea8be6", "value": "SWIFT MESAJI_PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7213f43c-cb14-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Trida)", "timestamp": 1707899916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707899916, "uuid": "7610afa4-7772-437c-8287-f47553ddc434", "comment": "Malware payload (Trida)", "value": "ba018cc7ce0c24830da0958ff977d63c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "Trida", "colour": "#3C1DDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707899916, "uuid": "e4433e30-f19d-44cc-8cb8-699b5e234d99", "comment": "Malware payload (Trida)", "value": "108f2a72f7893e548fceab29a6ec2757bd446a85653398ead38d8e9398d78a32", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "Trida", "colour": "#3C1DDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707899916, "uuid": "5ca72f0b-c35d-4ff7-b475-c8d4e118e0e6", "comment": "Malware payload (Trida)", "value": "5eea04316190869bea794bc174a2955c6463d84f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "Trida", "colour": "#3C1DDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707899916, "uuid": "6f9ae51b-2bd3-45e1-8657-36cce9b1fee9", "comment": "Malware payload (Trida)", "value": "ccfea51501297eb98abd50aedb3dd0661b68a189d57e62b6d6432421bdb85eb879f20b23838a09bdbdde077432ed2839", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Triada", "colour": "#9CEAE8", "exportable": true, "hide_tag": false }, { "name": "Trida", "colour": "#3C1DDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707899916, "uuid": "6a70c94e-7f1b-4d76-a9c2-092f72dddbcb", "value": "T1C70812D3F358ECA6C0F39735D6315162792A0CB05B13E6A72D02B23C6EB3AD09545EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707899916, "uuid": "c1b22f70-b98c-4a17-bee0-449e3c9f82b6", "value": "1572864:4UAONTa2ylpwD97OUehYIwq60mBFXUEVy7hyFpGLXRFy:fNTa2y7k9P3Idg/EH7APuDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707899916, "uuid": "45b6ef2f-891d-4a62-9d6f-7a70da368c42", "value": 81321203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707899916, "uuid": "c0684cdb-c6c5-430e-88a5-f3da7a25092e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707899916, "uuid": "c2661e7d-e75e-4a2c-8328-c9f80b530f1f", "value": "WS_m2571_lzf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143e2bc3-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707947433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947433, "uuid": "e0c6b665-d8d2-4dca-a746-afd2b33c840d", "comment": "Malware payload (AgentTesla)", "value": "843e3d8ed5572c7eaa25679c3853a76e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947433, "uuid": "c5f5feee-7868-4078-bde1-8d6ad9277c6c", "comment": "Malware payload (AgentTesla)", "value": "11d920768401320110366b31fbb636bf9475d08437d547de49f13e41abfa8a25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947433, "uuid": "b91f1eb2-55a8-4555-bc88-454d96ada5cd", "comment": "Malware payload (AgentTesla)", "value": "8eb26b298628b52175a0fd7a0cf3947234158200", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947433, "uuid": "d3a58fc7-54ae-463d-8bba-39607eae4565", "comment": "Malware payload (AgentTesla)", "value": "71260f4012fd8734873f00bb79295a6d264476dcad4e999e97861c0f515a6bdc24846ecef6be92e3c84be8d5a8d2e373", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947433, "uuid": "e10ffef4-e11e-429a-9e13-7c56215070ee", "value": "T1D7E42308BDD62F47729901E98DE6205FD9CD26BEE2F8A967036242209D3DDFC0097DD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947433, "uuid": "a15f4396-4426-4e6d-b28b-ead6d1f80793", "value": "12288:cqvEb8mbR3uCW3nERtb3jP5ujaIuZ+Udy4LcD2aXh3XjhZvj50NuJXp:AM+HzBujaIjUghXlt1QuJXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947433, "uuid": "e056077f-fa45-4fe7-8f49-428281bcbc05", "value": 675037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947433, "uuid": "c5e52d30-eeee-4be0-b978-6c0f1a77e13f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947433, "uuid": "e61b9c99-2128-448d-bbbf-f107a3c80641", "value": "invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c338d3a0-cae2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707878578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707878578, "uuid": "7f45585d-29a6-4d8c-a772-0c49bb77d0f5", "comment": "Malware payload (Mirai)", "value": "62b58790c906a7f7612779970097d3b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707878578, "uuid": "3d524d2a-d7fc-4fc5-9d4a-c0962986cb47", "comment": "Malware payload (Mirai)", "value": "11fb8428e10248164b4c2402bbf36c01077c6dd7c0be9e0c8ba6303881dcb86d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707878578, "uuid": "962837fa-da3b-4316-aad3-1e9ef22a6568", "comment": "Malware payload (Mirai)", "value": "dfc864ba65d0359cb56510d2e743ee72de5fd3d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707878578, "uuid": "80cc0774-3d09-4bb5-bde6-a0b18f8b0a90", "comment": "Malware payload (Mirai)", "value": "82734f6cbbb878975e700e275692ad69a918327940df1dc94e59c723e5841aa7ca6706804f00310746487b8d0b4d81a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707878578, "uuid": "0582f246-5469-49b3-8bbb-a63d6d31fd5e", "value": "T129735D24A9792E26C0D4A17B61FB8361F2F6230E2570965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707878578, "uuid": "fb4ddafa-2968-4b1b-be49-ddc3beee79e9", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8s:YwfdNu4cmZvFqI3w7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707878578, "uuid": "da6852d1-fa0f-4d93-ba65-f27cbc8d424d", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707878578, "uuid": "0d915983-b610-4022-bdaa-bc6910d7480d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707878578, "uuid": "ec2efab0-9eb7-41ca-8997-4bb911d892d6", "value": "62b58790c906a7f7612779970097d3b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf9d46a-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707947419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947419, "uuid": "cac3177c-4666-42a1-a456-0b82aa885194", "comment": "Malware payload (Formbook)", "value": "bbff6df888207f1dbab8c9cd3ee2282b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947419, "uuid": "01dbb9dd-570b-496d-b08c-a735097a316d", "comment": "Malware payload (Formbook)", "value": "120c6f98f5d7af157bc9db807ebb02d5613b26683df69b1b85544a86aa3f7133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947419, "uuid": "71dc33bc-31dc-410b-85e3-28597c629c75", "comment": "Malware payload (Formbook)", "value": "307c9750d341f2c440e9a5b4c130e26ba80a41f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947419, "uuid": "851f1e52-d860-4ef8-a080-1e0dcfcc8b1f", "comment": "Malware payload (Formbook)", "value": "f370db00d9b6756a3da1996dba4de889e4b3281a122d21d66571ef19bba7ea06c1e20908a7819682ee98416fef729586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947419, "uuid": "f615f85c-d308-4d4e-ab71-c64e5e61b860", "value": "T1F2F4F102B6F41F47DB7943F8296155454FFA788BA466E28E4CCA20DE66B5F808E41F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947419, "uuid": "16e92bc8-b5e8-47bd-9ba1-f1ef4d64ff27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947419, "uuid": "d67502a4-2751-4ec5-bb67-86aa39842407", "value": "12288:9SqHQkzqHKMbnquIuMyOl8xdBEUne6POHwkkcEFlXHMA1u4/YA8Ov2xjLDCty:9P3z87bqbuMypbEikYXH51uXXco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947419, "uuid": "efad3951-e84f-47ef-b3c6-4767f876aff1", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947419, "uuid": "27761ed8-9176-43eb-a62a-8f3e8db8e0eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947419, "uuid": "2098f689-01a8-4a6f-9303-e73538dfbcb1", "value": "103_1000RT0382400029_2034090349.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "128bbf12-cb1d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707903622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903622, "uuid": "33874ffb-be10-418f-a4f7-bfb6865031b6", "comment": "Malware payload", "value": "88363a120dc59eacc8c9f1fd9f4f2560", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903622, "uuid": "335e3fa0-d2ca-48fd-967e-35969f3275c2", "comment": "Malware payload", "value": "1273de7eac12d8c89ac387d908c322dcd1dcdafbf0df63630b929897c1d2d914", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903622, "uuid": "75575878-5947-4159-bc5e-88a3426b1c06", "comment": "Malware payload", "value": "25e43ea50af3f8bc50303b1b985dd1e67a903848", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903622, "uuid": "295ce998-2084-482e-b636-9d72841e15ec", "comment": "Malware payload", "value": "583b245fa931c65f1f54f3ce3b3599495b5014a5d786c80bdc3d4f5e504e9a2821d046603171777f56ace9d5611afa29", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903622, "uuid": "752ccdeb-9f06-4b19-a1f1-5b8fc301e367", "value": "T13F9533E5CF388472E4854138774EA865D73876C71AC45D4CAE72E502E067FFFA582B28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903622, "uuid": "601de97a-5869-49c8-8703-41f998249266", "value": "49152:gtMb+c6UXe5ZsF314eD7KSPfF/vxv3+PfD+xcJp44p:gqgUXmWTK4F/vxv3vcJa4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707903622, "uuid": "a6da7d65-b59d-4f73-8ab6-c7043c3e268d", "value": 1941054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707903622, "uuid": "76870fa3-5df1-42f8-b556-93e398e1b6e4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903622, "uuid": "ac4ab59e-f28f-4390-96da-cadd2b933ace", "value": "AH171003Q-1 TECNO CALUBERT SL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b30c574-cb18-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707901569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901569, "uuid": "1128927e-a154-4248-be31-5b1bd0e8ef34", "comment": "Malware payload", "value": "caad8a1caab5e5810686bc527229b577", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901569, "uuid": "a6a0220e-ecf2-4338-acc1-ea65b42c9d41", "comment": "Malware payload", "value": "134b643f2066efb31727699782e2d6d313de974c53d17a511423cadbdaf137d3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901569, "uuid": "0e102b4b-c327-40ef-b0bb-e336823ff9bf", "comment": "Malware payload", "value": "8dc8a893e88bb6cb56199bb31372d54a58c0eb0a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901569, "uuid": "2b18cdca-5842-43cb-b9bc-cdf5d820121f", "comment": "Malware payload", "value": "e37c4f985e29c7d1bc02861b90a621da025f6408899e4ffdeb5e9191d35ef593062eddfc46b2019013f6be8295f8d191", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901569, "uuid": "a4ac51a2-fce6-4250-b57c-a5387831d5fa", "value": "T12795D06761F90B37F173003D6C486919C811BE4D40B9EA4EA2F9FB4D2FB9B8564163E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901569, "uuid": "f7976aa8-ba5d-4e88-8079-bc8f3948345f", "value": "24576:z846FCnrky7Tt+PMq3avRxpIms5Xl6ravtwWoiE/3LP3FktMn8HKKKAN:z8tFUkyX0Eq3aTscavtwPiE/Lvz8HfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707901569, "uuid": "b8777117-9250-4d17-a549-cad2384d71a8", "value": 2057347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707901569, "uuid": "8e98ed55-a0cf-4610-ae0a-3009c63630df", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901569, "uuid": "f561cee8-310f-4f0d-86ac-ab35949991a5", "value": "GIAC-7-02-2024 534439.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7f6e97-cb11-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707898863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898863, "uuid": "22417f5c-10a7-45be-b264-be4da38c07f0", "comment": "Malware payload (Mirai)", "value": "fd9b9a99de6b767c2fc26025ed45a2af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898863, "uuid": "9e30467d-dda0-428d-8109-804d1012a7ee", "comment": "Malware payload (Mirai)", "value": "13bc4315988abc9cfda375f606218f3e14354ff10aa8eaef37b10e6600bf253b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898863, "uuid": "73a5219b-248b-4b73-801a-1fff4179cc4c", "comment": "Malware payload (Mirai)", "value": "7651b673a3b63453c88ec239d0818b2fa7dcb1fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898863, "uuid": "a41083af-905b-4107-8b5e-598542816efd", "comment": "Malware payload (Mirai)", "value": "151070f702b4c203c80971848948995ccca83e98b07e4c83b4adfa3e718da66fa009a344b080131df56ad05bb56edcf8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898863, "uuid": "e30bef6c-a96f-4508-b0ae-7f43eb2a30ed", "value": "T1C1E34C56EA818E13C4D527BABAAF01893332A75493DB730689145FB43FC6B6F0E77601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898863, "uuid": "d45dcbcb-c916-46aa-b115-10c264613ddd", "value": "3072:UgxYi2gojQeTWKrsRdx4KD+w/gyCeMdO7u+bnZuxy13Xnu/IM/9Vxqh:fxYi2gojvTWK4R4KJyO7u+bncxSXnIIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707898863, "uuid": "34a4bb25-201c-45ab-a2bd-4b4cf474e087", "value": 156877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707898863, "uuid": "a51fa82e-4639-4d25-8479-457376af25e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898863, "uuid": "a7c8488d-20ed-4502-97f7-0c3c2550222f", "value": "fd9b9a99de6b767c2fc26025ed45a2af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4faa77ff-cb3f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1707918327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918327, "uuid": "b09f9f9c-2959-4d2f-b6aa-9c958063512b", "comment": "Malware payload (Pikabot)", "value": "17eec7727f3a922f621ee008ed59978c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918327, "uuid": "dc1118d1-2f95-4e56-b469-1f0070ed25b8", "comment": "Malware payload (Pikabot)", "value": "144504c7c282771a26bf9a0fe0445f275bebd5f42c675f87d792513de2e4158b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918327, "uuid": "d306f2ba-7983-418e-b1d2-b36f818a3766", "comment": "Malware payload (Pikabot)", "value": "6d6757cd154f8b7cc9956181765e549d06bea8e7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918327, "uuid": "b21d5312-18bd-44a8-b895-caa52fc36ab5", "comment": "Malware payload (Pikabot)", "value": "2e518e5d86a89ee3d0e90942951bff13015d4524b63efb04544c9f8cf85a260ce76167300b46dac9c639a50019453259", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918327, "uuid": "cad665e1-a3df-40f9-b637-2469c30bd256", "value": "T1457301B35AB8D0EBE2497D71105E0DB952EA21501BF24F4C9249FAE46BFB5203F06C96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918327, "uuid": "cd596af0-c971-4582-bf13-cd2dbdcfa82e", "value": "1536:ZIzT2mLaU7F2G1PnccSWZ4Oo+MhNE9psjR5pWRR/rBlM7HkUvb/UoB/kY:w2mLr7F2cPnxSWZ4OshNESNiBeH9vb/d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707918327, "uuid": "16416c6d-cbb2-4dc9-ad2a-58182c04e653", "value": 80539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707918327, "uuid": "7179b766-84e6-4a5e-bdbc-a083f81ab221", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918327, "uuid": "931334bc-7a96-4f81-9dd7-9ad7cc34d461", "value": "UNDEU3.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901f3202-cb79-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707943346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707943346, "uuid": "aed9d1c4-4525-4519-9e78-97c58c963269", "comment": "Malware payload", "value": "8f0b14abaf77d8886a2bc8e6e212eb55", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707943346, "uuid": "b080ef38-8952-4f0b-9dfb-5a8465a8aa2e", "comment": "Malware payload", "value": "148cb6696c823effaeb1ca5c9edf5fd17524b4ee483991d6199f59295c61a817", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707943346, "uuid": "fb5075fc-1718-4545-a965-909dcd491bae", "comment": "Malware payload", "value": "d8d5ff7ac0e089eb5aba2d9fb4d55be0cbfd27b8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707943346, "uuid": "2049eb0e-6c44-4e26-8382-57809449abdb", "comment": "Malware payload", "value": "32304ebd7a2e3c7266e73c19e4b35ff2cf81dc516de86e0205e03757491d145bf07273ca4aa344001227be3c526dd375", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707943346, "uuid": "b0458fa3-88a4-4429-a155-0d606dd56b00", "value": "T1B6846BC47248585BC28A4B7FB77D959FA2B108CE87931AFD61153EC4766AF52FB30880", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707943346, "uuid": "8acbd281-9ffa-47c2-9d8d-73e11cc62672", "value": "6144:98hWx2qO+WFkk5g1nFBJbOebtdLi8YobuzVvQjdUUY3QK8RXPDyxZg:9KWx2qO+WFkk5g1nFBJbOebtdLi8Yobr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707943346, "uuid": "2f86bcb3-282a-4f16-8609-3f2c09b314bd", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707943346, "uuid": "38cd8a71-901f-44bd-9f4e-bb952d172cc7", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707943346, "uuid": "edd1e330-2816-47fb-bf70-4e404bed9406", "value": "Excel1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d82699e-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707947422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947422, "uuid": "e25f3da1-2955-4484-be55-f12ffa321d47", "comment": "Malware payload (AgentTesla)", "value": "1de2017b34b7c105e4893aa03b116fac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947422, "uuid": "53eb109c-0860-4d4e-9857-5ad78e33d965", "comment": "Malware payload (AgentTesla)", "value": "153a3eae9f938db9d8219958107df8ae6a1b51fbb32f79edaa1780aba3cb2814", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947422, "uuid": "2a128526-cf2a-4fde-8880-4d53deca4fc1", "comment": "Malware payload (AgentTesla)", "value": "c96f268c76261cb0f4f4fbd1ee97afd587512080", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947422, "uuid": "f063e21f-ded0-4b10-b5f0-23b1a5dd785e", "comment": "Malware payload (AgentTesla)", "value": "14aded902e4733aff4a7e7447419ccdf42b3b58e402af42195dfd2030816f9e37809fa53e26518029cd478a9044266b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947422, "uuid": "6dd27aab-ad78-4951-8a29-8451dc1e23a8", "value": "T18ED423B56AFCFD15A8B9CAA53C0B238620DD2D73921FA3BC4517A7D300E14ADEE43944", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947422, "uuid": "13a75b34-1254-41dd-8621-8f805a9424cb", "value": "12288:B56x9NkLecMBDMctqG6yIzHi2rQx3pe2//oUHeuQx/bwkzCeuwPyEn:B56G+BIcH6Vbi243pd/oUHpQV0e7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947422, "uuid": "280b69d3-78f8-4383-97be-e6ec2779b356", "value": 616288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947422, "uuid": "5e2f9ed8-405b-498c-b2b2-2dd7c85d722f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947422, "uuid": "ba1752fa-ac90-4ca5-8e81-21085b067cac", "value": "25934-FLOWSERVE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b47c82-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707915762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915762, "uuid": "4772ef28-31fc-46bb-8c9a-4e22d27e2a85", "comment": "Malware payload (AgentTesla)", "value": "2a8784896abc5ee4496eac507b9bbbac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915762, "uuid": "de0a5909-41e9-45c6-bcc8-21427653ba8b", "comment": "Malware payload (AgentTesla)", "value": "160cad0ef94afc46c99903f1c9d643563e696e1878b851a8ebb82c3fa9b0806d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915762, "uuid": "3e2e236a-4ad0-4c7c-aa1f-95db8fb1a0de", "comment": "Malware payload (AgentTesla)", "value": "3f77a93c04f54c790df5d8f0624350643157029d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915762, "uuid": "eb46d738-7cb2-47f1-bfca-7db3d9ed5e2a", "comment": "Malware payload (AgentTesla)", "value": "49f488a2012be8971694dad11ebd7d68aaec45272865610b69d030b76c1ff5b30769ee5112935a0a0292b234116dbaee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915762, "uuid": "9b5fc393-cee9-46c1-bb88-10d7c330090b", "value": "T160E423C4878A4812ECD4E13B229269DB7F660DCE7AC111C7ACDDA9C7D2AA5CF403DD85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915762, "uuid": "13347d23-08ea-440f-b361-44385e2d2c7b", "value": "12288:TZnnxpujyN2z9F+gb0vN7PuK+e/69ZgvJ8fWWl0SFMp/Nmb218oz:TZxpFQEljuKJCc+sMMp/jWoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915762, "uuid": "3480a89e-f512-46a3-ace8-8a8aa79af7f9", "value": 681707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915762, "uuid": "59bfa170-bcd5-4563-b9f3-4173015db9e3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915762, "uuid": "d0b7d943-634e-4a46-8585-fc705ebd7689", "value": "PO-4600056709 i\u00e7in yeni sipari\u015f.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca6b3ad-cb7d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707945165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707945165, "uuid": "edf5d9d4-69be-4a20-ba2d-df4c2f08111f", "comment": "Malware payload", "value": "0292ad9638b77a8eec28500c53495266", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707945165, "uuid": "c321b02e-cf80-48ac-af62-24c76529e95a", "comment": "Malware payload", "value": "1626880b917b7f5756109dcb6533a5dbae859ccd841554e5bdb6c602cc3a9226", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707945165, "uuid": "14236cf2-d583-4e9c-90bf-01315f0eb034", "comment": "Malware payload", "value": "b200f5730bf998387cbcde4dc6432d8b12fde479", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707945165, "uuid": "eaabcbad-20ba-45cd-a1c3-36be67e64166", "comment": "Malware payload", "value": "9d3862de147d7ee0d180520ab1ac3b92666b7f96de02d34f7c0c247752d3a331c98f1cca8d61393eeabc3f1551aa92c7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707945165, "uuid": "5cddb150-af14-4196-b8cb-85b0c68a796b", "value": "T18106AEA17DC804A5E07B03314F99FA78F16E7DB01EFE31971292F629A936D410B1C66B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707945165, "uuid": "55fb5188-a9d1-40f6-96f9-437649bcef95", "value": "607d0c9fedb370b1ce70573304bcd084", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707945165, "uuid": "c3fd400e-b111-4f1f-83bf-bce0faeafe61", "value": "98304:5wrMZ1Fm2dvuvPSyzxUY9TdxbfP4HFLOAkGkzdnEVomFHKnPh:5DZz+dxbfP4HFLOyomFHKnPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707945165, "uuid": "e41ae16b-2e80-4e43-bb2f-68c34ff20fa7", "value": 3771472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707945165, "uuid": "56fdb49f-5804-403b-81c9-c40f831bb621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707945165, "uuid": "6cf45de4-0267-4e53-a3a5-60574b538518", "value": "SH.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49188681-cb05-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707893405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893405, "uuid": "ce2aa0c3-2d60-436a-a366-89cbeff23656", "comment": "Malware payload (Mirai)", "value": "443d71fbee450a75eadb258cc48289bc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893405, "uuid": "0c76a87f-a090-4d70-bf11-b886527ff1ad", "comment": "Malware payload (Mirai)", "value": "17902d5f57d6342e500146c41e990527529a6c9de60f9674200b574445fb69cb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893405, "uuid": "dfc7b515-5ea6-4dc7-a511-89162d74adef", "comment": "Malware payload (Mirai)", "value": "a47c8c0314178d23bc23e22ac6cef860169d53d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893405, "uuid": "bbbdef79-4257-4103-9b30-7c2c997cf411", "comment": "Malware payload (Mirai)", "value": "2f1c5a81a453addf4bfc6fc46fa073972eb888df6bbe9ad3a6506e186c14ef63b112e59afc348f99732f3b142ed2e2ff", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893405, "uuid": "5365b4af-593a-4739-95d3-e28cef83e507", "value": "T11EC2E1A360B5C907C4A7827B5E3D19A621706434734DEE2E776A5FC437460E0657ECCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893405, "uuid": "151acb4f-a376-4587-8e4c-79daa41b7605", "value": "384:MsQ9WXUx5+bkbRaliVErjrL9VD9jPwrSaf5ewTvDyLTwfflrTHOBFR0j/y5ZCA+7:u5+Kcrb9VDJeC2KTgdTHOBcK5ZCAyCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707893405, "uuid": "5c8e1290-d571-4fa8-90be-a973b1df5800", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707893405, "uuid": "f469bdbf-3760-487b-902f-2872414376f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893405, "uuid": "1cbc30ef-7e46-4f32-bbbb-1038599fdef2", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7958e784-cb45-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1707920974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920974, "uuid": "f68f46d4-ac49-49cc-a583-44c41971c246", "comment": "Malware payload (Pikabot)", "value": "b3e03a1844162964a300dc34ca6591d4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920974, "uuid": "d059fad2-af1c-4c77-8436-497ddf1b24a2", "comment": "Malware payload (Pikabot)", "value": "184e53af04ff158a22facbe4499694223462bfed7d6c96e83ec1be69272348e4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920974, "uuid": "24bde435-96f7-4266-9335-767b6291388d", "comment": "Malware payload (Pikabot)", "value": "a208f340c4f1a9fa3e56204460b2f3f7ad95d695", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920974, "uuid": "f36d5c55-6a08-4ba3-91b2-029aa6a76946", "comment": "Malware payload (Pikabot)", "value": "9ad9b1d717c3044b35f1d4dfaf80e9a3a2575ad2e86c5ce8ed5ae631ded2cb84a62c142557f37b9b8ceaad9fe77126bb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920974, "uuid": "b6de5fc2-be9a-4533-bf93-270c48311661", "value": "T11DA4BE407542C173D0AE0B311974F675856DBC344BF496EFA7EC1EAA0D282C2A572EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920974, "uuid": "47f97965-740f-480b-b449-341bd2a06e2f", "value": "370ebde54530b2016d14ffc9556403dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920974, "uuid": "9e5ee941-7656-4d09-b57a-9aa6b0aa0cec", "value": "12288:v+P9B4JFF6iIJoLjIE0LO5Q23eankS0HsQBw:vHJaKE5L4US0HJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707920974, "uuid": "05336d23-644e-4cd6-8e02-58521de2b00b", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707920974, "uuid": "6a17ee6a-e478-41b5-9251-0ccaf0593514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920974, "uuid": "a37899d9-d3f1-41ff-b345-29936bd7d8c9", "value": "105482.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de704927-cb38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707915560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915560, "uuid": "74c2ffbd-3d89-4702-8e4f-e60c8d940539", "comment": "Malware payload (AgentTesla)", "value": "e13a243f7a791c4941432ee4c39f9cda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915560, "uuid": "026cd2fb-7c9f-4be0-867e-aa1aa72ed4de", "comment": "Malware payload (AgentTesla)", "value": "198ff208a336939bc2623042646023f39ef7d0d39f1eb7ec4fe27ac3caef404b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915560, "uuid": "3b17ee55-839e-4d47-b319-8a2e376b5a67", "comment": "Malware payload (AgentTesla)", "value": "4e63b192e0fd05a91da96b7a3ec93d8035fab1d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915560, "uuid": "40d881ac-4b69-4074-9ee0-048c063a87ad", "comment": "Malware payload (AgentTesla)", "value": "bfc17572ed9a67e90ef2d72c8776b7c3570b550c41db34225e93dcfea3dfeec94b01684f295425f90d1af35450aefa76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915560, "uuid": "14cc0b75-7656-40e9-a48d-a4949caed6d7", "value": "T128D42303136DB793C1BE02F6196EA6A5037081AB2054EF7C3DD8E6E153693B51AC4F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915560, "uuid": "0c94a07f-4aaf-44cc-9dde-965b78e664fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915560, "uuid": "15b90adc-c1b6-4e6b-8460-371d02e0f295", "value": "12288:CzNFDciqkVgtmk7XICZCGe7C7vSPawQKavCMZMI25VG4:C4Ietmk75Cy7bwhI7MI224", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915560, "uuid": "dcc0c22d-7f9f-45d6-b5a4-8be5ba65571a", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915560, "uuid": "db0c2680-1b3c-405a-820a-7773d43e41d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915560, "uuid": "d5ff9224-26f9-48e2-9ab7-64f2c7bcffaf", "value": "DHL Shipping DocumentTracking No Confirmation.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0604f36-cb7d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707945145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707945145, "uuid": "f76d309a-8ce9-471a-989f-e7e221f8f89e", "comment": "Malware payload", "value": "b6964fcac526edd5ebdf3265b172330c", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707945145, "uuid": "2a8aa072-98c2-4cbd-bb27-b8e22aa94102", "comment": "Malware payload", "value": "19c825e3348a7b74f041f1143d3cc3066635df04d452bdf715593fa3851b38c8", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707945145, "uuid": "086331ff-1b0e-4457-91f2-f5df5580b82e", "comment": "Malware payload", "value": "3bba0b52124490e4dd14f60644ae6bd81432771c", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707945145, "uuid": "7f2d10dc-ba58-4744-94ef-be338aab9c76", "comment": "Malware payload", "value": "f9f33f0d5b0a3316e808beb84e42c7f0dc7a048a7b8e6e31328f2bc1c59a3c9abdf38e3d305363c1cb69275a0607e4b1", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707945145, "uuid": "b71ae726-3798-451d-99e6-18ba768a63ac", "value": "T1DD43F1B5146F5C2BEA91D83D0C8E03D962107C6EC352B2DE3A68336C6182C9703E57ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707945145, "uuid": "3d2f9ddf-d178-492e-9752-6f55dc4a4fc2", "value": "1536:mAToOEjzAw7Y2r7DUsV4XzY9t3jSagJYw8TE3JnB:FoOAcw7nXDUsOjm3jTxY1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707945145, "uuid": "a1fc9eb2-90bf-462c-91c0-8514c91fcdec", "value": 57701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707945145, "uuid": "d93ecc27-dd83-462a-bb50-3302d2944836", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707945145, "uuid": "6e62d579-6435-4694-9c19-db6db91bcd0a", "value": "VOLUPTATEKH.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840ee8ae-caf9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707888350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707888350, "uuid": "18bb26da-5d8c-4459-a9a6-1707d4663734", "comment": "Malware payload (AgentTesla)", "value": "128c74791ca71718959ca82bbbf66dde", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707888350, "uuid": "6da204ea-db6c-41b5-b2e2-3600893e12a3", "comment": "Malware payload (AgentTesla)", "value": "1adc29f30b30e301acefe1b46bbbd7a4f3a76c3708ab842199e95f8f5f053244", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707888350, "uuid": "822fe0da-4621-4a85-9d87-988f7f775cb2", "comment": "Malware payload (AgentTesla)", "value": "efe185037a74f5f8ea08915eb98079cf2dfa29bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707888350, "uuid": "ef945148-2cea-469d-a54e-06b324a4b587", "comment": "Malware payload (AgentTesla)", "value": "9af9ef67f46f937dfa8627ab302bea3513a46ddb4e05355d6b0292d401d0c88db16a79a7994867f61f44d0075e573bf8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707888350, "uuid": "0ce040c0-7c54-4aa4-a0d7-92cc1f27fa7f", "value": "T1E4F412163397CC8FC5AF49F6107090D1F3B521EA3961C7CD5E98A0AC0EA6BA353857A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707888350, "uuid": "cc03979f-50d2-4f92-883b-d596e3a234f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707888350, "uuid": "abefd15d-dee0-4273-83c5-33ea367d80ce", "value": "12288:16pzN6j+hcPTFJNmvWfRFBVDTmEgijux07DLUBU5QGe7WJE9f2M6EoLZUGjmqepT:16pE6ymvWfRFLfDLJe7Yqf2MknGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707888350, "uuid": "6b3b52a0-6c01-4fa8-a03c-385d2206297b", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707888350, "uuid": "a8139b19-ef37-4d33-866b-46f0289d6111", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707888350, "uuid": "1baf73d1-6fe6-43af-88db-4f7423ba457b", "value": "SecuriteInfo.com.Win32.PWSX-gen.23795.4587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63242b8e-caf0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707884429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707884429, "uuid": "13bc0bbf-e515-4464-96ab-43ee86553274", "comment": "Malware payload (AgentTesla)", "value": "ed5930f4658fd7b3173fc77650446d07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707884429, "uuid": "b1f0e1c3-aa30-4190-9978-40a70dcdc660", "comment": "Malware payload (AgentTesla)", "value": "1b145595fb003727cf021147e41a84381589db8a7f5c1f4c712d5586730ccb56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707884429, "uuid": "2a09946e-80de-453b-9a16-a544368a9629", "comment": "Malware payload (AgentTesla)", "value": "b6ff66ef734de3709a2025c928d62a66d3f0a9f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707884429, "uuid": "1519c36e-63ef-4983-bd8a-7dc62826923a", "comment": "Malware payload (AgentTesla)", "value": "fbf4c525ddd7e055b0adfe40ca437ed50e83006284112e57da6be8a45483291b33da6577fac861c7e202b808f5c8c119", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707884429, "uuid": "d55663d9-1cb8-4fb4-862d-f9bdf3c97360", "value": "T182F4125273F6E81FC96E1AF7143250C193B2A6CA3A72CBCD2E88B19C1DA0B975344757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707884429, "uuid": "06a4cacf-7624-460a-9d51-4d90835c2b14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707884429, "uuid": "fbbdee25-2316-402f-ad67-0fb01c3cd121", "value": "12288:C9zN6stYY2fvqwZoRarcnwc97FSZPvp2jUeijB89tZOCUc8UZtUSNQmqepT:C9EstYYsv5o2cwcRFSZPvp2jLijBER5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707884429, "uuid": "58a2d18b-3aaf-44fb-91df-da0133bbd2cc", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707884429, "uuid": "9ccf2657-21ae-44ac-bfd4-19ff26a0b342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707884429, "uuid": "491aaabb-fbe8-4125-9ce2-ae0d2143dd3a", "value": "SecuriteInfo.com.Win32.PWSX-gen.13039.2563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2a055d-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707915771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915771, "uuid": "82caf297-5f01-4bc9-8cb7-70489ea34bd7", "comment": "Malware payload", "value": "316a1531bdba25ce561de92633b75335", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915771, "uuid": "3233e01b-950e-41ce-8e00-28307ffa9b27", "comment": "Malware payload", "value": "1b42da5f97c0ce7cd09ea9b3ff232eccf7b117a6164752be1f87250b0f547f92", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915771, "uuid": "5f2829db-d1f1-4c1b-88b3-2891ceabe5ad", "comment": "Malware payload", "value": "8922cd08274fe7ed8e425e8942f923e7c1e17d3b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915771, "uuid": "7ce888d9-68f5-4e03-bfaa-f240b5ab0559", "comment": "Malware payload", "value": "1eef94dbcf7093890b0a288d4735e20d879329ee67c68dbf0c5a417f7dcd3e9ca4f0f164208407fc9727b7913ea4cb06", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915771, "uuid": "76e171dd-c275-4d19-a5f6-8db3c0815c22", "value": "T192E15B6D81B00854C78AA039D350BC853777F9814267071B7670DB6E59B6BFA4BEF218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915771, "uuid": "283f1c5a-8da9-475f-9080-9f81e7c66146", "value": "96:X118CJwPZ2Om2MhVVCvkwQEeGIRf3UNaa2ZUkqWUgYjqWUgvI1Hy1508YuL9FrQU:s7PZ9OV8vdQjmlwvAvvRZYuHrZgYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915771, "uuid": "9ad64b8c-9c82-41e3-84a6-58c8a71f6d9a", "value": 7185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915771, "uuid": "784013f4-8ca4-4941-a396-805aa2f760f1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915771, "uuid": "43cf99c4-7a00-4a9a-bdbc-fdfc3a6fb49c", "value": "Purchase Order_NO3682720.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17e2e3c-cb60-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707932772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707932772, "uuid": "8e769fe9-a28c-4d1b-8a77-fa12db6aa0df", "comment": "Malware payload", "value": "24feec53720e109138b26866d5e4abb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707932772, "uuid": "54f89836-deca-4b86-84bd-833f8fa9b720", "comment": "Malware payload", "value": "1bced0780c8ddb4de36834b608dde54a0b1cc79c740e566faa937453403999a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707932772, "uuid": "9b2216e8-82e0-48db-9200-bdb96c2fc88f", "comment": "Malware payload", "value": "7004b5c86332c19075360cdc2e3a60818bb31ed6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707932772, "uuid": "a785ff3b-8143-47d5-beca-b248d84a20aa", "comment": "Malware payload", "value": "a9185e66296bdb31df6373bbe65107358a6737aad9bc972f442657d6e9ff1f9119fe61107f2690ed8e44286fd679c982", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707932772, "uuid": "b2c00f32-2abe-46b5-882f-78070f7d13be", "value": "T14BA34A2456D5C031E60365B58668C3F64EAB387A71A2FDCF4FD798711F286A2E31831D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707932772, "uuid": "abeaf63c-44b8-438f-8b4d-52460e5f0eba", "value": "1536:uskWKeCGxXtGK4A48f1jCZW5993WiZA6lM8g+iRwVD7:ufWRCy/dqG9gUvXg+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707932772, "uuid": "9fb2c386-51d0-4f9c-9cf7-8723636e7eae", "value": 100767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707932772, "uuid": "c05fbe20-86f5-4bba-bab1-22763deb6731", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707932772, "uuid": "9eb69913-9ba4-4596-85fb-389b33cc8fab", "value": "24feec53720e109138b26866d5e4abb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc852f84-cb3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707917677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917677, "uuid": "441d46dc-4144-43fb-adb5-10cb6d3046c0", "comment": "Malware payload (RemcosRAT)", "value": "45e4f0077714e12a942fbd50b92278ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917677, "uuid": "2b7dc64a-ba99-4047-8ced-853385d813ce", "comment": "Malware payload (RemcosRAT)", "value": "1c127eebd7d602e5dfd453c901c61d4f41304eaeee33d2aca87db7e08b0a6292", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917677, "uuid": "d40427ba-d3c3-4b92-9b19-ec83e500883a", "comment": "Malware payload (RemcosRAT)", "value": "c6c357965c1c76cb5eece9f8026bc311e6107346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917677, "uuid": "c6f6798f-da78-4a48-9a0c-b967b088ff2b", "comment": "Malware payload (RemcosRAT)", "value": "b977412ec656b6007d1aec5d07507cc405b8966fb9d3be8a32f4cdbc3841d6300d63e79d1fab2fc841d99e58335da4a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917677, "uuid": "30c7155d-76ab-4625-b8b6-c4c009b24723", "value": "T120152371A3E70B29C2254FB74ABF564347074A8F11B5E7AE1E88EDDA74FA3026024717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917677, "uuid": "fbd80786-c7eb-4c4a-982a-e04a386670fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917677, "uuid": "c25c3cf1-45b0-4e37-b876-ae6ec1419ef6", "value": "24576:i4SZJVoqutiR5MZGKVhYGkLlw8DOHs8p:FtxZGK/YGk7asS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707917677, "uuid": "c7e8d9dc-f222-4425-8946-7256b35d8773", "value": 885760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707917677, "uuid": "291bf0f5-2af7-41ae-b29c-ee5358e062db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917677, "uuid": "0409deb8-ca77-44fc-9967-fb40abff59de", "value": "SecuriteInfo.com.Win32.PWSX-gen.20579.4557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d31add-cb45-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707921126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921126, "uuid": "69a6c617-22d3-41a2-9955-27002184759e", "comment": "Malware payload (AgentTesla)", "value": "b968ec51644f83b7b0b1f22930902f19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921126, "uuid": "de51fe19-6ad1-487c-a8a9-0ee3277018aa", "comment": "Malware payload (AgentTesla)", "value": "1d3ef5b6a9660f6aded708492a040af0fc5021d457b6fa77ee760d20c6c0f395", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921126, "uuid": "b76febb4-6b02-428a-bd33-3fc4fec5026a", "comment": "Malware payload (AgentTesla)", "value": "b0024e7299d5d762dbeaf63ad2ef081c70051162", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921126, "uuid": "52bd3e01-8edf-49af-afbc-c25b0c32a84a", "comment": "Malware payload (AgentTesla)", "value": "cdd3c59a4aa8157e31fc882015110d3147953818d5066525fdbb49730ba465bf38b5389fbd8825f307c557c7857b3a24", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921126, "uuid": "252e40cb-3c85-425f-abb9-ee9a4279dad5", "value": "T1CB15F06AF340953CC6391E36F09A97F743B98EB7D104DA1B1AC4F59C7A3939E01492A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921126, "uuid": "27bbcf81-e9b2-4c04-86c1-b528a800d3b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921126, "uuid": "8efc3615-41bd-4a40-8e09-3b4501da7030", "value": "24576:qFoayl/koKmz/Fodu2gzUISyN5fKlv/J6:qFoaypAmzWQIbmZKlvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707921126, "uuid": "4c6f1a12-2e7e-4f7b-91cc-8db18d64f563", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707921126, "uuid": "3a73cd48-ab36-4f81-945a-5acac1673872", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921126, "uuid": "445952e2-83fa-4dd2-8e16-c1d33b170ad0", "value": "Rendel\u00e9s K290821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f9a8b6-cb3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707917713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917713, "uuid": "e5530dd0-2e09-4221-97ce-7c19c52fe5e8", "comment": "Malware payload (Formbook)", "value": "cd8edca1396524d51a71ca38b7f5273f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917713, "uuid": "45d17e2a-36dc-49db-bc88-f81c12f727a8", "comment": "Malware payload (Formbook)", "value": "1d5692148172354fedfed8e9e8f368a59a8c2c6372c7885e80087d9ba5ad76c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917713, "uuid": "c7c0ce44-7fd8-413c-9adf-f229758bbe8a", "comment": "Malware payload (Formbook)", "value": "d8a092cd9c6d4034e1dae4c850169e38ba46ff7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917713, "uuid": "accee955-75d3-4ba8-99ee-b133c4a59756", "comment": "Malware payload (Formbook)", "value": "2a17a506ac8780388e0d37a035de307466b0c548b7ed6656f01ca52beebdc0d5e756feb191959ddbdd036e9ca2fe1a2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917713, "uuid": "6d37ead2-032a-4d1b-af20-365f24c032bd", "value": "T1C4D41220129CE3A3CD1913FE5853174A63F6A3BBBA91E6CABF04145D4DB3B07A741267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917713, "uuid": "f90f5f19-192f-4d08-95ac-dd8fbb014a7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917713, "uuid": "96b7668a-cd5e-4608-8a20-635a18e4cf63", "value": "12288:5ekeQ5vziy6BQgKPZn3HB78Ujj0nGDRql6w2lgHiKeee9JMALH/6V6Cs2:5ekriy6CzB3CnGo/CKeee9J1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707917713, "uuid": "4372c975-7b5a-4dec-aed1-58f130eb7e2c", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707917713, "uuid": "f186fde8-f930-4556-bc5d-acd07f711d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917713, "uuid": "0257e9cd-0b5f-40b1-b238-0211de86e919", "value": "z2______________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84453cf-cb14-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707900088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900088, "uuid": "7c7c2ca7-867d-48ec-a69e-497b3e60cf0d", "comment": "Malware payload (RiseProStealer)", "value": "942e0c660c367fe63d150e2d87a35915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900088, "uuid": "621f751d-17bb-49b2-b81d-7ec53eff95ab", "comment": "Malware payload (RiseProStealer)", "value": "1d862fe2cb9f69616bb0f6e8ab1c5519263b2914708fe76aec93c90f407b1823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900088, "uuid": "8a716d66-2da3-4eeb-b60f-3d24d3890df7", "comment": "Malware payload (RiseProStealer)", "value": "fa7c8c08b88b5177e289e4071211c020abc431a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900088, "uuid": "849f0638-9c4b-4cd6-ac7d-c1bdd88bfc06", "comment": "Malware payload (RiseProStealer)", "value": "82eddefe1e87412964f130982a36635a1e5ace896eef0a65d5b1be0e2f7f671496ecfbf6dc0e548d8703138406b5840f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900088, "uuid": "55b35943-2fcf-42ff-9973-bf54147da452", "value": "T15A6633536E45C49AD14962385966FB7CF5712FF804374103F878B78FAAF1A623A3A063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900088, "uuid": "080fbc76-27ef-4438-9609-0d2460ef823c", "value": "b8a1a21d6eadad214c544e8876c5812a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900088, "uuid": "c8d5c96d-e6ca-41c8-be43-f955a952b512", "value": "196608:hY3q5r7M9iBbl3bz0mtCPGMzyvKqCq7UJZXgL:cc7M9SbNbziGwyvKq7I4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707900088, "uuid": "cb83220b-973a-4c2d-a291-6d02e5ec6e07", "value": 7002200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707900088, "uuid": "43a926e6-23b1-47d3-8012-b1a42c42b91e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900088, "uuid": "0aee4510-3198-4f60-ab94-13305a6197b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f9620c-cb09-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1707895408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895408, "uuid": "39c49abe-667a-42a0-af73-490dafed2c7b", "comment": "Malware payload (DBatLoader)", "value": "79fb5d4ea572f782e36d05df71607a72", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895408, "uuid": "9d1e5869-eac4-45d4-b038-5fc9bb955d40", "comment": "Malware payload (DBatLoader)", "value": "1e3c9eae95d8470d8549a9590e17c232f3dff7c0cb9de0bcdfa0028ef7bdff7a", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895408, "uuid": "ad1c3f05-3969-4fa5-a83f-1399d305c92d", "comment": "Malware payload (DBatLoader)", "value": "0ce15eba6d4876d96f623088303ae0c381059bd9", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895408, "uuid": "3c5cdc2c-06da-40d8-8ea2-7e17652e418a", "comment": "Malware payload (DBatLoader)", "value": "fe7d960e7809ef8dce3e45f96b937b272a02cae141e9f3ef355dd5c6ff2482eb60ed9e141b959500a282cfa4c9c85c51", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895408, "uuid": "3d9af1c4-3525-45c3-b9b5-736e103dc58d", "value": "T15455BE3A64616CBDE03F213D4B26A6ED7D6DAD71BD886C021AB459CE0F781413B0D39E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895408, "uuid": "0525252f-75de-4eb3-9106-022cf397d3c6", "value": "24576:Zv5YNbmkjT2ldxxUmup3FjSZpSInhCLxr6GLHpAIsMlUSiPV6DF+:ZvjpthYxrpJAIoS2V6DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707895408, "uuid": "4406c649-ed92-4996-8444-cb1f45842478", "value": 1390563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707895408, "uuid": "d3631822-63ff-4e91-85c6-e47b7e8daf27", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895408, "uuid": "07bb5289-70e5-4553-9601-e0f99d1590f6", "value": "GIAC-14-02-2024 704439.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf402d0-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707915745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915745, "uuid": "2ee4720f-c218-4e09-9889-77664347fc3c", "comment": "Malware payload (Formbook)", "value": "1f55fe4ab2875d35c58c4c43b46fc2db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915745, "uuid": "5bcea041-826c-4aad-8d6d-03a5c08d1bf8", "comment": "Malware payload (Formbook)", "value": "1e8674c7af963d6734bab4fde6589bb98e24a6887673e1d0fb40ce0c93dfb181", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915745, "uuid": "65282d1c-2b9e-4328-b3ed-3c7150d9f182", "comment": "Malware payload (Formbook)", "value": "a5a049eef7dc45da32747af6dd576d60b1fc6f68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915745, "uuid": "87097081-c114-4ac2-b535-d3612cb270aa", "comment": "Malware payload (Formbook)", "value": "908529dc4282ed0bc7e67eac1006f3267dd51c06d7dd5104e854348f8253df04ff2fafae6b222f7e739bf93791b3d018", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915745, "uuid": "8657bdeb-1be8-42a1-91df-c018b7c61be8", "value": "T149E423513D7C9326F89E83FC5420584953F6726951E1EADAADCAE0D32EA6F110230F9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915745, "uuid": "8eefcb89-23a1-47b2-ab74-40382f3a871c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915745, "uuid": "6712ab5a-9561-46c6-aaea-f34d8bd225db", "value": "12288:RiD2XaluR3ISLEzE1TdPSGJPiaElDvkNkq0+/fFuidktYSDR/bPPc0I8AdRm3U+:luc3ISLcE19dCDvkd0+0iyYAR/bM0IhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915745, "uuid": "f55d551e-c618-4cdf-90ca-d820d4208708", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915745, "uuid": "064f20d5-4944-44d0-a3f0-099664d70278", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915745, "uuid": "b30f2855-1b74-4175-9966-340c901b84f4", "value": "PAY_INV_1011031923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448115c1-cb37-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707914872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914872, "uuid": "3cb3d586-fb57-4456-9f8f-90f195df9c2b", "comment": "Malware payload", "value": "5141ef1380d75095ea30fd114b125e38", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914872, "uuid": "a08b48e5-270c-4afa-a42c-0d9090f91615", "comment": "Malware payload", "value": "1fb21e90551a14d56800b435ba496f9965c3995d5b02481c50b27c4cbfdfea82", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914872, "uuid": "73a98a2c-d3e6-4b4f-a610-25718bbc203f", "comment": "Malware payload", "value": "1ce1f5ca95360729da1a1f09ecc19306897de268", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914872, "uuid": "fb6f28a7-e3db-4491-a5dc-bd320dc9b45b", "comment": "Malware payload", "value": "fc9163c4fbf8f67473b996cffd37e61e6b85bcf06810a192c073a494a812c5c5235a2fdfbef3e3c999a1b524d6a98d19", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914872, "uuid": "616c5579-31c7-4760-8306-5f4590e84491", "value": "T1B7C601A03CDA0026F0AF11716AA9FF79E12F6F722F3525535150BA19FD322436E14F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914872, "uuid": "985f0a12-1bbe-44e1-8d21-55b360f5a0ce", "value": "607d0c9fedb370b1ce70573304bcd084", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914872, "uuid": "963e8ca6-1576-4e82-abdc-82da8e296ef2", "value": "196608:XWx2zpdra2YbT8yN+8Mne5nd7g25FjZC8OH7RbFd/Or+GvJbU9RDf/kuFLOyomFI:XYCrdiNTF5nZ9C8Ud29JuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707914872, "uuid": "802aa270-43f7-4ea7-a276-13465912ed19", "value": 11922432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707914872, "uuid": "3c3c5c6b-1c3b-4d8f-ac73-6822e4d26a04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914872, "uuid": "a0be5e92-6f66-4702-830f-44ca10d9a587", "value": "resources(2).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca668b53-cb3f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707918533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918533, "uuid": "398de6b8-5cfb-4585-b947-d9e9d0011b0c", "comment": "Malware payload (AgentTesla)", "value": "40481437ab27f01ff888644faf6681c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918533, "uuid": "304dfb44-a6f4-4aeb-9648-7bb350993681", "comment": "Malware payload (AgentTesla)", "value": "20cf4c65d87c78a7f04664974de125697792c6381d028ae32ec275294edae5cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918533, "uuid": "f004e720-1ad0-4eda-bbf2-35394b6ce45e", "comment": "Malware payload (AgentTesla)", "value": "024028b85e5be0f8039a17f3ca29de6421503d52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918533, "uuid": "1def257c-5e25-4541-995e-6bfb34b9ba9c", "comment": "Malware payload (AgentTesla)", "value": "e1f262670f711b4eedf0182817aeed11a0c66ad83d103510e8cca23ae750311a312dab61eee5811d23996ff2e12b7817", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918533, "uuid": "907b9b43-ded6-4633-9102-7bc8160635bb", "value": "T1DE05AE24B3F91619F1FF0B7BB5B1042646BAFE06BD42C74E1962569E0C26B80CDA1773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918533, "uuid": "3284c776-fa81-4988-9904-a2b3ad557cbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918533, "uuid": "49f69903-26fe-4838-8af9-d3809da70402", "value": "12288:Se69UNW+A0Bc+T6r/TdJd+AReS4wN+H/Qzs+vCMeJaAAS/BCSUolq5Ic:Ser5y/TdJoAn4w2hJbAGkSUoMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707918533, "uuid": "7bb8fe60-1d69-49bf-8b4b-c8e4dd4af854", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707918533, "uuid": "46d0c2bb-95ab-4190-bd86-0855cc7e9258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918533, "uuid": "8497bff5-cb9b-483d-b654-72ef8fe257e6", "value": "40481437ab27f01ff888644faf6681c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d219f1b-cb12-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707898915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898915, "uuid": "ab441c3a-5c30-4633-b1d8-e4870f678fa5", "comment": "Malware payload (Mirai)", "value": "b7cc095062e2ce83fca2791e7b0a12a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898915, "uuid": "11cf2807-2373-4b25-b78c-d91e11f12335", "comment": "Malware payload (Mirai)", "value": "22187f2db8dd7b8faebbc0809208a096fc912c7a5301c4a30f31ad0739952606", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898915, "uuid": "41d69f4e-8c3e-46ae-8463-d7bb9f2ae94e", "comment": "Malware payload (Mirai)", "value": "13d140761cf3f58e82d8936a4f117eb017b89485", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898915, "uuid": "437b2b6c-9cde-4daf-bb18-b58dc4a211ca", "comment": "Malware payload (Mirai)", "value": "054998cb50df408c0897ba770028d7eaa2c7a3ff07ed6143e38df2b76c1b915f3aa5cd91266439fc29d0cd79e60fea87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898915, "uuid": "b7c58003-dcbf-4c38-9d69-fdd0689fb9ac", "value": "T1D7A3C71E6E158F7CF79D873447B78E219688338B2AE2D141E14CDA015EB028E741FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898915, "uuid": "7d8c0102-4428-4ef5-aa34-8e8dfb9f4508", "value": "3072:pqunD7x7p9V7Ebcr/kq6dH3faIfaazOBCHM:pqunHtp/V693S8aazXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707898915, "uuid": "b24eb710-ed81-4769-997b-bf78cadbcf83", "value": 101132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707898915, "uuid": "c6a466e3-3f0c-43fb-9068-7f11d106d510", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898915, "uuid": "fe4b629e-b903-4cf3-9c7c-033b7669a39a", "value": "b7cc095062e2ce83fca2791e7b0a12a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc27591b-cb3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707917650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917650, "uuid": "2f23786b-e865-4a6d-89bb-4fa02014197f", "comment": "Malware payload (RemcosRAT)", "value": "b6fc590bc1f6aee015b2db72f9988c8b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917650, "uuid": "8b224807-4538-442f-a7d8-b2b9f6e496b7", "comment": "Malware payload (RemcosRAT)", "value": "230ebe29cd35888b7bf1688d9108ef8ad4ad3a0d3d162aa6b33c6d6587d836d4", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917650, "uuid": "cf8f3bcd-803d-4f2d-9fd8-74a950ef1ad3", "comment": "Malware payload (RemcosRAT)", "value": "76bd5f1a7203d96a86e4a89992b4d2bd5069b9fc", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917650, "uuid": "5f8f911a-1980-44d9-8593-4880e87a3399", "comment": "Malware payload (RemcosRAT)", "value": "1683ca6b6ed8d46f8999026140d2f44000c0538975e26239ddb89d8f1d3ad8e4779ab7f8cdce04e369f23d0a7abcd0f9", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917650, "uuid": "456a68d6-00be-4a45-a940-4aa5a9867658", "value": "T1E2D4239897C2DBE5A94643D9DEE2D0E9171EBA3F521E898814C0331274C622F6DFED07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917650, "uuid": "1b64c716-b312-4701-af3d-27ed3db3ee31", "value": "12288:GfSecO/kRyZHlS0rrcM1Xsvw5Kq3gZSpZYyUvfskOp:Gq7uOY8811XDYxZSpZ58fskOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707917650, "uuid": "b455b1e2-3aa5-466e-9f36-ac78c54ce4da", "value": 625944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707917650, "uuid": "f9d11447-a20a-4d65-abd9-9c713f7c0b74", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917650, "uuid": "018e3e8a-25ea-4206-b5c1-7294679757db", "value": "nAWB-RO-202644066004734534543534534563456784576373.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba3531b-cb05-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707893356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893356, "uuid": "d50628fa-6570-47c4-a573-d64aedd28e84", "comment": "Malware payload (AgentTesla)", "value": "24388da0b9ef417ad8eb437dd258cc97", "object_relation": "md5", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893356, "uuid": "26337908-90a4-4f01-840b-58e29a1f93fc", "comment": "Malware payload (AgentTesla)", "value": "24874c10c2ae2c600b97c36f6ea0a6837725a9da34d3f73de7206db7c3c62102", "object_relation": "sha256", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893356, "uuid": "35d826b9-eeed-48e9-b4e4-0ba119bb8a06", "comment": "Malware payload (AgentTesla)", "value": "daa55abcfd96ce1742dfe2e6a2259cd4dcfdbba0", "object_relation": "sha1", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893356, "uuid": "3ed4896b-77df-4cc2-8eb2-d787fd363313", "comment": "Malware payload (AgentTesla)", "value": "9de44c02a97bd4907c124405a2d32b92008840f0c2208a3f83d860bc5426d067293a0b502da397b994f35790dd335684", "object_relation": "sha3-384", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893356, "uuid": "0020c234-6105-4ce8-8b33-5282392c17eb", "value": "T1DA92E1271294ED212704E9BB1476680C0639ADE85090E7076B2C2CDB507E83BB7DBB34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893356, "uuid": "83f0a1c0-5835-4df7-9510-b4cc86c01e67", "value": "384:3xDnR22ofLEELWIpDAuy8PEOwI3AX4aT1SX1YZrCMw8f8epTCL5D27:JR22ofIAMF/h4Vut48VTCL47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707893356, "uuid": "5e595b94-e1c7-4c8e-9a79-cc50f3f5ebc3", "value": 19836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707893356, "uuid": "4314fe76-74d8-482d-8eb0-d36dc7f08b40", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893356, "uuid": "3befcb4d-feb0-44e5-b105-f1c6189a2bbf", "value": "RFQ.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5541e5e-cad7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707873884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707873884, "uuid": "6b6ba004-39cc-481c-9c5d-3e967fa6b3d9", "comment": "Malware payload (AgentTesla)", "value": "410e187db30108a114d08cf587f7bcb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707873884, "uuid": "7fb5d581-e1fd-4633-8d4c-a6a10df4d4b1", "comment": "Malware payload (AgentTesla)", "value": "24d29087cd9eeec19d7ccd087f2a7d6bb33a1c8cad5519b6e399235e7d1f39b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707873884, "uuid": "b2e2c5e4-ff70-49c6-b9be-611156e86d39", "comment": "Malware payload (AgentTesla)", "value": "1f9d3ca98752e68bd957848dab90b2e6e5d9cc0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707873884, "uuid": "02530b1c-beb7-4cb6-8203-a737ed855be6", "comment": "Malware payload (AgentTesla)", "value": "ecdc4b9e9e68fc9d87a20e28e1ef2a0d0b7287aec66711a71e0d7690a7b4645e6158c1f38e4d5011cd835be43d41003a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707873884, "uuid": "42c1360c-1f23-493c-9f23-425f2d73f9a3", "value": "T166E423193E5803A3E9AD8BFEE03518C64379426A5D52EB97EEC1B1CABEB5F814401743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707873884, "uuid": "caeb6978-497b-445f-83dd-289319fa4d09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707873884, "uuid": "780e3984-989c-4256-ab5c-8b9e41aa570f", "value": "12288:AiD29xlub26F8NZXF+4o8DBXGEF7InAc2dQSv6+CwMjpsAV:OPw248NVFJEVAc2dQF/zH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707873884, "uuid": "1c625f27-77d8-4d7a-8444-1d972c248283", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707873884, "uuid": "71468384-ad4c-40fc-9d70-80a815ac2370", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707873884, "uuid": "21eccc00-90eb-4885-aade-76a2ccd6c70c", "value": "SecuriteInfo.com.Win32.PWSX-gen.4085.9395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3de53b-cb12-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707898890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898890, "uuid": "e41a994a-0bb7-4a36-9eb5-9b46ac81bb85", "comment": "Malware payload (Mirai)", "value": "926c4d6271ff789f1b7869fc177e499c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898890, "uuid": "3e56bc88-f17c-4c6e-8802-816afc89e297", "comment": "Malware payload (Mirai)", "value": "24fd0b5356f7ee751cc3a2746ea6da9a273e5771c6b9708a146f38b766f63ce8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898890, "uuid": "1aa50fa0-9a55-4c55-8e50-a1379b9a65c3", "comment": "Malware payload (Mirai)", "value": "2159fc1cc9637faa0eb07ba90c92f7f8036b0cdf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898890, "uuid": "25ad6815-7482-490d-80d0-bbb023cb8461", "comment": "Malware payload (Mirai)", "value": "32c8327c9aaae4f14e2e775d73630168f436233745da4724f4f73090753ac3f6b8b7f771d94daf878c5cb300510ed438", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898890, "uuid": "c4ba320c-3fb3-4175-b777-b7b855a06d33", "value": "T116735CD9A8025D3CF85BE6BD94220F09E924231557D30F2BE5AEFDD36D731689E02D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898890, "uuid": "b71516ba-4f0d-411b-8cf0-d434fb13c2ad", "value": "1536:jvXzeOyllm0KfPKizrqw6agTLfKRslO8Ad:jvjeOyODV6w7PROO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707898890, "uuid": "f1dc4c1a-8e7b-412a-a485-d09c74a7e246", "value": 78808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707898890, "uuid": "b912c677-79d1-474b-b52e-dd34707f3f63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898890, "uuid": "f91a265b-e19f-4b3d-96b5-deef1931b7e7", "value": "926c4d6271ff789f1b7869fc177e499c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb458ba-cb37-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707914858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914858, "uuid": "17178295-63da-44e5-a184-2e2fcbc53dac", "comment": "Malware payload", "value": "557e38be6d80bb2538307cc20e4a3161", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914858, "uuid": "2476afe1-612c-4be0-b114-186607489fe2", "comment": "Malware payload", "value": "266759931f0c5a0621f77438f87ec57d1fa373b0d2102b477922665224144eb7", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914858, "uuid": "31363a44-ae0b-4228-800d-654de6eccc41", "comment": "Malware payload", "value": "d41313b03dd208a3b80524fc22f5f57810570547", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914858, "uuid": "8caa8138-f4e8-4f9f-afeb-823c5ed0ffd7", "comment": "Malware payload", "value": "8b85e52f1153236fc364bba9a1e89e53e3e3b6cc53fe6a9eab67bf0d8e3c0ba3e96f304d3f68c135297c492601cb812d", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914858, "uuid": "e2765e8b-bec3-4d5a-8608-3c0456044243", "value": "T185C601A03CDA0026F0AF11716AA9FF79E12F6F722F3525535150BA19FD322436E14F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914858, "uuid": "f82262e5-e977-4eb9-b604-fd8c743e8f2d", "value": "607d0c9fedb370b1ce70573304bcd084", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914858, "uuid": "7a96969f-d654-4583-a33e-ad5527bebf05", "value": "196608:OWx2zpdra2YbT8yN+8Mne5nd7g25FjZC8OH7RbFd/Or+GvJbU9RDf/kuFLOyomFI:OYCrdiNTF5nZ9C8Ud29JuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707914858, "uuid": "537b723d-02dc-4a9f-b222-5fd130887b97", "value": 11922432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707914858, "uuid": "e487547d-4826-4838-a514-acbfa74d7a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914858, "uuid": "b7fd86bb-022f-4f16-851e-94e7b66c67f7", "value": "resources.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522e0b68-cb34-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707913607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913607, "uuid": "9b5ff1d5-1665-4eed-8d8a-8391f7f10c96", "comment": "Malware payload", "value": "3f4866581b216d123bae8976c59abe06", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913607, "uuid": "d08a7604-cdfc-4139-92af-514ea0667009", "comment": "Malware payload", "value": "27627967ae77b1def1e0c6756e6eec9e17e1e713940726934b20690ba912ff4e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913607, "uuid": "60f4cbcd-13dc-4625-8cf6-25593ceaee73", "comment": "Malware payload", "value": "3d64468b91e7ce950a0852126feba4261c021985", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913607, "uuid": "e9b63cc4-20de-4dbe-b709-7e90e2cb619f", "comment": "Malware payload", "value": "a4eb5db3854e1bc0e9a96336d2d3b469e96f8e5059b69a101e746d5fe1eebd0038d17ad11c2a39f790829bbc17fd9014", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913607, "uuid": "f3617f31-bb40-48cf-84f4-cf1a3b3567d4", "value": "T16F859D789A9239D6D3B9A4C8C02DCDC5CEA1BC4FB120EA09BE59717628BB473C7144DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913607, "uuid": "67f20338-d1f1-4239-8b9a-1da0d91345ad", "value": "24576:ibbzU4JA5g17ST/0F1tjX48FSYlb+7jx9N29q6SeR6:inBA5g1uT/G1tjX48hw7jB6F8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707913607, "uuid": "0d6071df-770e-43f0-bdb3-3d5c7f10fb6c", "value": 1791237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707913607, "uuid": "147a37ff-76b7-4f86-b363-0f8d648daab2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913607, "uuid": "84997c6d-d498-486c-b5a1-abbdb5bbb0f9", "value": "rPO1_Invoice993.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad4606b-cb10-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707898025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898025, "uuid": "373b7df3-90d3-4362-9b75-b0752de1a2f2", "comment": "Malware payload", "value": "414dc8f2a956e86f977585ddceb3f187", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898025, "uuid": "d4408c3f-0158-4be4-ac05-0c1f67616a3a", "comment": "Malware payload", "value": "279b8268105eb73fb5686d35b8fbc949c91ebef88bf66f9e476730db7484397d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898025, "uuid": "1b638fe1-5eb3-4d5e-99d0-c70af54b91d5", "comment": "Malware payload", "value": "3bb620b24a8ac373597b5bc52ed27ec83205ddb0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898025, "uuid": "203613b2-7f2c-4e28-b067-c0e8c43d7956", "comment": "Malware payload", "value": "90eeb69deb10caaef8738587d102eabb66111ba424cbe5729ab11aa86faefd4e7bfbd8da7c4240685a0aa268bd3b518c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898025, "uuid": "fe34f7c6-6474-40f5-b01a-9ea86fbac49c", "value": "T1D0F09641A7F40710B7B35F146D75606946BB3E975C35C25D0390084E19F2A04D8B5BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898025, "uuid": "94bcc76a-8b0d-4a32-9678-a33b784272b3", "value": "12:QvE6odCKZWYlO+iMKdlgpF2MKYT819ot5k7CFf8fEl11l:QvADkYlO9Zd6L2Z9a0CFf8f6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707898025, "uuid": "e6647074-1099-4f73-a16b-3d37edee9329", "value": 598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707898025, "uuid": "8afa3043-367d-4186-95ed-b91ba7c81eb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898025, "uuid": "521ba551-0ea1-4bf1-98c6-01047e1fc3e0", "value": "Purchase Order PO0193832.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdde684-cb1d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707903854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903854, "uuid": "e3ff7248-d969-41b7-8a9e-615a2ca0d24e", "comment": "Malware payload (AgentTesla)", "value": "5503fde02b7addfff0657f400503480f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903854, "uuid": "91eebc63-47b6-42e2-8b02-03fddf0df936", "comment": "Malware payload (AgentTesla)", "value": "28800f5eb9080db8e444bf6dc373fc40240c9ef640974879e9b09c9e247731e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903854, "uuid": "3ec9ee98-099d-4098-aa27-4e953123bf72", "comment": "Malware payload (AgentTesla)", "value": "06ed8b6d6ea1306b38e8d5164d40886eb8905043", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903854, "uuid": "302c5f59-42dd-42e2-a30b-6bd604c66a2b", "comment": "Malware payload (AgentTesla)", "value": "bb1f00bf9783113fa99e88d77c8c0710e6b7c1aa73b16d3dbb72d6d636f829b5408ae54cfda75f1d997a3de730c7b612", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903854, "uuid": "cd6e0d91-dd87-45bf-b0c1-66eb1cc59b85", "value": "T138B2E118F022E26C8EDCB5DBD279409B82204D2C08BF0478B7C88137F5D2E7896E3A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903854, "uuid": "be458b30-8ac2-4856-8c6a-c8cc12c038fe", "value": "384:6QcPuJcVgI+x3JiqbaZsvvFFnJkncYfUNVbRU4F1o8JjLdsLpAXQCX3:LxcVgI+x3/nCcYf8IuO8caDX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707903854, "uuid": "80888367-9506-4405-a4a1-fe07876d4c7f", "value": 24802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707903854, "uuid": "86a324b2-7a1e-400d-9383-a67e23ada547", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903854, "uuid": "c207aa9e-0619-4cc6-9ab3-f02e65c25585", "value": "Invoice # 12200-330.r14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e2b572-cb12-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707898923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898923, "uuid": "704132fa-a89f-4e82-9812-7020e94d7b46", "comment": "Malware payload (Mirai)", "value": "488efad566b701d2c8df3f19a4a82517", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898923, "uuid": "c85d4800-35a4-4984-8c85-eb7e77e53c3d", "comment": "Malware payload (Mirai)", "value": "28a0c555a1c8ab77aa615cd9a149693b11009483489eee7e87ed6cdf3c3b6d0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898923, "uuid": "1e03825e-fc29-47ae-85f4-3f793cd26cce", "comment": "Malware payload (Mirai)", "value": "c27ae47808b3eac25b91dc7d81adaf5159a1cefa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898923, "uuid": "730cf71b-9beb-4dcf-8f92-9be1a156da40", "comment": "Malware payload (Mirai)", "value": "a04e61186f4849725f9ef7383fbb4ff601b5e55a0e1a163294862fb8fb5409fd61ed71966d22448a47ae0de983584f01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898923, "uuid": "16f41dae-38ae-4dd8-a29e-a99ab7c54429", "value": "T118835C3169392A26C0D0B97E12F74758B2E21B4E25E8CA1E7D730E4FFF51A506413AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898923, "uuid": "e86da10f-bee1-44e2-aad6-c85b0aea0ffd", "value": "1536:KYHpONKUq1et03jRIpwXp/ra/SjPsIhJWsjM3wlMVjeQH:nxVJTsIXzY37e4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707898923, "uuid": "4cfeb4a1-2ab9-4ad2-a218-388e18a52408", "value": 80880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707898923, "uuid": "ffc4b3f2-aa8f-4964-9b97-a988c882132e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898923, "uuid": "4b6058f4-59da-42cd-893d-31ad02b5db51", "value": "488efad566b701d2c8df3f19a4a82517", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9989f48-cb3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707917699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917699, "uuid": "e6016e19-3a1e-4205-bf1b-fdb446374430", "comment": "Malware payload (Formbook)", "value": "8fda9f65955354d41a374296c18626d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917699, "uuid": "c054bc79-1904-4f5f-bb57-6cf35771b73e", "comment": "Malware payload (Formbook)", "value": "28f5c3a4a4a6340ee05d8c84b0093b16ebd7abb4f4fdf56be9e82a3b50faed05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917699, "uuid": "f70f1257-b28e-4558-8b53-3261eb732fb5", "comment": "Malware payload (Formbook)", "value": "9fbb92aa77897401ad0ba6d26ac3e16025c56dd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917699, "uuid": "a1d8ac81-3351-492d-be52-62b4055770d6", "comment": "Malware payload (Formbook)", "value": "197ec4d81dbb08b24ff79f1568644176c28f032942fc608c3cab9f3ba0a50148fec4a2badd8431fe5cc29f6e89d6924d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917699, "uuid": "ba764880-ba54-4187-aaed-78a7fe819eda", "value": "T106E41230379A53EDC9A58B71293485C05776BB2ABF05CB5F2A09320D8D637235712EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917699, "uuid": "dfddebae-4f8d-429c-84c2-0b40e1871b25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917699, "uuid": "43c64f05-55c3-436b-9ce8-b221c91ff3ed", "value": "12288:9IeQ5vziMP+FyQZv6DQhB28sed56yZlJmzG1yLu6EZXfYLPaTyEMKxxT:Grih70if6yZj8G1yL1tSyE/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707917699, "uuid": "cc958ee1-aad0-4e8d-9dbc-a0093d2674fe", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707917699, "uuid": "8ecb4b29-ab09-4698-ab2a-139b757d76af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917699, "uuid": "c473753d-47c5-4917-9ecf-1c18e7fcd50d", "value": "rRemittance_90523_03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a2f598-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707915760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915760, "uuid": "c92d2d63-dac7-48df-93fc-7bad3e76db53", "comment": "Malware payload (Formbook)", "value": "e1a2ba4d338785ded3313b8ffb36125b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915760, "uuid": "287bf6ed-ffc6-44c3-88c2-101e102adec6", "comment": "Malware payload (Formbook)", "value": "2a1b5e6dcd2c73e73fa3cdd788771c9f25152cb60d8c8ad186983327f541d0fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915760, "uuid": "74bfb0da-2cd6-42df-b5d7-5811939c358d", "comment": "Malware payload (Formbook)", "value": "243622e167e25ae6a1be4aa957da81cc6b665e92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915760, "uuid": "c4595979-ef77-444a-ab25-c4905787aa72", "comment": "Malware payload (Formbook)", "value": "ec8cd7dff3ac53cdd375cae6745c2873da39416dd20d14fedb2ac8e4ffc4216ecb46d09cf44a8e089f3114cac4a8433c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915760, "uuid": "8b3a1939-68da-45da-8920-51d2e76000a0", "value": "T1B5D42354B42CA347E9BD43FFBA70294807B722974851EF09BDC4B1C72DA7F901862A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915760, "uuid": "ee055ab0-088b-41ec-946e-5975b309304b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915760, "uuid": "21f054c5-9d5a-4376-aa7f-22f11ac83557", "value": "12288:aiD2SXlunZlGY1jpw6wI1UBum9BLQb6X35MNaHZEqXuIGX3a4Bh:fV0lGGpwJI1QusBLQbMHOqXuIGas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915760, "uuid": "ceb72fd7-bd2f-4c56-8136-8900074c9b3d", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915760, "uuid": "f7377463-be86-4ae3-a522-e347ba1a3233", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915760, "uuid": "8acba26e-3b24-4598-ae8f-c86655509c4c", "value": "RFQ_NEXCOMM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b96b5b-cb04-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707892884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892884, "uuid": "87cd6dd4-b3af-4003-8d28-9b9d07d354a7", "comment": "Malware payload (Mirai)", "value": "d6b9387c877671fd483cc15a80b30c45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892884, "uuid": "476aa87f-1620-4a54-83e2-6f2f7d13c465", "comment": "Malware payload (Mirai)", "value": "2ae99e27dfdd9ed48a62fd3710c3cea54fa17c43ef27284c447636458dbdd6d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892884, "uuid": "212bfea3-aca0-4445-a15b-0a825c5cb4f1", "comment": "Malware payload (Mirai)", "value": "1deba08774d889465822c2854894d1c461f4a2ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892884, "uuid": "3ba447c7-bfcd-4c97-8d04-0b8f6d62a0c2", "comment": "Malware payload (Mirai)", "value": "469b52e90cd5876a1107be9fc44f2134bc25565d114f388d3ec07d34fac4f3a6276c36f279b53ebb3203d3f75d18c704", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892884, "uuid": "32589ff7-0604-48cc-8ec9-565a1526c422", "value": "T186136C76D42A5E54D0460170B860DF780F23E0C193676DFB2AAAC5A69487E9CF918FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892884, "uuid": "fc351818-6a2b-4269-bf6e-290d1208ae05", "value": "768:nZISg3TfWLSmH5QzXOJ92MC0omvrJFnhOtCu2w:nZDg3TfW+1Y92MMcItCuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707892884, "uuid": "c80bf5ca-7eb7-4e57-965a-3ac1609f4f8b", "value": 43940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707892884, "uuid": "ec5f4321-a7e5-42d1-8ac2-46334ed85785", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892884, "uuid": "fa7a3eb6-8e3a-4cb4-bb45-80de50e6df7f", "value": "d6b9387c877671fd483cc15a80b30c45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e62501-cb34-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707913593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913593, "uuid": "12e5c8bc-f7fd-4063-8f66-ed48b0f10daa", "comment": "Malware payload (AgentTesla)", "value": "0830376b1ec0b8e9b15635f5a6688909", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913593, "uuid": "c84cc351-ad82-4acd-b563-98b5596d4553", "comment": "Malware payload (AgentTesla)", "value": "2b123c40c214cc47d0ea41056bbe09f79ca1f4345537599e87de0cbaef1acd99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913593, "uuid": "2d3c31c1-e9b6-4069-8bfc-0c74479fa487", "comment": "Malware payload (AgentTesla)", "value": "ac18b4a488e41d424d97d2fefaf32e6f7d0bb7e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913593, "uuid": "cd98492c-1c01-44b2-8d50-afa0c01b80ce", "comment": "Malware payload (AgentTesla)", "value": "ae6b99e8b1163cbf9d885f1b53750970fd290032f216f545357c457666dc98e24d2879ea3cbfcdf34a5e1cc40f134773", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913593, "uuid": "42df9402-575a-47ac-856f-c2c3fde4ded9", "value": "T138E433B3AE2734784B27E311DB2E9DAB1E98419D7F503958F967341912E802AC9274F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913593, "uuid": "c20df8f5-9661-4c58-ba6b-a32278e5501e", "value": "12288:jtpYyMocD+ekHAATfYmgBMHYyEOEP5ny7cCorgDJPurk44+T6SOa:/ZcGHRTfGBNCExny7czrgD8rOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707913593, "uuid": "323fcdc4-0943-4a0c-b642-b460ccf5bc0d", "value": 703380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707913593, "uuid": "2e35f621-2083-4ac6-9581-b22012e01924", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913593, "uuid": "78253793-6841-48b6-804c-cd2e4e21e315", "value": "nCargo Arrival Notice,.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a33b15-cadf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707877374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707877374, "uuid": "3f9d972d-5078-4a16-aa0a-664c7bb7712f", "comment": "Malware payload", "value": "1281681fee53aeedf363b46ebf822d31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707877374, "uuid": "6a14f6dc-b62b-469d-ad99-2cda7f2e8e5d", "comment": "Malware payload", "value": "2bdcd4c0fa62b1d13d7079b276e123a11206fce3c15ce1adcff4cdb34df31739", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707877374, "uuid": "e39dfc27-dac8-4cfa-8032-824c88835d06", "comment": "Malware payload", "value": "69942f497db9233dee8023782f2f99998b83029c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707877374, "uuid": "38caf1fe-7fae-470b-8e59-0d37314b7302", "comment": "Malware payload", "value": "0379706bc60e35a78aec3746e445de8db2ca8f1a76071d2a3f8743cccf6cd48f2762981075d29baf17ee5902744863b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707877374, "uuid": "4591e274-f674-4ada-b60a-ccf9881a7e57", "value": "T1A8473339AEAAFCF7D422653C0D8D5467AB3F3059084A70C85328996EDF0DFC16651FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707877374, "uuid": "689f6c65-6f59-4669-bb77-fc96919b4ff5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707877374, "uuid": "4b0e8b6e-ad1d-4d8b-b63e-18a8616f4fce", "value": "786432:giE0hs7SJsWNxbl3G+CWkfJM/+YW83VhrU1zU:gchaKxbl2+CWkfJM/+7mrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707877374, "uuid": "4a8e8fcc-8b01-478d-95a1-73a2502094aa", "value": 25844540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707877374, "uuid": "1a3e7a63-b62a-4711-8ea8-b92d3c7cc1bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707877374, "uuid": "e62ff76e-dbc7-4710-94fb-5da806715d74", "value": "SecuriteInfo.com.Trojan.TR.Dropper.VB.Gen.4705.30726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d613cbec-cb77-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707942604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707942604, "uuid": "de7ed7da-6ead-4f65-8ea5-5c1acf65ef94", "comment": "Malware payload", "value": "4ce1b8dfcdec9337037df1c42d40dda7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707942604, "uuid": "25c5c9e2-d836-4960-889f-3448115b7f7f", "comment": "Malware payload", "value": "2c3df97ccaf2f33d0f34a14358a53c873b7373db086f0a614d6acc4c5ca6beea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707942604, "uuid": "3bf96618-5360-4c5d-ae77-b454b8e68232", "comment": "Malware payload", "value": "f54a0a2a9c7013ec5900afb177fc0a56d108124e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707942604, "uuid": "c271fea0-c7e1-40af-acc4-dfaedccf3879", "comment": "Malware payload", "value": "730e25d9eca341b932d0a189fa8baf09e9a45847c783eac185b7d33e18410ed44f784cc5f961f7a9dfbaa493902b12a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707942604, "uuid": "79039041-0f20-492d-814a-45bbcfaf3cf2", "value": "T15255CF3564211CBDE02F353D887AA67D7D6DAC70BE88AD025AB459CE4F794013B0E39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707942604, "uuid": "73a00485-e832-4fe8-9b8e-edb527888502", "value": "1a06dbac007de7746c351c3ce81e4d83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707942604, "uuid": "e0565bb3-95a6-48cb-a54d-b14f578a8112", "value": "24576:ZDhYhDuIPT2ldxxUmup3FjetpGgDhGX1r6GnHNswsMZUuiPZ6bLW:ZD/p1hQ1r1tswsuWZ6bL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707942604, "uuid": "57bdfa5d-40c8-4195-b5d4-372f5e7b735b", "value": 1390080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707942604, "uuid": "35bc9d06-73c3-4655-9ef8-136d5157aba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707942604, "uuid": "e507849b-23d1-40b4-ba22-7dfa552c8c2b", "value": "FIZETES_ADVICE_MT_105.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88558d8b-cb18-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DanaBot)", "timestamp": 1707901672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901672, "uuid": "36204dcd-412f-4e31-b7c9-82a78a346c5a", "comment": "Malware payload (DanaBot)", "value": "3ea6a5b6a66f68406043fcd05e822c9d", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901672, "uuid": "a329e005-94a9-4e6a-824f-b0df87cc0d27", "comment": "Malware payload (DanaBot)", "value": "2c5ea723530fa9428e3357bb89f9200a7fa05dedfb3c9f1454acbc27751c8056", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901672, "uuid": "60116037-8f17-4a13-9c73-cf918b36e9b5", "comment": "Malware payload (DanaBot)", "value": "a98a28227dfe62e05797fa1bb17cee2373ed8927", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901672, "uuid": "2c009f4d-8815-4ae9-b155-4c42c6dc7dd9", "comment": "Malware payload (DanaBot)", "value": "a2c7791646e8e435836c6a5f741b744eb5c980a8c6842a1b7a3f47a9920e034d241187bfba7bdd9ff8ea389ec53924e0", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901672, "uuid": "2d97bdaf-2f15-4061-a692-427c84c06d69", "value": "T1ACC1739837917615035333F33E37A0E9F8956C5A3E03406BE960FD99294823BEB57931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901672, "uuid": "5a7e70a6-6210-452e-888c-6e01d8c21e64", "value": "96:kWoxJJQmALrN080J2mkpIVXRCyKObJo9BeQrFsvn4DAz9MUmd99WL+wHWDX/KBnk:VoxJ0czeIVkJObJo9BecsvgAzHm7sL+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707901672, "uuid": "081b8ce1-32cc-430f-be73-830c0c53813d", "value": 5645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707901672, "uuid": "0143d166-121c-4a57-b966-f535f2fd4fe3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901672, "uuid": "5556c9c3-dfd2-4fd9-91e5-39325fdc4aa3", "value": "allegato_108.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e58808-cb3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707917720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917720, "uuid": "6170ad32-a0cb-49f6-a912-1392441c960a", "comment": "Malware payload (AgentTesla)", "value": "a68ca98b90ade59c462579ff915c76a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917720, "uuid": "93cbc946-fb3b-4d09-82b2-db950b72b2f2", "comment": "Malware payload (AgentTesla)", "value": "2ea6663c1306df3fa71f0fc0c4722e7058fcc19986ec96e4d9a4c83f3e1f2514", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917720, "uuid": "a916edc6-288a-45a3-94f3-b21783113c91", "comment": "Malware payload (AgentTesla)", "value": "8771bbcbac5d2ba54b0cbc23050d60a343eafae8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917720, "uuid": "6a8d922a-5dd6-422c-9061-e2facae66fa4", "comment": "Malware payload (AgentTesla)", "value": "3a1ffb6faf481b18eaef48352d65c9377ba0c8b7eb58febc0cad4ae90ec7c0b32e8a94295c72c93c7f89e5d2336abfb4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917720, "uuid": "0b503504-54ce-4eb2-86bf-edd33ad9cfdb", "value": "T18725B021F185D476D1B326B19D7EF760563AA63E8231C25F23D83A215EB1342263BF1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917720, "uuid": "16215d7a-312f-4755-ad33-401b08346574", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917720, "uuid": "501e7b50-c660-4955-8ba8-4b1588dfcc9d", "value": "12288:+hkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a/gdq8pqgG5s+XXEJYoxec:ORmJkcoQricOIQxiZY1iad8plGCqX33s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707917720, "uuid": "e1195783-ff82-471f-9258-a6db68f258cd", "value": 1038843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707917720, "uuid": "c0cb08cc-e675-4d15-8014-85b23f57149d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917720, "uuid": "2803cd0d-13fa-4d90-9665-c63e7d02b429", "value": "z73PO003-23170204_3520206285_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4eee2ff-cb5a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1707930093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707930093, "uuid": "ec62d4cc-2a84-4952-ba81-03f32d2d95aa", "comment": "Malware payload (Amadey)", "value": "a7cd5b96a37ef2f06e2c8c72c2508259", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707930093, "uuid": "380e8a7a-35a3-4ceb-b335-8afae7d6aba2", "comment": "Malware payload (Amadey)", "value": "3233e1d3dc7c73ea5052a53b8e67668dafc5f84ddc213c8bf5ed349a22e485b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707930093, "uuid": "cd8fccee-f578-4c67-bbf5-c8e2fdbf2397", "comment": "Malware payload (Amadey)", "value": "39700db2301d10fa7a6c9ee37985eb30bb060c6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707930093, "uuid": "11cdc95b-41b4-4fa6-970c-3889c580e2fe", "comment": "Malware payload (Amadey)", "value": "92ad62722e03d1e10c41715ce24933f72d4dc9acbb109000bc602a364619db7510be5f03265293d0c8cebdf3e1516ea9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707930093, "uuid": "1c2f919b-e0dc-4c7e-8ce5-d3eb8630ae93", "value": "T11395338F3E6B8EA2F9AC5471D0014796536C2EC464A705BD708866ED474BF52EAF3CE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707930093, "uuid": "db5b6360-3d66-48d6-8a49-006f3343bbde", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707930093, "uuid": "fb565112-3862-4d96-ae2a-6eca2b90d972", "value": "24576:xiKi2E914qcly/zSWxnkgFiJ8oO4DnNwWELF/pLzxLZ6+u+qfj9UMJTBayb:6z4q4RngQqozS/LtZ6+g79ZMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707930093, "uuid": "3dfd7661-fd35-4c0d-9580-91cd8bc83658", "value": 1948160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707930093, "uuid": "e4b5f7cc-2b73-46a4-aefc-73741dfd507e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707930093, "uuid": "b4d97e9e-2c30-433b-b2cc-b9a60757c6e3", "value": "a7cd5b96a37ef2f06e2c8c72c2508259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96de883d-cb12-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707899119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707899119, "uuid": "40542745-4b07-4d55-9fa2-937aaa6b809e", "comment": "Malware payload (RedLineStealer)", "value": "8c263ec6661093782d47bbc1d035d75d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707899119, "uuid": "e725ba5a-cf65-45d4-a945-da6e29fb3c02", "comment": "Malware payload (RedLineStealer)", "value": "32633ca885c88ee98188a45b3c4df0dcfe664c4e6b5daa203c6c39aadab19207", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707899119, "uuid": "eff09687-3841-43bc-be6c-587b26636c51", "comment": "Malware payload (RedLineStealer)", "value": "6980805f2756c7ad900052958ca3e11ecbc5b9d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707899119, "uuid": "0e9b4276-8684-446f-85fd-f5aec9e6dcb8", "comment": "Malware payload (RedLineStealer)", "value": "e27b1ad972584731ef0af38191576c90799edb83fe99891e4c9502154cfc4ded44711ae73161943a40c365e53bbc24a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707899119, "uuid": "49b74fdc-1b7b-4cbb-b23c-f0a6e068374e", "value": "T16795232170D0D373D8BB24388AD9CA395AB531E50B99E1EBB6EC27761F512D243362CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707899119, "uuid": "6435270c-bd77-4897-afad-b5e5cd0c1db5", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707899119, "uuid": "c2e437cb-4db7-4bfd-9314-abad91e67f6d", "value": "49152:XkQTAHzvJbZf2gztV8JSZFafOrYygOe4eD1cAd:XaThbZB8Jq/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707899119, "uuid": "ae06f226-b645-4d6f-9436-0670ae6fa05c", "value": 1936352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707899119, "uuid": "b57e2981-8cac-4034-8d7c-8ece925c4b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707899119, "uuid": "0bf17f99-5390-4bf2-90dd-8a034b4c3e65", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11248aa8-cb1d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1707903619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903619, "uuid": "229dcf53-4e0b-4cb7-9bfd-b550fc4be8fc", "comment": "Malware payload (DCRat)", "value": "2059b153136de16e58e27a8549dac1b5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903619, "uuid": "bfd766b6-e216-4343-99e3-fc6351c1558b", "comment": "Malware payload (DCRat)", "value": "326975832674627265c01a626a19ae8ff0a30fd7b7db9e17c098329730286f88", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903619, "uuid": "fd0cf0ea-f2f7-4711-b927-6d32fe662e71", "comment": "Malware payload (DCRat)", "value": "47f7fdbee2c963e63b52cac18bc5b9bed9b7c10c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903619, "uuid": "0ef0edef-ff8e-4fa2-aaf9-72e117d2383f", "comment": "Malware payload (DCRat)", "value": "b4f4918ef22ae375d8652159176723a6fa50c5e350551520d53bcb48f5a9b42453bc65f99bfaa554c57359e598d33d9b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903619, "uuid": "cb4825fc-40b8-4429-9d35-69f1cd1d20bb", "value": "T1CE455A017E44CA21F0191633C2EF460847B4AC112BA6E72B7EBE376E55523A77D1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903619, "uuid": "bccc65e9-1a3e-4174-86eb-cb18bff5a7b9", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903619, "uuid": "4686501a-b63f-4d42-a7f4-e93f260f1c22", "value": "12288:URZ+IoG/n9IQxW3OBseUUT+tcYbDEq7n2lBvR0dWfExtTWmOfcziDi+CUF9q:u2G/nvxW3WieCDHWBvNCtbskUF9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707903619, "uuid": "1ef443b6-15e1-4844-99f5-b90e1354df06", "value": 1164401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707903619, "uuid": "717238cf-f47e-4b8d-9d7c-bd50fb251f6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903619, "uuid": "cab46666-d70e-4f84-b5b5-a4e1490acf3e", "value": "2059b153136de16e58e27a8549dac1b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce255abf-cb3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707917680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917680, "uuid": "4aebd829-c06e-4a8e-9fa3-747f01beb507", "comment": "Malware payload (RemcosRAT)", "value": "b913676742e853083ed34d5ee14c0e56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917680, "uuid": "3330749c-a6bb-4632-9a79-bf0f09389d73", "comment": "Malware payload (RemcosRAT)", "value": "32ab9d5f1b61973c01b2adfc4e44caab278419073a308f2efc6f2eb6a8b06981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917680, "uuid": "ac20dbc8-c0df-4bcd-a65e-1297a5f5be3d", "comment": "Malware payload (RemcosRAT)", "value": "939317fd5fa1cde5dc2dc682c567728c31c33069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917680, "uuid": "76942c52-106d-4d3b-bb05-c41797bc683a", "comment": "Malware payload (RemcosRAT)", "value": "8da2e3d34b906b9632fe016121d25d1d8b138854e0d2d0dc8b572b609077bb2e4e5221f4355148731aeb94f6465c0df0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917680, "uuid": "6d23bad0-4f81-4a64-b134-d6cb474de7b3", "value": "T117F4CF61F2EC41C5E02359B349BB9DB156BB5D78E868800E124CFB3A67F3391841EE5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917680, "uuid": "3ccfd4c2-44f9-4931-b002-ea735b149571", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917680, "uuid": "8e22ff64-8903-49de-86ef-926c0730bc97", "value": "12288:A07cAYwueUfwQ04JlB4fUqC7O0FwiYZ1aphHAwgi9Nmoe:A07cUueUfx04JlkfbRnuNmoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707917680, "uuid": "73d9b036-c481-4152-8eb6-54816e11cedb", "value": 765719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707917680, "uuid": "0f84ea4c-1f77-4833-b70d-d0c933266642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917680, "uuid": "7ab90c81-3187-40f2-9015-082af064e44a", "value": "rIMG-Oferta-WAA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062a40f8-cb06-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1707893722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893722, "uuid": "21ee450a-a8f5-4c5d-b04b-8aedaf72988e", "comment": "Malware payload (AsyncRAT)", "value": "18bb98b45da6d509a360ba1b5f58e854", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893722, "uuid": "2edfcbd5-ed22-4d24-9e00-409b08922a8e", "comment": "Malware payload (AsyncRAT)", "value": "34619b02688a538cf3bec776233ced7001f09307e4a4d231fc0f14330ec938b6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893722, "uuid": "2d3151bc-ddc9-4fdb-ad54-4c5b73f30690", "comment": "Malware payload (AsyncRAT)", "value": "f47c5c5b47e51037ef5611b6dbed2ca1c4279be9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893722, "uuid": "8c2a1f7e-9cd1-46b7-92a2-f2a765ebf7ff", "comment": "Malware payload (AsyncRAT)", "value": "3a89088dcfc8380eec23f70c6386a45f93b829a36c7137a630a994381bd64ffafe4fb891ad17b7aca0a3a653231cc384", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893722, "uuid": "853b3977-4dd9-4f12-837d-dba21e2d1ebe", "value": "T1CF232A0037E8812BF2BE4F78A9F25145867AF2633903DA492CC451DB5613FC69A526FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893722, "uuid": "4935281f-8a48-45f1-b66c-bc15d10b9387", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893722, "uuid": "ae97aa2e-99dd-44c9-b504-87234d4d15ec", "value": "768:ZuwyNToEjaNLWU3+KZmo2q7v6MQP0UkcNIPIFzjbBgX3i0CNskgpkBDZrx:ZuwyNToqad2MsLtF3buXS0Ci/pSdrx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707893722, "uuid": "86b650e2-5718-417d-8934-a3bdabe12fc5", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707893722, "uuid": "b936b014-7638-4c68-83b9-a95209231ed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893722, "uuid": "a2f714c7-76ce-453b-866d-8e6132d06365", "value": "18bb98b45da6d509a360ba1b5f58e854.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120ac6cd-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707947429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947429, "uuid": "2b15d58f-bcd4-4377-b070-fc236eee6cce", "comment": "Malware payload (AgentTesla)", "value": "4a322684a81842d90fabc1588790cfc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947429, "uuid": "cf2d6bca-197c-41c9-bf05-e35b50a3cc45", "comment": "Malware payload (AgentTesla)", "value": "35a5e8cae3cbf0f14ac66c0e38c0754c024adec00297229dd1a0e44fbbbb81c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947429, "uuid": "f1814eae-4eff-4015-bb8c-ca920461ccbc", "comment": "Malware payload (AgentTesla)", "value": "42635a74096a7851416c13a55f454818c11ab6d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947429, "uuid": "c2c0ca7b-93db-4158-93b2-12fe18a90657", "comment": "Malware payload (AgentTesla)", "value": "108a46f3f0610668c5a108e65e85d36ad20c599da67046d1f20dc639cb0b369d19f154d29be2092292a63adaf02385ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947429, "uuid": "bff4dde1-30ad-45d1-a5e1-a0bc5c75b133", "value": "T12CA423679D204EBE186FB6A198E632E7848F3DD14E1EE00712A360DD4A77649CF930E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947429, "uuid": "e95ba317-79d5-4d9b-9e7e-13087fc38582", "value": "12288:9AnQMPo2KNh5ULUUtJXWn7wBNCTNcUjBZn8Bk:EQ7VNPAntJmncBkTn8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947429, "uuid": "515ff3cc-ea4d-465b-b868-e605e75e584d", "value": 461952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947429, "uuid": "bb035e31-906b-4971-b237-f7d288efc1fe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947429, "uuid": "6f456da9-3cf3-43e5-9f67-2a65948b40af", "value": "FACTURAS.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca90cee-cafd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707890136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890136, "uuid": "13589247-010a-40d8-b728-c7a7cd4e4294", "comment": "Malware payload (Mirai)", "value": "98ad2129f4e2157ca34804257da8e37c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890136, "uuid": "4fca6198-aad6-46b0-becf-857556b5d9e1", "comment": "Malware payload (Mirai)", "value": "368b012f2886a7e3d88cf90b169c9ca7c599699b292605c847373683b1745df0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890136, "uuid": "ee6ddf45-d04c-4528-b377-0c76fe2c60f3", "comment": "Malware payload (Mirai)", "value": "997531826304ddfa9c223ca9d8fa92d2b11d6729", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890136, "uuid": "f858767e-abef-4bf1-834f-01ca2dd50c2b", "comment": "Malware payload (Mirai)", "value": "358872abb31004b94a9d6688d932c87e8514a6d27f64371c71214726d7aa7926354b7679d6e812531b929d3be941bfc3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890136, "uuid": "285c449d-c412-42c6-bf77-21a7ee80faef", "value": "T12233F713B58285FCD14AC174166BFA3EDC26B1FD1238F1E27BE4A7227895E224E1DC49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890136, "uuid": "ab07d5cd-1881-4145-a75d-c23d185150e2", "value": "1536:89LgR6nQAFBwzSrIUTERLRw62LR4z7cbtLl92ZMLV:4W6QiJrIUTgLRw62KnSoZMLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707890136, "uuid": "36a059fc-b329-4810-bc15-6c30b018aee5", "value": 50560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707890136, "uuid": "c33482ed-609a-4d86-bdc3-ea1f5fbd54b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890136, "uuid": "ba0fcf26-0c55-44ec-9102-d643c3120c11", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53538151-cb3f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1707918333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918333, "uuid": "dd097be6-eb8a-4a3c-971b-0e174157d96e", "comment": "Malware payload (Pikabot)", "value": "19c178d159928aaa23c2042e7ba3aae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918333, "uuid": "be4ae9a7-a294-4918-a805-6819064708c3", "comment": "Malware payload (Pikabot)", "value": "370af5dd65ce0c3d8655863cbb0889d5e8d22ea254f99d6a8d23b9f88e5c56f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918333, "uuid": "383a0be5-ecef-4e7c-80bd-789d235978c5", "comment": "Malware payload (Pikabot)", "value": "2bddf4534187cc4b2b3c77da8613b3f4ad8b0fd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918333, "uuid": "173d0971-c7b2-475e-b0d6-de3614fc1cdf", "comment": "Malware payload (Pikabot)", "value": "54c0ba8a5c67144df754bdc5e907e50e4449de5e83856cc443d8543b3c3bd9cf8653a828430b443f3a5ba52229df532a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918333, "uuid": "22591648-1fbd-405a-935b-e9b076b75187", "value": "T1F2659E21B643C231E16111B05AAF9B79C9AFBA385F6205CFB7D01E2DA5309D36A31F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918333, "uuid": "143c886d-3275-4517-9b48-3fef6a79e7b2", "value": "c360eb5cf26a327cc9c0bc75621b0558", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918333, "uuid": "e2665be9-c92e-4f1e-a238-70b4fcc05613", "value": "24576:j0/wpWGxRsnyM3LF+0mlBnjs60nEisX1N9rm1Jo/13JQyjLc22dEaY7Unbya87CJ:Q/wn0x3LFfmHnIZE9rm1Ji3hLc22dEa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707918333, "uuid": "2d039b4b-20e7-495c-8be7-89fc9303bdf1", "value": 1507840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707918333, "uuid": "b2e9e3f8-6aec-4425-b55c-7b8096862f33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918333, "uuid": "18c38f5e-6d37-47f6-98c7-584034673e2e", "value": "magic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4fd8dd-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707947448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947448, "uuid": "170ff25a-d493-404f-869f-555129252d05", "comment": "Malware payload (AgentTesla)", "value": "227e1f3b703cd0eff2db88f2968d362a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947448, "uuid": "590823a6-45dc-4253-abee-0200bd745e7d", "comment": "Malware payload (AgentTesla)", "value": "3717f0928a99c81222dca1d74f568e2f92584b5bac7848697bd3913c01742baa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947448, "uuid": "c5bf7db1-b30a-4c9d-9939-66a8c11bf7e0", "comment": "Malware payload (AgentTesla)", "value": "1b3722992f2aeb86c86c7e0a572f07b9d905daec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947448, "uuid": "bc6ee0b1-7762-4a85-abb9-67931017a27f", "comment": "Malware payload (AgentTesla)", "value": "cecb33757646f7ddb518f72bd4ca9113d8aafabb5d4ce87a0aeaa123ac2941785a7cbf4803166289398e56accff667f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947448, "uuid": "638b8a76-47b0-4fd8-b736-ca3d6e9545bd", "value": "T169D4221173998B3AC8594BB839F226911339A38B0B11EF5D6F9531DC5E733C98226F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947448, "uuid": "50a36d2f-9e22-4a0d-9651-58d6f7f18a28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947448, "uuid": "ff8640c8-1c35-48cf-baa6-09cf13ebfe9f", "value": "12288:Y0RyeQ5vziurA4ZNBH9DkCTPNG478nGkRKW0N71ulXCo77wzEDBuyhier4:wriurBZHJNG4SRKW0NJxgMKuyhi64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947448, "uuid": "57af2875-3c86-4ecc-a6fb-eee68609da82", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947448, "uuid": "e7773dd3-5c53-4302-9d37-9db5e0da8e4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947448, "uuid": "fdcf8e47-8a56-419a-af64-4611f1516b48", "value": "SWIFT MESAJI_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c91b7c-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707947431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947431, "uuid": "3fc8f923-b4e1-4cc4-a9b8-54d55a70ca74", "comment": "Malware payload (Formbook)", "value": "889cf6d2dc5a945c1bb2809e70a46294", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947431, "uuid": "71eb6509-4663-4859-81cb-0825c4ce5b82", "comment": "Malware payload (Formbook)", "value": "374e82c426bb09972efa0921091f44a134cb314a38ba75cfc171911e4b51a447", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947431, "uuid": "9e1d1377-929b-4400-a8bf-733ff527b590", "comment": "Malware payload (Formbook)", "value": "cd99a396dbcef25ab3094c9a6317a1994f824bfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947431, "uuid": "fc17cd4a-828c-41d9-9b32-e085d334f4aa", "comment": "Malware payload (Formbook)", "value": "3df85d8de0c939adabddab1de3b9548f333cce08af82f6677467cbff377ad57650efb2cd42c561298f2ab4b535736683", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947431, "uuid": "2e1eedbb-4ebb-43ee-a4de-e9776c23c1df", "value": "T1B743D025A2F84336F6F79678787180801B32F647B846CF5D8C85444E89A7F4E8E62B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947431, "uuid": "05e83397-9000-4bc9-9138-e7d63bcc1c19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947431, "uuid": "85836540-8b57-4789-aa0a-9ed4752ede09", "value": "1536:vOZ8AdyjwNUMhTsjJOCq29suranxH2ufS/Gu:vOZ8iU+Tsjs22gaxH2zGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947431, "uuid": "a924db94-f726-4b8f-bf22-6fd361370bdd", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947431, "uuid": "96b7cf17-89ee-429e-80c9-24f0ed6e4a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947431, "uuid": "d87768f3-0913-44bc-a111-52990e5a708e", "value": "International Bank transfer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c2067e-cb45-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1707920854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920854, "uuid": "029e0786-95df-470f-bcad-8604d9b3087e", "comment": "Malware payload (PureLogStealer)", "value": "ad413fcb09e2f6a2f862a614c478bef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920854, "uuid": "670e5476-0076-428e-847a-8bb0d3dca449", "comment": "Malware payload (PureLogStealer)", "value": "383a0d94ccaeac8b164cd2eb4e4d189c29bca50ad7af0004ac8be891dd285aa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920854, "uuid": "c0a51676-fe32-45fa-a740-d459151e9f9c", "comment": "Malware payload (PureLogStealer)", "value": "2c51ed72626a915668be91e2f7d5e516d42be4d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920854, "uuid": "c3de6b54-19bf-476e-8baa-5c7b3f8c9d7b", "comment": "Malware payload (PureLogStealer)", "value": "69641c92d8aa25f777b045f087725489d1b015859320abcd19bd0a435ffa9413b24ff03e200fd252da0e92e0f26981db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920854, "uuid": "0306c3c0-4d3e-44d7-8b83-6428186f5a71", "value": "T130D42392770D3913CBCE19B744B1357197F0AF2272C2E3CEAAA0464995E67C845A23F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920854, "uuid": "50a03b8b-e0dc-45cd-84f0-318f9a42ee4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920854, "uuid": "3d7e93d3-953c-44ab-93c8-43d2e69e1fc5", "value": "12288:Y/RzNuSCfI+yQw+HImZDJXclcECJNhhemFYRGoUJnDMIJS2K:YpPH85ZDJMlcECh0mFCdUJnIII2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707920854, "uuid": "43577e5d-bfef-42df-bd76-0a58db63190f", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707920854, "uuid": "8ed4dd2d-69af-47a4-a324-cbcea36c73eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920854, "uuid": "e2787c13-7b0c-4d49-99fb-7487533ee01c", "value": "Omega Engineering - PNALO05145 PI1_221102277.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08593731-cb03-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707892438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892438, "uuid": "d56f0300-a8ba-4446-8be6-58a93e1a6488", "comment": "Malware payload (Mirai)", "value": "3a9443f0d81de6a08892bd925c7b2a18", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892438, "uuid": "352c0c46-2677-4a14-a46b-4ebb994b0afe", "comment": "Malware payload (Mirai)", "value": "38aa87b213bf4bc8a0b86d4e811218e9622b9660518906f7588c0956bfc551eb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892438, "uuid": "5b39cd58-149c-4244-b05a-e22c29b1bd21", "comment": "Malware payload (Mirai)", "value": "81a93b78c34014edaff227490c2a13129abc4afe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892438, "uuid": "74ceb69c-2b0d-45fa-af1b-6e92a19ccd70", "comment": "Malware payload (Mirai)", "value": "432eb2a2c311908b0afe9c05d6ac93645f2fffce3def1e9b2f96c84022c5f7965b96f20c3e5843ce429fc240a3746959", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892438, "uuid": "92a03e93-25be-444e-afe4-93be02ef8f7e", "value": "T1E173F756B8814B12C5D512BAFA2E118E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892438, "uuid": "75d273f7-1bf9-4e62-9eb5-dfdaff5d7e1d", "value": "1536:2lntfxPrXkja/jkp7a2ysPWO/eaCx0FIuiJer0vtGcL5iYIWz:IxzXgawUwea+er0vtGcLARG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707892438, "uuid": "ffc2e1d7-4be3-48ed-9417-872b671af713", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707892438, "uuid": "3d1109c6-0ae7-4aaf-8413-aced29b7160b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892438, "uuid": "673095a0-7d2d-4acf-8b5c-cc272a558dd0", "value": "arm6-20240214-0633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f984a7c2-cb0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707895849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895849, "uuid": "5e7107c8-afc8-42a1-a0ff-1598f15f3384", "comment": "Malware payload (Mirai)", "value": "c0eef050783ff989ce3c14a076c505c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895849, "uuid": "377e712c-acb8-4e59-9c89-defbf4407bfa", "comment": "Malware payload (Mirai)", "value": "3990107bb30607f86db4c2ab42ff12df28aed0735359cec4aa09215c43b1f335", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895849, "uuid": "66a57d76-d295-45e1-960a-9bdbe6bd16f5", "comment": "Malware payload (Mirai)", "value": "6a779452786e4b069566f6360dc7692c8cba9ada", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895849, "uuid": "c469c970-9eb0-4a4f-a34f-24ca95e02563", "comment": "Malware payload (Mirai)", "value": "c8563242b2d65a28bc0585e420e1a8ccde8510be5da2ecab92b2749bf8caf69291d09521a3610056e999fe4dd07aae48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895849, "uuid": "01c5ec49-9826-4aa3-bf4d-e0dac232dca8", "value": "T142538D75D11DAEA8C0414AB4A9198E704F13E4C046733EFBEA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895849, "uuid": "d349c60a-14b3-407b-94ed-a2d8bb3d1ad9", "value": "1536:ragXV1f1Fl/wtknOPQauiufs3Ii3O/qyD6EZeCc:r57f1b/EQHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707895849, "uuid": "5a77684e-2b9f-4359-acba-256d02a5b3b2", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707895849, "uuid": "e0a047fe-46b7-4cf6-8d29-ff03b5497c33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895849, "uuid": "23a1c708-6a44-4b9b-9e08-85bd70e9638f", "value": "c0eef050783ff989ce3c14a076c505c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0380bd-cafc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707889788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707889788, "uuid": "3b2d9924-1328-4c8e-a632-11279ecc0653", "comment": "Malware payload", "value": "5704c7588ac246829b7d2feaff12fe84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707889788, "uuid": "479b9df2-b012-4a8d-832a-445ea3ef9987", "comment": "Malware payload", "value": "39f89a0fcca62742280331d857a3b58d94f89094baf9de5b55a561c8f7ebc570", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707889788, "uuid": "f3183141-27bf-491a-be8b-616553e476c9", "comment": "Malware payload", "value": "3cec568dd1c8ce7a3ed8ba108cb58af6a388432d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707889788, "uuid": "4766783a-bd7d-4d64-9c73-188c59a2ac18", "comment": "Malware payload", "value": "83e06b7df4a20222600abcf04cefef145d8e39de12ce4c14c4c085cfeea15eaf3e3c8ef9b099048b50e61149427d55ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707889788, "uuid": "b34ae5b6-122d-4b84-824a-39d9834a2fb3", "value": "T105C7AD0273E54198E1B7D1388AA7950BE773B8261730CADF329C12652F77AD09E7B721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707889788, "uuid": "d18fb162-9803-4272-a072-4617af747590", "value": "60119ed42f111b2c92d08284871fdfb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707889788, "uuid": "af9e5a87-73b8-4b3f-9b7d-d8d1f77d3520", "value": "786432:Gx9zE5tJQxhAsf3OfGrsW1BS1aqZW2WD6aAWUfx:Gxdh/3OER1BS1aIyDSZfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707889788, "uuid": "0829ea9d-9284-48a7-b8da-2695899f9a89", "value": 53635940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707889788, "uuid": "eb033c60-fa08-4413-91d0-d56c840815d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707889788, "uuid": "7605e0ed-d950-4a66-a9de-d80cc33fd651", "value": "ILC Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361d6d46-cb38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707915278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915278, "uuid": "db3ea8b8-53f5-4f73-a2e8-ccf57f472a2d", "comment": "Malware payload (AgentTesla)", "value": "3cd15a597bce686b6fa8b378e3422839", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915278, "uuid": "1713ee7a-102a-4383-9876-9b1be0587760", "comment": "Malware payload (AgentTesla)", "value": "3a117183745224765eb2d50d5fc3da43bb44bf0b94bf32be6c3f418c8abde716", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915278, "uuid": "7e0d79de-8793-4d5e-bed3-4d2317e85a0c", "comment": "Malware payload (AgentTesla)", "value": "3b777782babcfc9ce26258313e3969896c9dc486", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915278, "uuid": "cc12bba7-80ae-4a6d-9607-67d54f7b7374", "comment": "Malware payload (AgentTesla)", "value": "41ced16e03653572f3a44c65f6ce91fdf59c08deee578349df9dbed4321c2082540b8e0b43235bf9dfc96b54f5c5e0b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915278, "uuid": "e4ae76bf-897f-4f28-9246-41851ff75063", "value": "T167740151E3A8BEAFC45703B509391B0265AABD199DB0020E2759F9257CF33737A6BD02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915278, "uuid": "a36b4d0e-fec7-4da5-90ca-007b33df0b0f", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915278, "uuid": "11c18cb3-b6e4-413c-8053-cf28678d47e2", "value": "6144:vfL+oqWgmCRd3KxnEO1kD7iXrSV9U225OWH43ufEwtp1kd1Ka:vfLoYEO1WclY+fBU1Ka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915278, "uuid": "d95ab683-db01-4233-b7ea-ff9cc3b6fe2e", "value": 339357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915278, "uuid": "35e4ff5b-452b-44a2-901b-12cb93db1471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915278, "uuid": "1f6aa964-c2a1-476f-b9df-5278a78afe18", "value": "IMG_003062130pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e08b45-cadb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707875577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875577, "uuid": "f07147b0-4cb4-46c9-8a57-d6e5b6ee8556", "comment": "Malware payload", "value": "b10f5b5724a3535ae4e5fe893a8a3a50", "object_relation": "md5", "Tag": [ { "name": "64-176-201-250", "colour": "#59FF4E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875577, "uuid": "c339bb8e-4d28-4432-b59c-e231fdd26205", "comment": "Malware payload", "value": "3a23705efcde642173ad9061d00d79ed279d1abdfe5f502d54e375781475d3a1", "object_relation": "sha256", "Tag": [ { "name": "64-176-201-250", "colour": "#59FF4E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875577, "uuid": "20ad53fb-5bf0-457a-876f-f24a58556765", "comment": "Malware payload", "value": "adbe82052a64c2313c6fcf1800cbd84776a916aa", "object_relation": "sha1", "Tag": [ { "name": "64-176-201-250", "colour": "#59FF4E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875577, "uuid": "4765f600-b22d-4ac4-a28e-36f632c06d9f", "comment": "Malware payload", "value": "734d5377c5a1307d139f7695d575b492d1567f758d3469490480f765bcdb825a7d7ae4f4cf5a80631df0eecb7b5de18d", "object_relation": "sha3-384", "Tag": [ { "name": "64-176-201-250", "colour": "#59FF4E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875577, "uuid": "ecd4e8e3-428f-4e8f-9253-d7bc3f1d2d4e", "value": "T123A44A746DE24E5BC05E41FE83341334AADFE283596352AB68ED6CEDDC1EA451F42883", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875577, "uuid": "6ee28b55-6c6f-429d-9656-9ab114d90e5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875577, "uuid": "9c7d9faf-88ca-46d2-b47a-2e314793b065", "value": "12288:Q+s2gEZ9JIb8888888888888888888l88888SuJTk8888888888888888888888n:Q71EZrIb8888888888888888888l888m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707875577, "uuid": "4f17cbaa-7574-4695-9d54-90ffd3751df0", "value": 466432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707875577, "uuid": "6082b721-9744-4f77-a4c8-eaad131338ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875577, "uuid": "366c98e4-a109-408c-8c2e-c95ef930e736", "value": "lively_setup_x86_full_v2074.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de97b4f-cb38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkGate)", "timestamp": 1707915344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915344, "uuid": "2722d8df-3df3-4c0a-ab9c-ae27a7342fb5", "comment": "Malware payload (DarkGate)", "value": "2999391319cda1be5dacfaf5b05062b2", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915344, "uuid": "28d9fbc9-c3b5-4560-8eb2-b7f25cbc3127", "comment": "Malware payload (DarkGate)", "value": "3bf99810510c197b9cd6e434d95417515dbc42f94b11bbf9916ec160066eb77e", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915344, "uuid": "fab042fe-acb1-41dc-98a7-77d134240587", "comment": "Malware payload (DarkGate)", "value": "c983b7dff2ea4c63f3944e639eb54d0e6b0b655f", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915344, "uuid": "f4fdbec9-5616-4cdd-b358-2fc666a1fb66", "comment": "Malware payload (DarkGate)", "value": "3fca9a5a67684fa6f26d9c922c5856430c5b60df739aa9e26a5580e30401854cb7afd9f30c63ff4d2d7c776966c335c8", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915344, "uuid": "b0c081e6-0ea4-4f73-a99b-6b31a82d7760", "value": "T135566CAB62D88969D01FD2BAC0D2CB03D433F47637F281E7335162753AA65D90E7E258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915344, "uuid": "c965a274-549c-42b9-9f0f-0992386b7f8c", "value": "49152:NpUPFUhtSTK+0THkWsN8SDYdvH5eoQDWeEHHhRgWEF9nuriG7DrFWoRRRJuGgagL:NpMnFDcEWoVoFWRGga5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915344, "uuid": "eac12ee5-7d56-45e1-93ff-72cc47e920ef", "value": 6094848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915344, "uuid": "6dde300c-5816-4665-ae3a-7e4070d5734b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915344, "uuid": "049f975a-1b7d-4d7f-9284-09697e9044f3", "value": "build-x64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fedad1cc-cad2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707871806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707871806, "uuid": "ee2c5c90-d4ed-4a1c-963b-b634c3106e24", "comment": "Malware payload (Mirai)", "value": "76edcba1b898bc0a0fbe3c5085717f29", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707871806, "uuid": "5b5087bc-04db-4047-ba64-8b0f63a0dcd7", "comment": "Malware payload (Mirai)", "value": "3dcca222169de01c291eed48156d2a03edd5f64a1a38827b2517d795d37883f8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707871806, "uuid": "570b02a8-cc54-4c5c-ae83-74ad463ce425", "comment": "Malware payload (Mirai)", "value": "1abe255112a1e7b9b1b4137dc6fed1c940271c69", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707871806, "uuid": "5b53bbef-f24e-4c2c-b63d-3dbb91b91688", "comment": "Malware payload (Mirai)", "value": "9d52119325b5b142cfde8a71200f65e591d626d06f73b893a5b6de8d98b542de6debfd94014ce055c5db645105b0b56b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707871806, "uuid": "e66ccea1-3294-4d44-822b-2a44c6f35969", "value": "T175D33B86FB419A13C0D61B77FA9F424933129B54E3DB73068D185FF43F86A9A4E2350A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707871806, "uuid": "117d972a-8c3c-4be4-af22-7c6b98c43ab1", "value": "3072:6h7um7+ONhLmiTHsSTjpI3SyRTaA508X6GsM/9/sW7m:6h7um7+mm0jpI3SKTE8X6VM/9/sW7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707871806, "uuid": "cb2dbffa-3731-4cb0-8210-295417e4b18c", "value": 138499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707871806, "uuid": "bccadad3-1256-4755-966f-475c9829722b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707871806, "uuid": "6d0df236-c0c8-4c72-8a93-9adab3bf5fa6", "value": "b3astmode.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2d2b57-cb41-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707919477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919477, "uuid": "6ab8d7b4-bd0d-4309-b9b0-1a32b5b252df", "comment": "Malware payload (RemcosRAT)", "value": "d8fa6959c7765d689fa7e3281b46bfb8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919477, "uuid": "8caa6971-fd89-4449-a305-df969e1b9c3b", "comment": "Malware payload (RemcosRAT)", "value": "3e21b228b8e069458460dc632de5d378f51ff7438a26197c50193580ec68e78d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919477, "uuid": "ca6d85b5-7b0e-46ae-8aa0-ac4f3fbe9ef6", "comment": "Malware payload (RemcosRAT)", "value": "804ae2c2cb08375cdbb1876dc3234e8d91841747", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919477, "uuid": "31af30ea-7f4b-4a12-8637-696d5ac5bdb8", "comment": "Malware payload (RemcosRAT)", "value": "94ce6d3adc53364332188b0fcc8e8f532dd0eb5f9a5ac7008704f393960b2b8dc230be4d97465b12f9f2b7737a775480", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919477, "uuid": "f6640ec4-71fc-4d1d-af3c-aa6bd7680a26", "value": "T1961523283B7430B7DE76A3FF6502D4A30771C8909AA5C7DC8C6A399F15D73A85045B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919477, "uuid": "de3145d3-e2c9-4ccf-92e9-baf6b81bc2c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919477, "uuid": "24e439ca-180b-4f0d-b888-0eed9a190d6f", "value": "24576:zox7nA7gNJV41GiEd1zjIM3Ybl2ES01FzqItCctn:Ex7nAwBi8FD3Y4yz3tCctn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707919477, "uuid": "b8de7d34-4061-49bb-bbd0-e5b495faa7e9", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707919477, "uuid": "69475c34-5041-49c4-a5eb-d818c5e9a511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919477, "uuid": "f4a646ff-8332-4967-b584-97cc443c0129", "value": "z15TFDG098700080000800.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47020fe2-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707915735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915735, "uuid": "e03928bd-9f1e-44d5-af6e-4953d6902ca4", "comment": "Malware payload (AgentTesla)", "value": "9833797b44980709002464e24edd4fb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915735, "uuid": "6cc2a539-c401-4383-a645-ca3812c0d1fc", "comment": "Malware payload (AgentTesla)", "value": "3e58a9e8a1bc613475b7694000856641aacf4a0d4b67cb85b156207d40cc8aff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915735, "uuid": "afdd6b4e-6682-44d1-8c48-2e6e4bd88458", "comment": "Malware payload (AgentTesla)", "value": "6022d3d22085532753b4709744f012aa569cf837", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915735, "uuid": "44fc1ef7-725f-4f8f-891b-729713d935db", "comment": "Malware payload (AgentTesla)", "value": "575da6646b3578658aad2dad56d29f53b8066a451cdf1d0e6be3d949ac8c4d006bead4f9ef2266647b8c7bffc14bad78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915735, "uuid": "e677ac16-6c64-41d8-95d0-6dff5c59c353", "value": "T1E0E423093A2D8772D6DECFB69078ADC293F531693864EF149C8860E58E7B7C48973613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915735, "uuid": "28e47532-64af-466d-a4f5-3dfd3048749d", "value": "12288:aiD2vsKnBtFk3FGrN+CrL9f4DAehh1uj+QdEJA+mWhjc0jvhbzdTbFUahWD:OTXUFQX5Deh3udL+m0I09HdTb3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915735, "uuid": "8b0f6e99-1b0d-4819-b1be-b789473e5e43", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915735, "uuid": "70f0b3c2-f806-45fb-bdc9-3685ecbb5316", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915735, "uuid": "e51f0d37-5182-4aca-822d-99581e09b2c0", "value": "Quotation Request (URGENT).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad95b079-cafd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707890138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890138, "uuid": "d0aa02be-2aa6-448c-8adc-394f2844aac4", "comment": "Malware payload (Mirai)", "value": "f16fccf44a1fa981db6a65815481d628", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890138, "uuid": "a1e37197-25c9-4eef-8780-e562a582dc84", "comment": "Malware payload (Mirai)", "value": "4185b3d9dfb85673cd0c28df54bc80df9e4593f50917ed180379f12f8419431b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890138, "uuid": "7f1003f5-00ad-4617-bbf5-6a87364cdec7", "comment": "Malware payload (Mirai)", "value": "ac79fef30b3592e2dc4383a7d1fd8f993cbfcec6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890138, "uuid": "e42dae3c-a1ba-47ea-aa4c-6b646a28cd6d", "comment": "Malware payload (Mirai)", "value": "63af93cccc33f6f669a68ce3170f212a74d629514f3b4a3285ac6ae3db149481679b5be0f18aa48f8b2d0d8ddeff7457", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890138, "uuid": "3c8cf8a0-af79-4a75-bc81-ee6a6ff0635e", "value": "T165C32A56E6404B13C0D6177ABAEF42453323A7A4A3DB730695285FB43F86B9F0E63906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890138, "uuid": "ce963ed4-f7f9-4c10-9710-a9c27075ca9b", "value": "1536:w0nPFr4yXKG4XHhWNW1nSwhyTxJNlQGi7CxpQIn6DDKknKGDzw/9P1n9g85S1l3z:D1YQNW1nSwhRTCxWI4DZnKWM/9xaWmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707890138, "uuid": "e92a6ab3-009a-4b11-93a0-bb8dafba213c", "value": 124212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707890138, "uuid": "12e9b7fa-8a94-4f48-abf5-25d0df637bb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890138, "uuid": "6671a66d-f5c7-47b6-b2cf-c65250574fd6", "value": "skid.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e26948b2-cb38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707915567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915567, "uuid": "d20606a9-4def-4881-9bd3-7dd98537d064", "comment": "Malware payload (AgentTesla)", "value": "3e53c7dc71d279d027aaf595e52aefbd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915567, "uuid": "a8a1a37d-93f5-4a54-9f89-78dac6a5171d", "comment": "Malware payload (AgentTesla)", "value": "424dcd42dd8561a5943cd7472f80433d84ff431166a0f292383c9b299dfdeeaa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915567, "uuid": "8278e25b-a067-4ffc-81c0-56ae3393e6d7", "comment": "Malware payload (AgentTesla)", "value": "b1887a940e2880f493a62c68d769ae39975844f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915567, "uuid": "ba5b3ee1-9aec-4113-b7ee-cf54b1ab3d17", "comment": "Malware payload (AgentTesla)", "value": "70da444902b2b57899d5e776a6da771f8a772020b62f79f360946b97b8a13534b35fe9b64f046be88a50275f18bf3d86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915567, "uuid": "3842c40d-f003-4f3c-b525-15543e13feee", "value": "T1A1334B01B3E85732F9EF1F77A8BA91445230F7A67813D60E22E452954C737508BE26AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915567, "uuid": "5b769e29-1b6c-46ab-9380-5c3e597c2a44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915567, "uuid": "54e7c9e2-948b-4a5e-a7e2-42b99f3695ae", "value": "768:6gwt/6u+iBBO/gyXWfLmdWCI8Avera5Sc8B3mi/2ZsLbVHkida5vEFiRbb:6gkB+d/gO/vIaMYT2AVHiveiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915567, "uuid": "0a02f201-82cf-4ef6-9379-4a4d60a1da29", "value": 54160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915567, "uuid": "0e633870-bd23-4f35-b698-6ebd9f69beea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915567, "uuid": "4d440390-0587-46d7-b0ee-73eaf78edad5", "value": "DHL STATEMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fbb2315-cb38-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707915401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915401, "uuid": "c133d1a0-bd53-441d-bb4b-5ee12d376da1", "comment": "Malware payload", "value": "a3a4438b1ecf4620d6eb2195efabfd45", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915401, "uuid": "3906469b-d54d-4a6e-861a-8c70a9752e10", "comment": "Malware payload", "value": "429ff495ec7aaf30c4b4e4955ac31e102d28a5a681a56b0dd3afc3adb961c049", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915401, "uuid": "8f798bc5-c272-4973-bd79-5df3428a828b", "comment": "Malware payload", "value": "9e5fbdcb06e26c3f9b937d56326c0add3918aac6", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915401, "uuid": "b6ad1577-c363-4689-b1b3-afe71c51e09f", "comment": "Malware payload", "value": "ecaa90437ce3795704edd5a327cc7da5ec5f6ab6000e09d6e6262aab9aa3db9890024e5029afb5927b7a9a4885da385f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915401, "uuid": "edd47305-3181-4462-a8b9-5482adfed592", "value": "T118C0C030CB6DC3C716437EE036208C11D833601679EACC1312CE0E0D04C3C55135B8C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915401, "uuid": "81519130-643f-4826-af5f-5dd6ac38acb5", "value": "3:HRAbABGQF0RLUNMuRVZo9ZJiBct1YSvE5Tv1Jj4I5o6Rfg0ck2RMQ5yn:HRYF1mHRI4S85Tvf5oeTckF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915401, "uuid": "4b1e8821-6c3d-48d8-ba84-79bfec49822f", "value": 180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915401, "uuid": "4f87a208-fa88-49e6-9d83-bcdd106c127a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915401, "uuid": "428da7b2-6283-4d29-955e-8be5b05ef4c8", "value": "invoice_20240214064510.pdf.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332eb552-cb1f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707904535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707904535, "uuid": "5ad539ec-d184-4f1d-9438-d87dd9d32779", "comment": "Malware payload (Formbook)", "value": "d9d0d9017bda7878be11f91b928123fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707904535, "uuid": "15ad9b2c-5119-4c07-af99-04980f821361", "comment": "Malware payload (Formbook)", "value": "42b875ba2d7d655249fb6a50f8106b7070fcba963a9030f72558b1632e0c6a6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707904535, "uuid": "b9226323-dc7e-46d7-b105-66ddcbefbfcb", "comment": "Malware payload (Formbook)", "value": "c9107b01689d61e4a28d248673172f761ec30b10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707904535, "uuid": "d9932305-efcb-4103-9f75-f4d9fd0ca3fa", "comment": "Malware payload (Formbook)", "value": "bdb23b64554b85c6eeed8c7d55a5b411d25bfe4715928b1bba254400b5e9786b7329f23a4adabacd732c5e4968590634", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707904535, "uuid": "1ce3b62a-6a4f-4232-bc0a-45edf4d723ff", "value": "T17A05BD14B3F91619F1FF0B7BE5B1102686BAFE0ABD12C74E1951568E0C66B80CDA1B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707904535, "uuid": "2c78a424-4ea8-4c75-bd9f-371573df9db5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707904535, "uuid": "9fe68f65-59f9-4c8f-bd92-d45e8062429c", "value": "12288:me69UNW+A0BP+T6r/IO9ywjI4DBbWry2boplbuvCxefwB351UuzLolq5Ic:mer5T/IsjIubQbMlbifwBzPoMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707904535, "uuid": "93fe289a-25ff-4bd2-a7ee-49d1a87bebe6", "value": 862208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707904535, "uuid": "7c205f64-a650-425f-a398-07de6f3b20e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707904535, "uuid": "53b2bc8b-0b8c-4a99-a167-9670272390a1", "value": "d9d0d9017bda7878be11f91b928123fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04657c9-cb0b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707896155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707896155, "uuid": "04867d17-16b2-42df-8e82-d08f27247d54", "comment": "Malware payload (Mirai)", "value": "405777d5f26f6d782f6d352033be82f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707896155, "uuid": "03a6d155-9226-47fe-95ff-f25418dd2b1d", "comment": "Malware payload (Mirai)", "value": "43ee6506eae4fbb3358498b818801512fa61262ee21d37b3fcab2dbf7c788da3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707896155, "uuid": "324ebcd9-45f4-4a91-aa5a-194463cf2690", "comment": "Malware payload (Mirai)", "value": "d76acf685a43c5d1dd2a999d95c995847e590807", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707896155, "uuid": "64aba14e-74b9-4972-b0b6-ff6554123ed1", "comment": "Malware payload (Mirai)", "value": "606c9667ba3e18d5cf6b01724679dea09d4323b5c174e183effc6d4a24af09abb08fb71d8488f84a8a6868737552f3d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707896155, "uuid": "1b45d4f3-23b7-4bb1-95e9-345bb3be00bc", "value": "T105D2DFECE5A49247EB5C18BE80DD17616F41B082320BEB9A77604C899212D9FF55A0BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707896155, "uuid": "f0739724-eab0-4ea8-83e1-1e684b34c35e", "value": "768:jMYHb623BWixcolXbq0on0qk3On5mPCAWW:JbFBWQDet0qkB6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707896155, "uuid": "462c308a-6c9e-4951-b8dc-66110f46c8c3", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707896155, "uuid": "da3379da-eaac-4de3-b375-63be9776efcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707896155, "uuid": "0d5a4364-2e99-44d6-b537-cf1a10f3d90f", "value": "405777d5f26f6d782f6d352033be82f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f6200b6-cb1f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707904529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707904529, "uuid": "9e028a8c-b39d-4d6c-a042-1b195fba4582", "comment": "Malware payload (Mirai)", "value": "525aaf0f7b8ffd7f29390ae94b183589", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707904529, "uuid": "4358c823-e57e-4c4d-ac43-ac4a2b677ac7", "comment": "Malware payload (Mirai)", "value": "46685b83bf9ff1c82284c8ace23a4ab5ab80ac69400cefb874eab99fb96b9fd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707904529, "uuid": "f97c79d7-b9d5-451b-88f2-1940910c861e", "comment": "Malware payload (Mirai)", "value": "bc83d179bdabd71ece2e2efc9cc1ba54c2ca1702", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707904529, "uuid": "68451ee6-81e2-4e22-851b-7ee4c72dfd9b", "comment": "Malware payload (Mirai)", "value": "36a677db51d2767f9d34a2acf9667e981559a61ea411f0e4db32f6ccc622400298a096aeec3c3168cba864661d3b7b9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707904529, "uuid": "6aea7d4e-0299-4c5c-a49a-d3238f5a5974", "value": "T12DD2C09BFA557DC8D2ACDE3B495D03704DD4A8E230CA8B8977714D88AF4DA1F76060B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707904529, "uuid": "e7f3ddaf-605a-4689-bf90-88f58a29f3b5", "value": "768:mAsi7oKx1FyP1EXQi9tcL+nmubF3CDwWu:mdi7oMUEAi9StKF35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707904529, "uuid": "42c73e87-f20f-420e-8fe0-31b371073d49", "value": 28516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707904529, "uuid": "43ac5567-55eb-4ed9-95a8-f8b9f762bf9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707904529, "uuid": "ce10d951-ffcb-4c4b-bd27-3f7e07dbdc14", "value": "525aaf0f7b8ffd7f29390ae94b183589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de371178-cb4b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1707923720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707923720, "uuid": "d89530c7-f40d-496d-ba1e-27bf80d7582f", "comment": "Malware payload (Loki)", "value": "9d75b956b1aaaa9f0bbb13cb760f7494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707923720, "uuid": "0371cd02-8201-4436-975b-4c2e61c4afc6", "comment": "Malware payload (Loki)", "value": "475605b7bec0b5c75c6e2592fd3484c2355c7d20070efdf29bb3091270f3e512", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707923720, "uuid": "1fd0a40a-8bfe-4dfd-9fb3-4a7ef204c82b", "comment": "Malware payload (Loki)", "value": "612f4c7d0d30d1c9250a5bfaaade25f950f5012e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707923720, "uuid": "dcdb694d-5900-40fe-9351-891da019fb72", "comment": "Malware payload (Loki)", "value": "476ebb13e145b0b5bfe2fe9f74a7f3113036f82dc101be29978358ed07cb28d2c3665f697e204ec75071180cd70714d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707923720, "uuid": "74b70bc4-13de-49f0-947b-f5593ffa9657", "value": "T10D154A23B89E8072CB72277D4965AAD5ABB41C2D0299B14F13E83D3DCD7D4411F2FA1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707923720, "uuid": "2b081c76-0fc0-4b1e-8c31-17d70b26cfb0", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707923720, "uuid": "6e76435d-5fe8-4317-b35e-e4cd040f9a29", "value": "12288:ghkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a1yUz4qVqcVWYh/e+Wf:oRmJkcoQricOIQxiZY1ia17cqV1teZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707923720, "uuid": "c64053f0-904c-4a8a-b914-5a8dcb37cf0f", "value": 949779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707923720, "uuid": "1e301843-151c-49ac-b00c-570318a8d403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707923720, "uuid": "3274c20b-f40a-4150-aaf8-e782f9f09f5c", "value": "Corresponding Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060969c4-cae5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707879549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707879549, "uuid": "cbb10129-9a2e-4054-b86f-3e70d772625d", "comment": "Malware payload", "value": "67328b9fa0636fcc8686db3647f78bdf", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707879549, "uuid": "8b5a016b-76a1-4faf-85c6-9a02aa72bb3a", "comment": "Malware payload", "value": "4766be0783b2512c3301909586bc8b5b97afb848cf0bc99df91151d6f56bc5d5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707879549, "uuid": "16c69b4c-83f5-4ddf-921b-da1f501cb811", "comment": "Malware payload", "value": "bb7933267106a988d5b29c5b2b86403871e217e3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707879549, "uuid": "13fd9ce5-96fc-469e-8d9b-3b0fe2971f61", "comment": "Malware payload", "value": "757faebc5a00fb5bbb4441503956ea52d7522f86a279de8624f4defb3a5ece78fc044f7bf19dcee0f6f6af1dd18370b1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707879549, "uuid": "3fba69ce-1c5c-4a7d-a9d1-546c9cd92742", "value": "T1F3573311A287CA36C51D427BE468FF1E4875BEA3073101E7B2E97C6989F1CC1A5B8B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707879549, "uuid": "c016f708-9402-448c-b78c-9084724a03e9", "value": "786432:XiVCuI6dl6Pb96E9wNCaUTTJsllTKmzp:y9dlq9GUSl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707879549, "uuid": "5ee4eaf0-1df4-47a2-9d2e-37f214b56f08", "value": 28114432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707879549, "uuid": "2eb0b96f-e268-4d64-b884-26493247b1d6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707879549, "uuid": "419bcecd-08c3-4fc9-b6ec-8b8112852df7", "value": "LUZDELSUR-RECIBOMOROSO.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0176cc91-cb0b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707895862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895862, "uuid": "5a1671ca-dfae-4dea-a0dd-843d2be553eb", "comment": "Malware payload (Mirai)", "value": "44c8f2a057790c12835fa1438c8577a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895862, "uuid": "4fb0105d-f313-4e0e-a412-48c4f19a74c1", "comment": "Malware payload (Mirai)", "value": "487e9b6d07d22032b7db8b383206b0f5b9340608fd781f22d99a6d7cbd2ecb8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895862, "uuid": "7daad256-d306-4146-8ef5-b694103d6bcf", "comment": "Malware payload (Mirai)", "value": "e4e5ff4647ae63af85fb11e0fa2e50d85742372b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895862, "uuid": "cb3da797-7144-4601-abf6-88f205934335", "comment": "Malware payload (Mirai)", "value": "a635dcb095d675abe8158a7abc77a1dbb5f413b43d3700e6c3546f3c5d533fa13ef1cd032f148cb699a4902795b8778a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895862, "uuid": "f526d569-b859-4152-84c1-da85878c7104", "value": "T169533B99F4028E3DF88FE9B984160E05B93023D212931B276BAEFDE37D331659D12D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895862, "uuid": "860371f5-79df-4728-ba02-4b84304fc3a3", "value": "768:Ge4gpsM204GEkRbj3eXVVnQiiQthc3gFHu1eu48B8vB6J7EzNfXuuJpozCK3+:Go3EkRbreSiPDFu1X48B2SEzNfeuJOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707895862, "uuid": "36ff5dc7-ec75-40d3-823b-3cf3b022a68b", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707895862, "uuid": "c584169e-5a08-42ad-9a7d-b7f017784fa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895862, "uuid": "444e0f1a-fee6-4d6f-80df-0e6b6f7c663d", "value": "44c8f2a057790c12835fa1438c8577a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47446ce-cb44-11ee-b7ea-42010a9c0006", "comment": "Malware payload (FormBook)", "timestamp": 1707920644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920644, "uuid": "d6fcc94c-ff63-44b3-919a-1ef90b5a0d56", "comment": "Malware payload (FormBook)", "value": "cc9b350e7a9831f16a750f62257025a0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920644, "uuid": "068a31ec-97cd-43ec-ae62-0dc5413e9827", "comment": "Malware payload (FormBook)", "value": "4898b46986b9c742657bd0810efee5abb54db259f27661d0ddc881c45590377f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920644, "uuid": "922279ac-4db2-481c-9b42-2c50dab78895", "comment": "Malware payload (FormBook)", "value": "15697a4b5720c1dc94474df649f17edb2df1f5c4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920644, "uuid": "1a9601d4-b623-47e4-9dbc-49ffaf3d9cd9", "comment": "Malware payload (FormBook)", "value": "9d97d75429f4d55ba511f28545b90e2700cf6b7b3f50894531604a6bae02496d1fc25e0b3dc4e4233f147fb40bd68f8c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920644, "uuid": "eff7e96c-3f36-4faa-9c39-cb5e6c3075d1", "value": "T14AA55B767A927EDBE07BD8CCC08E1D85CDB1EC7F81A0654A7B4B717B19A7150FA010A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920644, "uuid": "eed08149-fcf0-43f4-9f5c-f1e2db0851c5", "value": "24576:zw0OOKKFC+cx9RAd4+TN4o9cxJgI5DcQv8GXfK7sbsWU6jCNAPNw:jPdcxod4JfgCXfL7jCiP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707920644, "uuid": "44074495-d750-451d-a222-963987041913", "value": 2144707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707920644, "uuid": "e6ef1f42-977b-4df2-b7bc-082c85ef3f73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920644, "uuid": "aa8b2cd1-c914-44c0-9a4e-e449220f997f", "value": "Signed_order_021424.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b723ef8-cb80-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707946184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707946184, "uuid": "26ebb214-f694-4ef1-8529-8400fa56e52f", "comment": "Malware payload", "value": "cc3b9e73174f649a80978c85d270c327", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707946184, "uuid": "3ca3a0f1-63ce-4a30-92f5-9ca8626301f1", "comment": "Malware payload", "value": "48a03463a38e7e382946f28d6fd335fe9dd04fa361ee2aea2c591d97fd630c18", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707946184, "uuid": "2eba84a8-be67-49e4-8d01-9e99531bf80a", "comment": "Malware payload", "value": "af75c2de4998cb95444734d63fa624ca0a204aab", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707946184, "uuid": "327f0f48-1ccf-4102-a214-f522ff107930", "comment": "Malware payload", "value": "4753c2791aa6eddea034528e85be8858d41ae3b39a3ffa4cbdc89e5439c9adc93afb0bf4b390e1c58bbcab629fe9c978", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707946184, "uuid": "f27d0a1e-934a-4024-b8d1-8f0b1ae2d99e", "value": "T1FCA31221CEEFA4C4F00A12224A7811C6FC8DD7A157FB51B1A60476FBB71AB6C9C0CD82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707946184, "uuid": "5727a337-1d51-4d4d-ac55-710afb99d0f1", "value": "3072:Sr42yRV3isPSGpbHSz3wqek1XpaZAgM3U0h0j:+pyL5/pmzgXKGN0h0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707946184, "uuid": "16dd897f-9425-4d4e-a42c-ed6276a49f1f", "value": 103867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707946184, "uuid": "df643501-dd94-477b-a2fc-d67494f89f5c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707946184, "uuid": "bc4ccc1f-4c5b-43d1-a3ee-b137037d3675", "value": "DOLORESJ.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb46cdbe-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707915957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915957, "uuid": "d778b97b-b1a8-488f-bac8-d5cbc294e1bc", "comment": "Malware payload (RemcosRAT)", "value": "ef4b2fbeecb9121ca199ed2d60fe56a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915957, "uuid": "4710e472-9f25-410c-a0d4-8f9c9bbb6826", "comment": "Malware payload (RemcosRAT)", "value": "48e084d0d4c39bfe350c6f5d9aa67d5bf7968b774d890f1e75d2366e886ce78a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915957, "uuid": "215d85a1-3386-456d-acde-f579ac253561", "comment": "Malware payload (RemcosRAT)", "value": "0f437870965b98e910fcdd2521071776622a8805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915957, "uuid": "171c98f8-5c02-4926-94db-4d05a693d0d5", "comment": "Malware payload (RemcosRAT)", "value": "552929ca9080abffdb21d81ac684353d2a2d1f0a999ac844a4cbfb586aacfaebdd5786d5f36a84b5ab6f66fc8a0b9d90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915957, "uuid": "f361bc85-7f7b-4072-b02e-a4dd3349e001", "value": "T18EB4CE85FB509268ED2ED7311936CE7102237D6DA172AA1D79CF3DBB3EBBA429001417", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915957, "uuid": "33924f96-0e10-46ab-8812-51dd3a1d3963", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915957, "uuid": "f5ad8402-be88-4ca9-a300-d3d059895baa", "value": "6144:fClMw2Xp5wLj3OcbQxfxtvm2vJ3L1IsQbuecFI:f8Mw2XwLDTQxfx7vMpuev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915957, "uuid": "8f745783-c033-471c-a638-37c1385964f6", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915957, "uuid": "b04dd090-199e-4157-b57f-c83ac3c7cc81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915957, "uuid": "1b4df0a0-a9cc-4fd1-89a5-27f052506476", "value": "6fdp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0521082b-cb0b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707895868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895868, "uuid": "54b3e0b8-2153-4997-860a-2a6b1f456a93", "comment": "Malware payload (Mirai)", "value": "c09888d64dcea8dadd79f6a2fb6c2cb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895868, "uuid": "ab24bfdf-5f77-42be-a95d-64989a78c2b9", "comment": "Malware payload (Mirai)", "value": "4991b83c26882c1af8c0a016bc312e23f29825c6daf1797aa1fabacda60c4c4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895868, "uuid": "8f5e7c58-f057-4c8f-a528-7cbaefda2e90", "comment": "Malware payload (Mirai)", "value": "5b5e25ba2be5db2c34186194a2752faecdc3e461", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895868, "uuid": "2fe583e0-47e5-4320-bc7b-85113acd0cc7", "comment": "Malware payload (Mirai)", "value": "888098fe66f76fcfd7d9e5a85df29508bebf7c6ae308e05ae80ad1fd51a54dc7625832305c3ae27123e092b08c9bdeeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895868, "uuid": "1cc8a465-be2f-4319-b640-8b33847dff3f", "value": "T148E2E18A85B4EC32DCF10839DC9F4A192A0E1BF9CCFB19560591236C279584D4E763E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895868, "uuid": "69d0bc54-40c3-4704-8176-04b9ecdcd64f", "value": "768:q8Lm6COq1fewJiTpCUdMDOr8//ca04uGPda7b0L/0XIMN9q3UELdT:zLJCnexMq8//ca5PYY/tLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707895868, "uuid": "70e86b7e-0173-469b-99d5-799814371eca", "value": 31864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707895868, "uuid": "e7e0e3f9-aa54-4482-afcf-0b1ee6f3407e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895868, "uuid": "e805e32d-5a3a-4ac3-a303-4ca2c53e3e03", "value": "c09888d64dcea8dadd79f6a2fb6c2cb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22abf8af-cb0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707895488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895488, "uuid": "42950f9a-de51-4960-af2c-4147ded09bd1", "comment": "Malware payload", "value": "0225acee4e1d577bdea3b530941db1ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895488, "uuid": "09c4dc3b-c170-47e3-8b61-656b24337aa1", "comment": "Malware payload", "value": "4a38df7112014db2054dd7e8698d74d35e0acb6a60522b2299601a51519a08f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895488, "uuid": "1c3d86e3-b07b-484f-ab76-b4089c6b2c8c", "comment": "Malware payload", "value": "269e4e4402f966ba0a6fd453fd0ea8aaad8a600f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895488, "uuid": "1a246d28-3bd2-40a2-926f-ca46b305b508", "comment": "Malware payload", "value": "e49723309dd718b1eec79b1a210ddc11da2cc6bf16cba813544f6fe6779099e0a6880f26403d2ae465e36a20f891324f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895488, "uuid": "3f513206-953e-4961-a86a-edf71cc23a62", "value": "T1EF955C12F2E14873D0231B349D6B4A75A93B7E202D38954B37BC7E6C5F76281382979B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895488, "uuid": "cd9ff624-0925-4f19-aad9-1bd086477a0d", "value": "d4f4f0abbf6e8fa24ac883e13b380edd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895488, "uuid": "60ec5607-2421-4076-802e-11374a8cb2be", "value": "24576:wzoDgvAbAMtFsMQHkIv5iAkvG1IWaSAZ4eDgdCVbw8n65kfJgXdwC:nc+71bbv6ogdAnwKcdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707895488, "uuid": "46431cfb-b595-4367-9fc8-3ff2e2cf82f0", "value": 2053120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707895488, "uuid": "d7f5338c-3a68-4962-a849-56e1e8465825", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895488, "uuid": "39d81a86-0496-40b8-98e5-362298689dda", "value": "0225acee4e1d577bdea3b530941db1ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e03312-cb60-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707932625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707932625, "uuid": "baa516de-f8bb-4e4f-ae83-707f5d6b7008", "comment": "Malware payload", "value": "1d125d579cf9557d68b5d2952623bb33", "object_relation": "md5", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707932625, "uuid": "b8576643-b8cc-42a3-95b7-fe9370a226ea", "comment": "Malware payload", "value": "4a6420fd97ab520ba77c346ba0cf94afa1b4bea721cee1ca229cfe01d9823097", "object_relation": "sha256", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707932625, "uuid": "c3b61b22-36e7-4006-ade1-82835016aace", "comment": "Malware payload", "value": "742817ba16197115190cf031a33210e91d8f1681", "object_relation": "sha1", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707932625, "uuid": "3fd5b1e4-2a11-4364-9571-1e93942d268b", "comment": "Malware payload", "value": "a1e3797fc8a299233d76e7265ef86ab4e6f1307aa9a7970ac179b8bfb75fe0ab1ad29e36fb6498ec6900ebcd004e368c", "object_relation": "sha3-384", "Tag": [ { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707932625, "uuid": "ab5d2e2c-f09e-445a-8ebb-bdb7914fbc21", "value": "T11C1112F7E7C5A8F191CC46D9ECC09908BB8C734A85B4BC0AD95498320274A5E70712B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707932625, "uuid": "63c84710-9f98-42b7-830f-0089d3b2f25a", "value": "24:TgtZkaVwdgtNHszBXg3UMjgtrLFtgtr1FOVgtja94Hg/C:Mn1VVrs9Qx8BFyvFO6keHg/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707932625, "uuid": "6679469d-074a-4ed4-b838-f0da4cfa3e1b", "value": 1070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707932625, "uuid": "96d10c34-f4de-431e-8eb3-555264989386", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707932625, "uuid": "20e9c3aa-ac40-41fa-bba5-fbf0c21d4a62", "value": "Adjuntos-cfdi-jbzDAIDD(252).PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46386c08-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707915734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915734, "uuid": "64f325c9-c4cb-4b42-8ddd-015b4bdcdee1", "comment": "Malware payload (Formbook)", "value": "edc316b8803b0f0266cfae097c3750dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915734, "uuid": "49ea9744-6150-4329-b961-c16fb045783e", "comment": "Malware payload (Formbook)", "value": "4a750d67fcf8282a6ac9bed9aaa4ad1f002859ce6de73ee72697b840a33e3cf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915734, "uuid": "870da8fe-5c99-4483-8dd8-870fe99f57f6", "comment": "Malware payload (Formbook)", "value": "b4c45c0ed929f6e9c9db2f05a7bfa396395137ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915734, "uuid": "8cbc8212-81dc-4e87-839e-4ac457c99d7e", "comment": "Malware payload (Formbook)", "value": "bff3f3e1c80039ca35efb030b1d1a7c18a1cbef411e82b418189f11ba7b09758cac280de191c86b906473dd7e1805ef6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915734, "uuid": "29ab2060-375f-489a-817c-b52059d2c47b", "value": "T185E42354BCA857A3EC9D4BFCA465C9D303F229652AA6EFC9EDC070C71CB9F505612283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915734, "uuid": "9d7ec731-579b-4327-9ea1-5161d0172a7c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915734, "uuid": "d833e8e6-0e48-4d16-b186-c310663f5729", "value": "12288:biD2s8lu1etjBvkAr610m71/4qeElK7nzh6xVWporlBQcgiW78Dwahjny0:MIwet9kNe2lEDzh6xVA0BRhW78DwaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915734, "uuid": "5e4c3aaf-bc68-47d2-b643-12f1ccb9b339", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915734, "uuid": "302b5b60-3056-4fc7-949d-d311f8077f48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915734, "uuid": "6e2c747a-5890-4e08-bddd-08dac056534c", "value": "STG CFS Arrival Notice - pickup - RN 20248008-03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91b850b-cb3f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1707918531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918531, "uuid": "23803891-2033-4315-9dbd-08bc2132e069", "comment": "Malware payload (zgRAT)", "value": "d05d378744e4e2f22321548cc1cdb7c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918531, "uuid": "fb2a76f5-7113-4152-8fc3-32caffb8a937", "comment": "Malware payload (zgRAT)", "value": "4a95a724256b627867947bfafd12e86328cc52acedfe810c37883f4fb5320762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918531, "uuid": "1eeedbd1-2edc-4544-9715-58bfca9c63b6", "comment": "Malware payload (zgRAT)", "value": "ce2addfba34bfaefa9e30d81dd4c8c47c5331c3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918531, "uuid": "d6169f99-fb95-4dc8-976d-a2a3fe351e36", "comment": "Malware payload (zgRAT)", "value": "131d6c428974e38dbe418a15d90314d839b2e75df1be3df1049ea774a471e5750048e41790c15ea9215dee62c6f9b5dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918531, "uuid": "c945aede-ea68-4e9b-b7bc-53e4ab099759", "value": "T1C636CF037655CE13C38AE237D2D2691053A7D6D2AB1AF34B37C112F829837DF5D8A986", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918531, "uuid": "81256629-acea-4f20-be6c-76177c75ff99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918531, "uuid": "c6097fae-3397-4755-b566-616aa912ea70", "value": "98304:Ig8VCM/9DsoEvdB4IHfajsirUtTYq2hYizm6dvD8T4bxJFoXkF09RnVmFHXFZfsr:Ig8VCM/9DsoEvdB4IHfajsirUtTYq2hW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707918531, "uuid": "3bf076b8-ca1d-4bf7-8552-5e06d16e7d8b", "value": 4961440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707918531, "uuid": "7bde3dfa-d438-4d9d-963d-aa9bd3ec5be2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918531, "uuid": "9e91678c-dd24-4db2-84a7-342c3bcc40a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2c76ce-cb3f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1707918618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918618, "uuid": "44e16ab0-8dd2-4195-bbfa-3dcbacea488d", "comment": "Malware payload (RecordBreaker)", "value": "e88da5d3f528d78eabc2de83797c2195", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918618, "uuid": "2f4cb783-d829-4ef5-9f61-7d4371e0feba", "comment": "Malware payload (RecordBreaker)", "value": "4b06c62c07429d0bbc7f9126a18c2e959e5c52c09236dbfb5b16a09390f0a300", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918618, "uuid": "5f867380-2908-4d1c-bf0c-a9900abb1200", "comment": "Malware payload (RecordBreaker)", "value": "7937c0b3fac48fa50aa74e80387a6ff6f463c978", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918618, "uuid": "5b31ed11-0b00-4017-9655-0829f23fb6f2", "comment": "Malware payload (RecordBreaker)", "value": "7a22c8fd6725ef6dbecd3373c5856fc0d79d96aaf656f03d722cf9db8453ad87049e1d0309ac624e9fc316a96ad2881a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918618, "uuid": "6135efc7-2209-416b-9833-5f01bb630e20", "value": "T15B549D3023D4D0B1D343153489A5E7B10EEEB867F262BA8F6FD5E63E1E382959217319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918618, "uuid": "22900870-7cea-4bec-9325-0ef7b3c66a29", "value": "7a16202dd7202181174ee4ca5dc3433f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918618, "uuid": "9dc5e0d1-bda4-47bc-b696-50c52d97862a", "value": "3072:OziRfFi3WzI2OfoyFIUVvBmAx0H3q0eJ5cLw5p0s0hQUxaIa2VM:/RfFDG3FJVvtyeJ5JKQUxaIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707918618, "uuid": "d91e6517-a27c-4243-91a3-bd6af633ee29", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707918618, "uuid": "e3631045-bd69-460d-8792-75ab44662112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918618, "uuid": "2640d55b-fb5c-425d-8e74-86e88a27b9b2", "value": "e88da5d3f528d78eabc2de83797c2195.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d29d1a-cb43-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707919913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919913, "uuid": "5633fc67-5bda-4054-b58b-ad268856beae", "comment": "Malware payload (Formbook)", "value": "d88d07a281f91948a3d839b9908d5a8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919913, "uuid": "3f273947-9e03-41bb-b748-25620a5be9f7", "comment": "Malware payload (Formbook)", "value": "4b7e7f50f5a8101616a2d09fbff3a3d9c3c3b3b0dc2ded2a52b6540e7ec3a558", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919913, "uuid": "b6716b0c-af69-4a2f-a354-eb8aff929aec", "comment": "Malware payload (Formbook)", "value": "e5896b83e7252e6eb77b472a6f92775cb93b6940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919913, "uuid": "59c96f3d-7af6-4df7-b730-ec5804ca0f2e", "comment": "Malware payload (Formbook)", "value": "e2c271ef13b0280d3506b3bbbddbda63e036a335d965a863a009be1a8586874a857ab674270607c273376039793c7dac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919913, "uuid": "ede3fc41-e26f-49a2-aa83-b9c943a4a149", "value": "T145D423823761EE39C82C5FBA72A21951ABB3774D4E40C75D5DB234E838B73938241B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919913, "uuid": "28c0b003-248b-4d43-9e2e-f53ee321af07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919913, "uuid": "8537c754-f535-41c4-8eeb-f237b4f4817a", "value": "12288:KyuceQ5vzi5zYZOucMneauj60nEkP1IZl27lvcmTPYK5+7D4lg6B8r:hri5zYJn2pEdHulvc2YwgUf6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707919913, "uuid": "f8a9958f-0081-47d7-9aa2-21bb2a800009", "value": 623616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707919913, "uuid": "d89e425b-4a2b-4bfa-bad6-e58b97d67433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919913, "uuid": "8fd7ee7b-962c-411c-a74e-b89a47bd726a", "value": "z14POO230487PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f18343e-cadb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707875403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875403, "uuid": "eff1ebe2-56bd-4ef4-b096-22b5824ffdb8", "comment": "Malware payload (Mirai)", "value": "cd2c8f813f3c73bdb42a775030a82bc7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875403, "uuid": "402a739e-cbf0-42ab-b794-defab7ae2de3", "comment": "Malware payload (Mirai)", "value": "4ca6f4025e556977002d70e48a4f6414a4e957522a481bd4b1fabf1b55b98f29", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875403, "uuid": "7f1f258b-1b90-4b27-9b5b-4ff25ab000fc", "comment": "Malware payload (Mirai)", "value": "09ff69c4c8d9feeb3f66740d48364af6f88d6e74", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875403, "uuid": "fa932946-22d6-4c04-a902-edc0b679b972", "comment": "Malware payload (Mirai)", "value": "b2af93c34242d9efdffa715e65cf019f7a034d54df8d664353c3c5d1e8d261c899eca0208f933d649c3b983e8b50eff9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875403, "uuid": "38b4caea-2648-47b6-b9a5-b375d7c304f2", "value": "T15133F162676D79E191708777FC33AC5AA6DC17B89867309A28F4A61973C18024FF27C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875403, "uuid": "fa1173b9-8b57-41d3-bbdb-e2bfe89c37c9", "value": "1536:d9O/ZMAXIxNUk0NyLcPqF1aBexo4opKZbT:d9O/ZNKyhyLGqFUFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707875403, "uuid": "859e82ee-a946-4f8c-a3fd-81666069addf", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707875403, "uuid": "18f037c8-0352-48af-b857-af307739bb52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875403, "uuid": "69985f65-82e3-4b9c-841b-49b919ba0e34", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfcb5c4f-cb24-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707906946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707906946, "uuid": "38688d8a-a24e-47c0-bce0-1581d7668cd9", "comment": "Malware payload (RiseProStealer)", "value": "b2f94ce9aaa9c059759890227b5bb6a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707906946, "uuid": "08746331-7347-4091-a981-90addb72bf20", "comment": "Malware payload (RiseProStealer)", "value": "4d6892357278591e0365c59ea6482d4155a2e3c38814ff868c539a8e9dda5157", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707906946, "uuid": "248d3c62-3039-48e1-9794-3c312199ed4f", "comment": "Malware payload (RiseProStealer)", "value": "64f4d45c5db0630c44c3cc05fb2a1d61394aff91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707906946, "uuid": "21e89527-d73c-4fe6-98da-9b288001b74d", "comment": "Malware payload (RiseProStealer)", "value": "83ee783f76546862fb5f53ea97cfe9d8340ae7f56a76aed9c885c3b1901848432809f042ccb04d9835b421077ee5b8f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707906946, "uuid": "386f0c08-e887-412f-9743-bbf27083e1b9", "value": "T1F2E5338BBE825457C3626A358CC2FEF9147FEC01694918EA68FEBF17B5729190D37108", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707906946, "uuid": "41194630-ffb0-4bc1-9c8f-63f946aeef43", "value": "59aeb10eab81e92b5597d86d6e338bce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707906946, "uuid": "318a93a8-089f-4cbf-96e0-e25a2480a0fa", "value": "49152:ftJ+4uoQJ6UYxBdTd2YDMDlnQ/bslJH3RZNe6s+HwGeIzaEraTgSbB8+DfixYEa5:FIoaYxrTd2YDGFkslpbsAwGjzwgqDfi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707906946, "uuid": "18a61ed0-1b61-4d00-973c-d8e241e09b2d", "value": 3112960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707906946, "uuid": "40cf7705-ddbc-4ac5-8789-9a357b492175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707906946, "uuid": "8735ca81-8698-493d-8159-0433837c9059", "value": "SecuriteInfo.com.Win32.TrojanX-gen.6370.3894", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ee4fd7-cb3c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707916975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707916975, "uuid": "ae0fe8a8-6a30-4f04-8a80-3d6bb9f40b05", "comment": "Malware payload", "value": "7b73c29e17fc341427ed7ce08f89a1a8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707916975, "uuid": "4fef8d4c-9a72-4eaa-bb5d-7637975456a1", "comment": "Malware payload", "value": "4e19e2c03067396d1f04975047ee23c80b667976e8e1c67176a49c2a3f32a73e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707916975, "uuid": "b269ff1c-2738-43bb-b50b-606f83f47d4b", "comment": "Malware payload", "value": "7a08bf5074fe5b6841753eff12269aeb47b55b6e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707916975, "uuid": "3f7c316e-ffef-4cbe-ace8-93b3eb8eaa03", "comment": "Malware payload", "value": "172b4e00ff283dded3bc6ad0f9f78baafcc4173448de2d2b4ca1cea7702ac0bf3b7637be214b2c7ae0f30e437885fd55", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707916975, "uuid": "f33984b7-61a9-4568-a2bc-e6b400f1bf1e", "value": "T158C5AC96F759693FC877013309AA5632227BCD168B829787785C372C28776EC0F59BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707916975, "uuid": "77c2c265-866d-46d3-83ba-f41f087dcea6", "value": "24576:v8pHh9Vfb5AVGB76e+340UObnHaUTQ5fSdt9sfQxsI6TnwcxUd8QvlgkrxzfrF8x:Epf8sSHzldcQsI6TnZEZtgklzfrFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707916975, "uuid": "49e0e892-4cfd-491e-a20a-962090dba41c", "value": 2592257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707916975, "uuid": "4ae3a772-db5d-4054-b878-16b3006359ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707916975, "uuid": "a321a69b-fde3-4fb2-8e21-395a9e6b2ad9", "value": "FB_6425313767.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b977922c-cb04-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707893164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893164, "uuid": "6cddedae-8d6f-49f1-9d96-7a7c74190fbe", "comment": "Malware payload (Mirai)", "value": "6bc2a260055de0aa4af05ee9f5ecb3be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893164, "uuid": "90d76906-fc18-4c89-b32d-a7411bde93d6", "comment": "Malware payload (Mirai)", "value": "4e1f43273576105fcd3bdadaba22f9759eb5fbfea43bd35e212f42ddc057c73d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893164, "uuid": "a08f6eb7-dbcb-4ddb-bc47-b8d0e3eef3b8", "comment": "Malware payload (Mirai)", "value": "f1f1601657ed1039a94c64394144df8ab0133d70", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893164, "uuid": "c2ce1685-38d4-4393-bc1b-3542657f248d", "comment": "Malware payload (Mirai)", "value": "37dd9ef040ee37d46726b1823dbeb0eb5f9fbf6ff5fb745bdbb17abe37148c29fe80a47056495f0f8766afdcf78411fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893164, "uuid": "d0d67a28-7ca4-44ad-be15-401cd7174df3", "value": "T177332951B8815623C6D0137BF66E46CD3B2523E8E2CFB2139E221F60379682F0D67E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893164, "uuid": "906c2777-3ba7-48ec-ae46-345a0551def0", "value": "768:yWBF5r8FMVHrn6mLaEQczj9cas7fkZM/IPabLLYQGqbnRFopVJrvzJMw:FF+FAr6JWNcag6BPKLLjBR69H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707893164, "uuid": "48fcb5ac-8e6d-4854-887c-c30bcf12ee4f", "value": 50272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707893164, "uuid": "aa1cfe42-799e-4f1b-b6d1-0e8529503b19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893164, "uuid": "1d5251e0-58b9-4ecd-ab5f-d7ff06a4c86d", "value": "6bc2a260055de0aa4af05ee9f5ecb3be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2dca47-cb1d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707903750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903750, "uuid": "dab9bcaa-c902-4ad7-a9bc-85195ebfe3ea", "comment": "Malware payload (AgentTesla)", "value": "d36332f50732fd0f44b34389dd8c3f63", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903750, "uuid": "76d14e0d-88ec-440e-987d-0e08dca96d5a", "comment": "Malware payload (AgentTesla)", "value": "4e39f71eee8b3fd4f045b6ad1c0168bc65ba6140756a0e1ea1f7b55c1c18e4a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903750, "uuid": "99c32351-75aa-4586-80c9-8afa9bf6fe26", "comment": "Malware payload (AgentTesla)", "value": "44ffb3d55f725f95efc909cc2ba2302e68ba1148", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903750, "uuid": "63358c7b-eb31-4da5-b814-271a48937ce3", "comment": "Malware payload (AgentTesla)", "value": "f99fa93c4cdad844268a5c4aa11ddefc9558940af7b95ad9b9e9400ea2ff08ff58e1ef8f1aa7a680e7ef2b08ce10d0db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903750, "uuid": "139b83a0-25b9-4687-bfa2-f219b89ed806", "value": "T1AB333A01B3FC5721F9EF1F7768B651404270F6A66813D64F25E4A2854DB3B808AE27AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903750, "uuid": "a1fa5a7a-84ce-4c83-98c8-9d4ea31cab94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903750, "uuid": "c16c02c2-b198-42bd-8ae1-65ae648324b4", "value": "768:luDSN6ok6uddBBT/gyMV1g9mbD48Np0kerbD0sAvYyJuuZsLbVvkidCOgDEFiRo:oDSN6oydp/gFg9m44QDovvAVvMOgDeiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707903750, "uuid": "af03ebc2-59b3-451b-a695-2c85e977f440", "value": 54568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707903750, "uuid": "62dfdcb3-a983-4923-943d-ca416829e471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903750, "uuid": "069865ea-0068-42a8-a401-edaf9988f716", "value": "GMT58609.html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d00b7d-cadc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707875742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875742, "uuid": "27350492-a58b-43d9-8ee2-a0e0d2d8209e", "comment": "Malware payload (Mirai)", "value": "2ce6e86abbdcae8317dbadf7a629f7d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875742, "uuid": "03bcd70c-28ff-41b7-a547-66b04238a0db", "comment": "Malware payload (Mirai)", "value": "4f4e7ff236347d6b87fcb262792dcb6076cfb0644117473a3431d953c36f96bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875742, "uuid": "aa9952c8-bc4c-403c-9270-4275ac56a5e8", "comment": "Malware payload (Mirai)", "value": "bfded1547cc0d4864988b45fd97a29dc532dbc61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875742, "uuid": "207afc84-166c-483c-b68b-3663822bf023", "comment": "Malware payload (Mirai)", "value": "6be2d7a7540410cc6a1bc06c69b0e8ac84c30f2e988b3ff39df258b7c33a45c87a35e0945e058f7323738c8ce043f9da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875742, "uuid": "f7e6c2b0-337a-4b9b-ac38-127193f2289e", "value": "T196D2E1487692A3FA8C8DDABE770F002630AA74A9A6B29373B305D5534735141F251D8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875742, "uuid": "6db0a8e9-c848-44ca-a7a9-7da53b428708", "value": "384:MId/PxEDLd2TwMWzB6lowYcEaqs+9OC450LQixBfE4jdlz0lewZ90BKsdsgNyb3:blxKd29WcxEns+V6IHE4RlY990XdAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707875742, "uuid": "91a41bf4-c3b4-4496-b977-fcc91a78b81c", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707875742, "uuid": "57c13ef1-4131-43b7-ba07-4a6c45d5c0cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875742, "uuid": "7b9e72bf-463a-4b90-ab71-74b215912d49", "value": "2ce6e86abbdcae8317dbadf7a629f7d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c5014e-cad7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707873619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707873619, "uuid": "c470a17b-12c5-429a-a497-0eb475f85143", "comment": "Malware payload (Stealc)", "value": "d6e77e74584a1d69d15dbf7891ee82af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707873619, "uuid": "31a7c7f2-67df-464a-873d-16b303782d1e", "comment": "Malware payload (Stealc)", "value": "4fc932e1d16833c8cf642f6202d864b617673d37b961665d472b02ffc37e3f23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707873619, "uuid": "4ac98a88-7637-404c-8b13-7738b3713208", "comment": "Malware payload (Stealc)", "value": "7993da1962e68d499edcc490d9727fc34b1ecd7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707873619, "uuid": "c1c69ebf-1274-4b02-853c-46c09c2c1c8c", "comment": "Malware payload (Stealc)", "value": "a3be68014c7126369171ee7e6b85bb00667e6b8f11ad892dd3536428aedf74eb17e51190ffa34da0dc24debad0b2d4be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707873619, "uuid": "5184386e-a8d3-432c-87d4-580793ffaf38", "value": "T16334CE21BAA2C073C5AB44758970DBB05E7BB8B24E7580EB37948F7F5E703D08626356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707873619, "uuid": "45fd0d14-b9e3-42dc-b980-5d054a935dd0", "value": "0e828425972b6ebd163b450fada394ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707873619, "uuid": "65b77d38-db9b-431c-bf93-793180c834d2", "value": "3072:1K9hiQkFwMX9Wj/BOFb7RVOkrVXyVw7hvCoOg3BoCloWndugB1LXnvnYF50IhnN7:A9cjFNC/BcRjpXyV2Og3Bo3scOjv3I/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707873619, "uuid": "f48b93bd-9056-4941-b7dd-21ee1ee9101c", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707873619, "uuid": "5e1207e2-04cc-4ec9-ac65-7e2abed56541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707873619, "uuid": "cdbd0db9-08d5-4695-b404-b6880b484c54", "value": "d6e77e74584a1d69d15dbf7891ee82af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b37c94e-cb18-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707901596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901596, "uuid": "7b070ac1-531c-4014-a03f-098dbef1bdb2", "comment": "Malware payload (Mirai)", "value": "506d93794fece835dc98b94c0610286b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901596, "uuid": "3dca98d6-b996-4a41-a7d3-63faad6eca6a", "comment": "Malware payload (Mirai)", "value": "51a1652d290f2944a09df7fd9e3020e24efd75c9ec3e642c98c18a3b767c1798", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901596, "uuid": "4bdd2202-4f55-4a7c-aef6-920a804d5d95", "comment": "Malware payload (Mirai)", "value": "fc7a39915f55cfa3929a327c6ade84a5e7d5d613", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901596, "uuid": "0b41ef10-fcc4-465b-ac59-773ba73dc812", "comment": "Malware payload (Mirai)", "value": "b75ba6362942372485e8d88ee4f35782ce977d39535627a0c890ea77e3a17fe85b57f5d37869bfff5e7aa8e6f027a301", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901596, "uuid": "98f022b9-f821-44e2-8e82-de4a2ccbddbe", "value": "T1CED2E133A25E34A3CB617DB1D66B4BC43AB70AF8C794B00336154E5C624D5479BA82E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901596, "uuid": "c991fcda-ba3a-472d-abbb-6ea37f305fa4", "value": "768:/AjxcWcrZIQcgziwanUGXBh5iuTo4dNrDiFz0DxLBZT9q3UELSd:/AjxcWc2QR+waUGXBxE4dNzYLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707901596, "uuid": "d7aa7fa6-8c92-45be-9a32-6067943c9fd9", "value": 31064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707901596, "uuid": "0fedc52b-9a2f-4e89-9da0-393e0611c8bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901596, "uuid": "b006f7ac-82a2-4e06-856c-3bab8914a67f", "value": "506d93794fece835dc98b94c0610286b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed07f21-cad3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707872101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707872101, "uuid": "c9d69a1a-52aa-42b2-a9ce-15456c63f8f3", "comment": "Malware payload (RemcosRAT)", "value": "e1c24a9a62e766adf6fe9db74b1a4399", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707872101, "uuid": "7b7e3824-f48c-493b-95c0-30574fce02d7", "comment": "Malware payload (RemcosRAT)", "value": "523993fbf1e5d9c995dc28d558130c4fed4e0359495211b0ffd25fd82445f901", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707872101, "uuid": "1fadd21c-9479-4ca3-8280-833783bb281f", "comment": "Malware payload (RemcosRAT)", "value": "9d48c017b785214d0e9a35553dca6b22ad3b3815", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707872101, "uuid": "1ff0a24c-edcd-4d9d-be3c-eed23c3e3e26", "comment": "Malware payload (RemcosRAT)", "value": "ad23430b71ecbe7099912d301394c5fefb83e6c9b9701f6a6d5df2a9f0b88dce44f2f6596ea6c3445eaee633a5b22336", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707872101, "uuid": "d49be5ee-7b3b-4bd4-9e4d-496820d0a2aa", "value": "T15BD2F1E99E2DD46A8D40CA47495AB2BF8639002F8DB912D75608AD533ACB87A04B3716", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707872101, "uuid": "cc72c6fd-356d-4359-9136-b0a76631c607", "value": "768:fpj/VjMlSOhMZG276c+ma9Z6u393RNLVsVYPvWi:fp75MlSTomax93DCVo+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707872101, "uuid": "7cf9898d-a492-4cce-946c-d72697e87000", "value": 28609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707872101, "uuid": "73b10588-706a-42cb-9050-0ae526f1f16c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707872101, "uuid": "b3a6dd93-9ad4-4ea6-b5d2-cc1d01c0163e", "value": "InvPIF7894321.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850a1ffa-cb18-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DanaBot)", "timestamp": 1707901666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901666, "uuid": "8a93c007-f443-4dd6-98e5-fc46f9e12d03", "comment": "Malware payload (DanaBot)", "value": "bdea892e76ceed6a149f82e5f4afe0b9", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901666, "uuid": "1b0b876a-caeb-4020-84c7-a635a06a1ff5", "comment": "Malware payload (DanaBot)", "value": "53d19f4866f56b75ed63123b5aaf1d8d461616ab21ebdb47fabcdead171a5e44", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901666, "uuid": "42f5f6d3-5d95-4412-bbdd-1ddab17c98b8", "comment": "Malware payload (DanaBot)", "value": "8f161214d55755e820151ed5d4962437f4cee0f8", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901666, "uuid": "4a613b15-6dea-47d0-81f1-2ddee3df9385", "comment": "Malware payload (DanaBot)", "value": "3c52a4c5833acca6b3d05e2a181dd903c402a30c279ef4472ca15aaef5888ef7a4150e3ff712a686e2046494a99e976f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901666, "uuid": "d4814df3-3a6c-40f8-949c-f54584870f11", "value": "T156C1C84A67D0BCC8538EEAF7361770E1EA5DB84D36614C9A1200E82C39D9B61F6CD531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901666, "uuid": "9f3997c1-1ebd-4dd6-853e-1b6443821e7e", "value": "96:eYOu9UQqFFgM9imAruN7FilBBElF5IaE+FzIPTbgz7m72fNzIlcNpluSoSNaQ:zOuYFgMyrWhiyL5RE+lIPi8cNzIlmpmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707901666, "uuid": "f714923c-8e25-4e5a-8e50-ca5cc88c758b", "value": 5720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707901666, "uuid": "7d48ea23-7f4c-4fef-8ae8-a5f289af2a36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901666, "uuid": "8ff06942-7f0b-4887-a277-d850c1be1fda", "value": "allegato_16.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1380d5b5-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707947432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947432, "uuid": "fd663a54-dc7e-4a3c-903f-4874d1732e1f", "comment": "Malware payload (Formbook)", "value": "16a99463ebd4554c9b11480d36081514", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947432, "uuid": "d9ec48fe-45bd-4235-bbeb-16f8a4dc5bcd", "comment": "Malware payload (Formbook)", "value": "53e09d15ff2fcccd16ac139e20cb00ca6796f1e5e97d7a129ede94194d50f977", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947432, "uuid": "4dd54eed-9c2e-479d-a724-9de0ac383107", "comment": "Malware payload (Formbook)", "value": "e94b6f5cef97797989c214831dc4d8c692d38454", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947432, "uuid": "0ec7bd59-00c9-460e-a0d2-913e87dcdfbb", "comment": "Malware payload (Formbook)", "value": "9e9826a1e9c77863e50493045999d9764b1d335961ae29ea8fa80e2fc34a168247721201c9998938ff754344e1ed98de", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947432, "uuid": "315b4257-c4b1-452c-9da9-3f0b22ab82fb", "value": "T1EA23F1181F8A662910C1CC1FD0258DCA6E8BB56809BEA602E0F9C5FBD7158FD3E96D71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947432, "uuid": "adc673f0-2bbd-4f33-901c-ae1bfb1c0f5c", "value": "768:KPleZkUObUpJdkmVgXhr9+sMxB2/RJUTWDFb6e4Hb50iYgUK+s+pxP6:NZxOIpJdkmWQV2RJUqeeEbuiDos06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947432, "uuid": "4e35f748-d83f-4e6e-82c5-c13861081f79", "value": 49610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947432, "uuid": "ba034dd0-2812-4294-867c-d3909b22fe84", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947432, "uuid": "519ae57e-edbe-483d-9f17-00b9346a4801", "value": "International Bank transfer.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6075e7a-cb09-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707895360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895360, "uuid": "08a10486-2737-4a2c-8bbb-4423f4879926", "comment": "Malware payload (LummaStealer)", "value": "6c6c69fcff9c3e42c4e04e504056386c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895360, "uuid": "206a0854-fe79-4111-9be1-999fb7a117a0", "comment": "Malware payload (LummaStealer)", "value": "55408e70e2ce19c41366a8a69a3eb40b2a459099672f71a8969abb88decf69ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895360, "uuid": "14b5199b-0f7b-4930-9c5d-1d3616f10ae6", "comment": "Malware payload (LummaStealer)", "value": "286f58ce5b27043d6c86a6e16106ee092c709fc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895360, "uuid": "15dd73b9-8ca6-403a-89d0-04ec7726a35c", "comment": "Malware payload (LummaStealer)", "value": "98bc7e03442fd36cb91a5fb6658a50557154998604de03b6514148b5e72010ac0fe6b2ff93773e7e5e8103f008e50976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895360, "uuid": "c9e3624d-ac54-4e08-8b67-852a63871566", "value": "T12A6623B723194115D2EAC53DC923FFD432F20A256742983BB5EE7CC82A34D9BF592942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895360, "uuid": "b4211455-eecb-499c-acc3-d12505c30bff", "value": "c1adb2b33500df75883e17f0a5c33dad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895360, "uuid": "c2a7b48b-da66-4cec-88f0-c90349362ec5", "value": "98304:qk1KkTF5FOPhHb+X/yk4E/38vkRAumy6fNgibMns5TrXUXl8DumKISM62vwC3R:qkwkh5FOlw/v7cqAG2lXilC0nfs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707895360, "uuid": "ee6e6907-624d-40e1-bb20-908331ea9342", "value": 6751448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707895360, "uuid": "ba712ef0-b084-432c-97d1-d308d64b65d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895360, "uuid": "2738011d-0306-4b59-b11f-297157d47a34", "value": "6c6c69fcff9c3e42c4e04e504056386c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a35042-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707915943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915943, "uuid": "88e35bd5-3348-4ed2-97a3-16ea6c21754f", "comment": "Malware payload (Formbook)", "value": "38b8e91a32fc4ed6fdca303c001c98c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915943, "uuid": "e4fc4fcc-fb8e-4e3a-a5ee-2964382e304e", "comment": "Malware payload (Formbook)", "value": "554dbcd97568d114311a3fc7ebd48b0c27c82af445bbba0e00d0881a19ef1c25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915943, "uuid": "e3b45892-37a2-4621-8d59-b521f855d19a", "comment": "Malware payload (Formbook)", "value": "8a69ce5334867fb237ccb39a9ff781099f6e98bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915943, "uuid": "e195ac67-be59-47de-9663-3c16cdf7f1e8", "comment": "Malware payload (Formbook)", "value": "e5f53dbbe2c42a25a2745f810c427b3ad75b6ec469fe355c0f7864615ef863633590b1ab3ca557b913d82b642c519a5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915943, "uuid": "ba3b5766-a5a3-4c8b-b40c-5d724424c3eb", "value": "T1BEE4236034DCCB13E9BD83FC64A4044143F626672172D76A7F85A1D32E9AFA889B13D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915943, "uuid": "de71def7-25f1-4084-a0ef-feb88459722b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915943, "uuid": "1055e2ae-9654-4ffa-8873-5ecac825ef8f", "value": "12288:riD2DWluBJrfZA5nfjERxPBICMzSFKsgAkoiebMkMOqXjkoxYsLu8FQ1XL8VUXBl:zqMJLK5n7SJICaSFVrkoi6MOQkc1u8cR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915943, "uuid": "f58f9750-ec3a-4a86-b29c-8b3519fb48ba", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915943, "uuid": "afcb3142-4cf0-4e61-8e0c-be0876fcd13a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915943, "uuid": "876c53eb-4d2d-4d45-a07d-944274457124", "value": "Dekonet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941908f7-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707915865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915865, "uuid": "9f1590e0-2838-44fe-ad35-2e794fcaefd9", "comment": "Malware payload (Formbook)", "value": "a0ebf7cc2ba8c8849f0e4a3bb3b52c6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915865, "uuid": "0a55f810-cffd-4895-91f4-55a1a03cca93", "comment": "Malware payload (Formbook)", "value": "5701249e7424216864a0364ac132fdc02eb6061c9d275c153f5394d9e7199cbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915865, "uuid": "8d51f7de-c66a-4cd9-b11c-1ff8fda4f8bc", "comment": "Malware payload (Formbook)", "value": "a92f2f6dcbb1b00ddeb86b8f9ffdc1320d926812", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915865, "uuid": "dd683b7e-d4c9-48f0-b3d7-fa5c7c209104", "comment": "Malware payload (Formbook)", "value": "9ab498317bd418bb7853e72a9343ea0d5fe4feb8eef86bd08dff0b19864899c048fd67bd54661aa98d837965d73ead69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915865, "uuid": "b144840b-630a-4fc2-b7a8-de9ccf617324", "value": "T15D754C07B6568AF1E2956736D9BB4C148770E9837A2BD71FFA8E235A08037BB4D41703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915865, "uuid": "9da1d7f2-6958-40b7-af66-1f1e68025989", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915865, "uuid": "c97f3cb6-ca1a-48ec-9588-c93a67937989", "value": "24576:Iejc7DcCrHHSqYwX+8H+FVkYCwTPi4CiEpoyeKlsyG:IrSqJX+M+ZCweGEneK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915865, "uuid": "37a274c9-fc38-45f2-a8af-d9431f9d6a33", "value": 1604608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915865, "uuid": "277b4b55-3a66-47f9-967b-425ae80bd65f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915865, "uuid": "896aa33f-02be-427b-bf74-4985de6fb1c5", "value": "Yeni sipari\u015f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc1e8ea1-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707915932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915932, "uuid": "6c2d2543-6b11-4468-aa09-5cf3f6853b7c", "comment": "Malware payload (GuLoader)", "value": "7817f076ff826896eea5d88826f1e0bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915932, "uuid": "57141e7d-26c3-4e13-b173-d0ba6aaab0f5", "comment": "Malware payload (GuLoader)", "value": "5806a9ff0ee5ef23fdb2d7cb9f12c3c0ab4b69b77eedf3aef2387672f8cce129", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915932, "uuid": "ab3f0349-eef8-4249-81ec-cee4c9c9e31b", "comment": "Malware payload (GuLoader)", "value": "0706b2ecec41fe1af96790fe82d0ea746134da2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915932, "uuid": "7aaa2708-3442-48a7-bc56-22ab713d0f42", "comment": "Malware payload (GuLoader)", "value": "7bc03e6172ed7fa1e1e85f67590a74cd3ff7a4d6feddda0ef6549b423e3de48da099f64ac4ee1fa87389b66e25142b77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915932, "uuid": "b461e8b5-51da-4188-8329-c7b29ca14cad", "value": "T182E412552B80CD13FB52033581E1F37C9B39EEA8295AC723AAF93C9F7635B959C28100", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915932, "uuid": "7780db81-fb24-4e5a-b6eb-150485ed4d3e", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915932, "uuid": "9e077a3f-1688-4251-bc62-c4f2bf6583b6", "value": "12288:9cgybdNrgTB1myD5W3swba2cQxifyvYMaQyLi6R/LohEdIxL33vfy:9Sbd0PgDcYiqvYML3eU33Hy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915932, "uuid": "382b6e72-c28a-458c-a6dd-3b1760326026", "value": 721440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915932, "uuid": "91a80ad3-ec34-447a-b73f-f75041664410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915932, "uuid": "666c5332-b686-454b-b50e-ce646d4b3f44", "value": "ekstre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7574a38-cb3c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707917212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917212, "uuid": "d29dd9bc-432f-4e3e-a060-d5d7e431e23e", "comment": "Malware payload (AgentTesla)", "value": "5037ffe2c240c0221189a8824feb3d20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917212, "uuid": "e7c2ed2d-5643-49bf-a776-389a887f91d7", "comment": "Malware payload (AgentTesla)", "value": "59ca002beedcc922d7f55d3466f10744293ea653d5b555acf4a88789b327cdfe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917212, "uuid": "55e78dcb-a4ab-4b19-b4bc-00e5051151e2", "comment": "Malware payload (AgentTesla)", "value": "df26b9b1b1e2e65b709f22e368d0db02009b16ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917212, "uuid": "a75639a7-1d3e-4a5a-b70e-ba825dcd2018", "comment": "Malware payload (AgentTesla)", "value": "8ec56d16505fbe58a3b658eac2d7fbf7c346d3a2991698349822a2bd78b7d3ef8725187ae3f732db6d4936579ce24548", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917212, "uuid": "85799d6f-e5cc-4e57-bb10-7583abd090ec", "value": "T1F2334C0177E85731E9EF1F7768FA51044371F3AA7803D60E15E4A2954CB37908AE26AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917212, "uuid": "ed13a8fe-5450-443d-a728-eddacbfadf9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917212, "uuid": "003d42bf-6fbc-4e01-a7a6-b0262d752424", "value": "1536:Uq94zXSg/gFFjA2H6WPET10AVf1EOeiy:R94gFjA2aaER0AV9AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707917212, "uuid": "cd411df9-8ae2-43be-a1ff-11bf24b0ad3d", "value": 54168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707917212, "uuid": "6ab1eec4-f9d6-43ea-9388-dbb22eea8a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917212, "uuid": "cfce1bfb-184a-4c40-9a84-142d2a700a97", "value": "DHL STATEMENT 009##22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d918099-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1707915854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915854, "uuid": "34557367-1bee-4ee5-882b-0e506613c888", "comment": "Malware payload (Pikabot)", "value": "ec1c1b9f294b820b4d282c65aa3929d3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915854, "uuid": "f4e99abd-b1d8-4d63-81ae-5e622164822c", "comment": "Malware payload (Pikabot)", "value": "5dceda983a588e14d178ed46fd3e03333314270c36010684c9447ef03ca53f81", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915854, "uuid": "25212114-02c5-4e79-b56d-75405cf57088", "comment": "Malware payload (Pikabot)", "value": "85fad35c5dbed4c9391c586f7af8e980c01250af", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915854, "uuid": "8a6f4f08-83ab-4916-9dce-6a83c7414f1b", "comment": "Malware payload (Pikabot)", "value": "be1455102c5032c16f5790ec5902bfc92baf79cc750730d74669fac404adb0c181be82181419dd9966ead86b9bd159be", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915854, "uuid": "fb8ee723-5688-40e9-b4b7-236baf91bc0d", "value": "T1B0629557E74083B996A35102DA2F5AADE729C5746359C0E5B848E4BC1305F3EE3332EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915854, "uuid": "b37b9350-1afb-4304-b051-d275479b0360", "value": "384:ZyUE4fIqdiAbMiDg4HcFdxB/1YALnKJvl0GxH:cOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915854, "uuid": "3fa1aacf-3fa4-44d1-b517-a81db0ec9a9e", "value": 14545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915854, "uuid": "e40738c2-b872-4e1b-b9a7-cd8762cffc83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915854, "uuid": "32ba188b-6c87-473a-8014-f6b0f8219890", "value": "ESTK.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc195e6-cb42-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707919720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919720, "uuid": "e943741b-2666-45ef-9549-ecab15d10431", "comment": "Malware payload (Formbook)", "value": "fe24e9c1c2d459b0f157a009121c0c85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919720, "uuid": "1e4fcd7d-2c5f-4e05-b0db-e82060ed1d13", "comment": "Malware payload (Formbook)", "value": "5f57f52adae6c2bc66134b12af0f88354d3efa874598c8761984bcc71b0995f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919720, "uuid": "a8e5e2a3-5b83-4180-adb9-70188cf75d89", "comment": "Malware payload (Formbook)", "value": "431b20bfc6d5de451b000aa23bc9f133e9738012", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919720, "uuid": "c37e47b9-100d-4b0d-bd49-d6cb6ff736da", "comment": "Malware payload (Formbook)", "value": "3265da4e37cce323f8744b5c9fba1645fe34ac5282be0c36d4233b0bc506176ad04c062c6bbcfc116bb6b5871a6ad81f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919720, "uuid": "cca827d5-8618-4bc2-9744-e37c9288cb09", "value": "T12BE42200A59CA9B7C9ED0AFD91A1E1049774826AEDC4DBCA6F7F24B8C4E73805144DDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919720, "uuid": "123529c8-a77c-4266-9d19-60abda05fd02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919720, "uuid": "2c5b8a24-f661-4284-9fda-b8f61ead476c", "value": "12288:D2eQ5vziOPgMlP0XfxQ0+fk9su7kZqf6uk9oYyGmTfZnom64n2HeTg2u:iri+gM5Yn+fw3SuCQG2f8feTg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707919720, "uuid": "d05871a1-2b8d-4562-a000-b082968c1f54", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707919720, "uuid": "12b8f435-2d96-42d5-b306-73bcdfc58bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919720, "uuid": "cd959e1c-2a71-4f8e-9f75-b5e201808e10", "value": "New order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44d4c543-caf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1707886526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707886526, "uuid": "854a322c-5436-413c-9b09-74a16eb4be9d", "comment": "Malware payload (Socks5Systemz)", "value": "bee448973c4eb53cff2a8fc4c98b383c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707886526, "uuid": "7a7f803a-babf-434e-9df6-611a5cfea6f2", "comment": "Malware payload (Socks5Systemz)", "value": "615fc1c3729de8502cbc7b9f522264e0e46f6feb1639ded1547bee5e6564bece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707886526, "uuid": "94d2da5b-0a07-455a-9a83-0431fdcbccbb", "comment": "Malware payload (Socks5Systemz)", "value": "a56634b150d2f03138ebb4bfc997553ae6c9a94e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707886526, "uuid": "3e5610d3-3f32-4518-aa5a-eb8beed1e20d", "comment": "Malware payload (Socks5Systemz)", "value": "0575d78fee226ec4835ed92476006c411a15e78780b482ec3b3837cedf5260115c3eb6b29e91a69b641bce815faca234", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707886526, "uuid": "140bf857-486c-4f2c-9c08-adf641d2fe3c", "value": "T1D334BE11B792C4B2C9AB40708C31DAF42A7FBCB25675B54B7F983F2F2D712915A22352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707886526, "uuid": "b3ddd7d5-8811-4976-aa16-d6358eefa922", "value": "b67d3635f1277e6853103646a1e58868", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707886526, "uuid": "74637742-0003-4639-8984-a780c3e79e02", "value": "3072:SKFx1SiFwEX6biG0eXg0Dl90KBxSOWswSXBIQZ7kUYAKXn4nhB5LPiIt7:TF3PFqOG0XKUsh9Z7kUYZ4pPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707886526, "uuid": "4b26eb67-25fc-49e8-9482-a8b6923e7f89", "value": 251904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707886526, "uuid": "8f4081db-bde4-4926-bf61-b00fefca817b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707886526, "uuid": "c40b4fec-3ac4-4469-871a-266f3a8e8811", "value": "bee448973c4eb53cff2a8fc4c98b383c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042e386c-cb12-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707898873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898873, "uuid": "ab6dcfe9-692a-4550-9a1f-03d39dea6469", "comment": "Malware payload (Mirai)", "value": "e21f23ebe6bea02a2b38ed8b892fcc50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898873, "uuid": "49139d8a-8ae6-42ba-b74e-60c36d5f6706", "comment": "Malware payload (Mirai)", "value": "630cfde6992fd4c30f0a93ea553acf8b480cb93b7cf06f80bfa827ef384cee20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898873, "uuid": "e2d48bf4-28c7-4536-b0b7-3ff8f3b29f04", "comment": "Malware payload (Mirai)", "value": "4982c3733fcd4a8315f0ca2c47d4d0a98e429dfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898873, "uuid": "bf392750-e43b-466d-82de-c56dabe2c43b", "comment": "Malware payload (Mirai)", "value": "f1f84316e8b8b714f38df314ac2c00fa774b15a065fa76b7d976ed014315ff8ceeb9b1c465d28f5e023ff6b50f36ccf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898873, "uuid": "4a076755-902c-463e-89d8-e501594e5013", "value": "T164A3B616BF310FF7E8ABCC3719A51705198C650A22F97B35BA34D818F64B25F1AE3960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898873, "uuid": "194e6873-cf24-4a7f-a6c5-51b532c27674", "value": "1536:RvMKs9oRHbfZT7EQYEWiGlCvaGe1Cs2ooKfALVZPpzKA/:RvMKs9oRHbfJ7fW5lsarVILV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707898873, "uuid": "b9d4f44c-2d30-47f4-9334-6658e4d3412f", "value": 105116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707898873, "uuid": "634ebd0a-b640-4369-a60f-dd3b683b7937", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898873, "uuid": "c511b803-dedd-45d3-9b79-67703ca812f8", "value": "e21f23ebe6bea02a2b38ed8b892fcc50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd9df5d-cb38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DarkGate)", "timestamp": 1707915321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915321, "uuid": "601e9e36-09d1-4a16-beed-3f973570a652", "comment": "Malware payload (DarkGate)", "value": "9c743eed9f08294c6cb4f091bfcc9d5a", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915321, "uuid": "3ac53ae6-a400-4135-a124-35672f4483ae", "comment": "Malware payload (DarkGate)", "value": "63504a7e967d5983fd36d4b4c96284332104758a19dbc9c7a0ff4225d6f8ff13", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915321, "uuid": "d3671ea8-3ac0-4431-9e84-cef1fd8341cd", "comment": "Malware payload (DarkGate)", "value": "a8bcbc46c021888911c1a39cce01feeb92eeddba", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915321, "uuid": "41e21ae3-eb37-4b37-aeb4-01cea6fccd1a", "comment": "Malware payload (DarkGate)", "value": "d1d5b9436c23b7cf0d0c3c82d163b64156803f69131a2e6a724643be5991eb0da475cc6b7de852b6cf705650218ee8f2", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915321, "uuid": "d47547e4-621a-453d-aec7-23b4a82bedb4", "value": "T172C53348CE6B1596900997EB1745E7108A64D78ECB755CC9BA0FC2BF700ABF8DFD2068", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915321, "uuid": "cb73bb72-eb35-4ffe-8d90-50535ef890ff", "value": "49152:u43NPQUNYYeVKo9x5Kpu7ejYFMyImIZ7hkSRua84ioGR0ExxL6fQkOaf4Ila:uaoUNYYy9x5Kpu7ejYFMyOhkQBliLR0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915321, "uuid": "a37d8672-ef9b-47e0-b478-48d56d7baf1c", "value": 2536202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915321, "uuid": "87e5dba5-6a8a-4422-8119-edc9c1ba3ac1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915321, "uuid": "52836809-101a-4e39-a6ac-6fc6e2b072a8", "value": "build-x64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86cbf33-cb44-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707920758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920758, "uuid": "1b455c46-fa3c-4642-80f6-a51d44101bbe", "comment": "Malware payload (AgentTesla)", "value": "a18bb95cc0b4dca2b6616d18b99ec033", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920758, "uuid": "36b880e4-58ed-4a81-a6fc-f899a486835b", "comment": "Malware payload (AgentTesla)", "value": "6363c6f85a5ee95ea3fd025374e8ad16aebc513f56ade341476d1e2be045479d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920758, "uuid": "a9da3574-43ef-4680-81fb-8e272f4b5c2b", "comment": "Malware payload (AgentTesla)", "value": "3fa6123204578d4adec74588f954fa5c0c6106a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920758, "uuid": "d68551cb-aff1-41a1-860a-3f2c0a3fcb17", "comment": "Malware payload (AgentTesla)", "value": "bb99093f210905f85ac551b4c5c19e09c73877bd613ff0017add488e6367e555183d1042eb96570c6eeb3f55f2a369ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920758, "uuid": "66383e6a-579f-4404-9e24-6e36a456ddb0", "value": "T169D42374268DAB63C4984FB335F02B796734F4EE7868EEEDA9D168D817227041302677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920758, "uuid": "e8bcd3b3-d497-46f1-baa1-dc9ec2360893", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920758, "uuid": "c38fac6d-ead3-4a59-a390-41a82efdcf9b", "value": "12288:OzNCe2rrYaduOMvpj4+bbQ8ksXFEBQ/VQzjEx4oKbJH1v+:O/2YOuOMRM+bbQ8ksXF0tzj+4112", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707920758, "uuid": "e80cc1b7-4ff1-417d-b512-00e33420ca51", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707920758, "uuid": "673f7be6-1400-49a6-a656-019222fb38a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920758, "uuid": "d2066ef5-af37-4504-b848-3f762671dd65", "value": "lt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68ee5d0-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707915976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915976, "uuid": "5f74bd36-1630-499c-835c-387d9de321f3", "comment": "Malware payload (AgentTesla)", "value": "8a0181065ae802c6287f6bafc2dfc8f9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915976, "uuid": "2893093c-e092-45c8-af99-f1d9463aa7b2", "comment": "Malware payload (AgentTesla)", "value": "65af772e03925fe6f08f4da235d1b7d529fc36ddfdfb4648276431f94cda0636", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915976, "uuid": "60e33c56-fc7e-4d0c-b90c-3e1f790bbf83", "comment": "Malware payload (AgentTesla)", "value": "6835d56a0ca6c3db993a51cf4629fd36a40dc58a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915976, "uuid": "5106febd-26f5-43e6-8c45-44d7d36dd006", "comment": "Malware payload (AgentTesla)", "value": "665a5aa7a3ccc64cb1ee1df4a6c1b568c8e49c714180f40c52c009a6e9eeb952c816023593073e02da1eb47234de8915", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915976, "uuid": "727c9c12-ec45-4f12-aad7-eaf908b7f72d", "value": "T1B4059D9CB15075EEC817CA7689649C30A6113C7A931BD20760973DABBE3EA93CE151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915976, "uuid": "6087e7f0-1396-4f9a-ac92-aca870ebf0ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915976, "uuid": "8a9fdfc3-7e09-406d-bef6-4e30fa5ac7f7", "value": "12288:lt7teop6tph15QaS458CkLSgZUu5C2tNexrdgdnVSlWLj825txnm0zQJefU9G:lt55p6tplF5PkNZfLNeJlWLv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915976, "uuid": "2bb50b33-73d7-4e3a-b715-22329d44bee6", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915976, "uuid": "5141e0cb-4794-4411-ab5e-fd88ccbb5320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915976, "uuid": "6aac235c-5132-4d8b-8a88-73fd279478a8", "value": "bank payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187c7f2e-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707947440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947440, "uuid": "8e653760-7fd3-4bbf-816c-630694d39014", "comment": "Malware payload (RemcosRAT)", "value": "89842e3e62457c09adc295ae89558d87", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947440, "uuid": "7ec87732-4634-47b2-be34-49d31756eb81", "comment": "Malware payload (RemcosRAT)", "value": "6604ef90e74b159aa56a3c6e49fad825a612bd39f5ec54e90fce733be7c81ba5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947440, "uuid": "143bca10-9126-49ef-b89f-447bf1f56f61", "comment": "Malware payload (RemcosRAT)", "value": "82c7a8c2c9f11d17843c16a1ea5a5e13c695cc71", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947440, "uuid": "a2e0d407-2fcb-46b0-964c-a77d334992be", "comment": "Malware payload (RemcosRAT)", "value": "2c8255bbcb4348cdcbed37864746d7e7b32f5307ec898ef5e567304620022757a3b2d4aae123013778ae3839b14e9a53", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947440, "uuid": "b3e49b9c-950b-4e1b-a9cd-d346b8e6bd81", "value": "T111E42398E927296FCBA166ED15FA08B2A347B515C6078D2FBEC64C4C30E14FF6699D00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947440, "uuid": "d20933ea-7c3e-4724-b4c4-51ef75108b86", "value": "12288:1vKICzjLQWxnye8R5fC2t2iy2XaqsJOS7NqFMrYgrft0cbZLCQOFW/:1vYng5HzzaqsL8FMrJr1Pk3O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947440, "uuid": "c6ebfa64-5bb1-4f94-b571-8bc35329758a", "value": 679956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947440, "uuid": "56822b57-f05f-419a-9284-f70c20479d0b", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947440, "uuid": "afd7fbdf-b3fe-4265-8ab6-fdcd662aaa42", "value": "Proforma Invoice P002821.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02304ebe-cb03-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707892427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892427, "uuid": "67ed8ef9-303b-48db-a881-c3f184776c9a", "comment": "Malware payload (Mirai)", "value": "d7b9434bfc0574c45ee6b643716db5ad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892427, "uuid": "5ff68b3c-5b37-4744-8a95-71527c8c957f", "comment": "Malware payload (Mirai)", "value": "6a260a5bda5271e876599ecc5771d02686c5c7e3939a32a79638501e894ee641", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892427, "uuid": "ad013545-2d40-4d94-bf7f-ff38d7a5fa78", "comment": "Malware payload (Mirai)", "value": "115793178e2e792e6d7d8710b065503d4bbb0ef1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892427, "uuid": "3b3a3c76-7c7a-4ef0-8a29-1273a15d91dc", "comment": "Malware payload (Mirai)", "value": "7a6991f536d787884d5ad98200ba9ae2e1010171c5b856a86f83798ac5a3f5aa935daf21fd98e14fa02bcfbaf5387695", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892427, "uuid": "836df8b2-5d0a-478f-9093-e94b9470d981", "value": "T19B83A51E7E218FADF76D823147B74E25A69833C627E1D642E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892427, "uuid": "882b0f9a-2a77-4ae8-8dfe-259e9d9061fc", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/deyLYwHuRHI0I4E26gTQ7ZDYovZ73x/nL8y8Qx:Rakdn2Eo3eQaV9TQRYo99Be037WeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707892427, "uuid": "a840860a-a2e6-4872-916a-760fcd2e8ed4", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707892427, "uuid": "bffb922e-7916-40c7-8ed0-2baefef9edde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892427, "uuid": "b9aaf573-a069-45cf-9642-32af3e49cb84", "value": "mips-20240214-0633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0a581e-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707947443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947443, "uuid": "b952a9ac-0b0a-48b0-b323-61c08631fa9e", "comment": "Malware payload", "value": "b206b302f6712aeb97597e4253c272ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947443, "uuid": "5d69a3a2-9177-4daa-9dff-e67a07b8d9dc", "comment": "Malware payload", "value": "6ba80f62984ae62f2bdd136a92e18c9809243ac014ec481356a1c579cbd4f254", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947443, "uuid": "b22def01-374b-4bee-8669-2f42d0176b20", "comment": "Malware payload", "value": "f140d4d33400a0d91c073bed2efaf031d562a128", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947443, "uuid": "2b66f372-dbc4-4159-ab56-26d4832fd5b3", "comment": "Malware payload", "value": "064df5598453308d0bd1fa655acfc14e153db0da76406fceeb83b83ddd9c3b3ef26ef75beb51f44dbd93d422e6085e14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947443, "uuid": "26c0dda8-eb8a-4d0b-a9b4-2a8d778f4a30", "value": "T104234A01B3E84732F9EF1F7768F692444374F7A73903D64E16D412918DB3B508AE26AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947443, "uuid": "e735f2ce-e591-48b2-927d-ed188dc2f68e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947443, "uuid": "2ec51a05-64e2-4f7e-a50b-21b90356da2d", "value": "768:cvAD6uYEEBB4/gyIkGXopA8hb9zzSXhtvfawZsLbVfkidU:cvANYEh/grkDA73HtAVfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947443, "uuid": "8e2346e4-aad7-4a5f-8177-4eab1eba138f", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947443, "uuid": "8b5b7c8b-80c3-4574-a8a4-30c15a1c66fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947443, "uuid": "4972ab31-dddb-4899-b4a8-cb1f0fce4941", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db0557a-cb03-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707892447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892447, "uuid": "2c144fa1-0f4a-42ef-a79f-19571c57385e", "comment": "Malware payload (Mirai)", "value": "01671b4381d2de856f7f7f429f4909c6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892447, "uuid": "fccec164-e1a9-469a-b556-b7243663866d", "comment": "Malware payload (Mirai)", "value": "6e250b2924ad55b537ebcfe8989e19847cd092e55e099b1ad7ec1e99dfb318f3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892447, "uuid": "25a21d44-e89f-4b0a-8430-709417e28b3d", "comment": "Malware payload (Mirai)", "value": "02c6bfe58547d93b3333d9ce33e8049418c2ed18", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892447, "uuid": "3ccfc591-bbe4-47b7-a702-1b82ef1c6fbb", "comment": "Malware payload (Mirai)", "value": "7635293b7aedc9467def74bb7189182ef6f25d31fcdf15d0b76f3c7d60bd530aa860297a07a34a848367ebb51f62ddfa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892447, "uuid": "4f584e76-8dda-48d9-901a-56fbc0371bd4", "value": "T16183D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892447, "uuid": "d52f7862-eb30-41a4-a7ed-888e459cacd2", "value": "1536:iVLymx1Kstkj752dCexuV/8UZlDwfkJ4MYfW6:iVLyIUbFezxu5VD1e3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707892447, "uuid": "6b2dfa4a-f96c-4e42-a095-b000f258542e", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707892447, "uuid": "e3a97d04-6fa7-4b88-a8a2-d32612b08cc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892447, "uuid": "3db59aaa-85b0-4714-a5d0-c349340e9ef7", "value": "mpsl-20240214-0634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7019521b-cb2b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707909791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707909791, "uuid": "21a93b63-0d06-4381-889e-6924dc4eb273", "comment": "Malware payload (Formbook)", "value": "0fac532d2dd2b7b0b2f72991d6158d37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707909791, "uuid": "f948f2b1-770b-4c6b-8d40-b576cf813cd3", "comment": "Malware payload (Formbook)", "value": "6f58a874d38b7f49e2cf380f4cbf7bf3c6367b9d8ea4bca7dd81f83a3965e81b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707909791, "uuid": "86ced164-b87f-4038-adcb-14a09db8ba15", "comment": "Malware payload (Formbook)", "value": "7a450b9aa3f83a992b64f89fd5bac69adc0721ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707909791, "uuid": "f34a8d98-fb60-48ff-b0bb-6ba46b11289d", "comment": "Malware payload (Formbook)", "value": "4f0dca28ae2d7f334954b83f7f7868584a5e7f44648f428ed57922ba639c02a570379779f9352c366813dc55accde35e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707909791, "uuid": "979c0ccf-0f55-45a2-8ac8-ea93d16e09f3", "value": "T1DFD4231963BC47A3CEEDE7B202F236602226F9479D46DB8D0D0D9D8E3D963453160AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707909791, "uuid": "4ce1e665-cfc4-4aa4-b5e9-544b8c4e623a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707909791, "uuid": "ff9256cb-10a5-4316-9548-fbc5e0c9c222", "value": "12288:xYzN6dLxVJpGaTBYpX7SqiknpD5oYGiEltepiBnEFutAVsE1:xYgNxVX+peJkorTlteoaV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707909791, "uuid": "80ea9ad4-8634-4031-bd60-d69c9fcc69db", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707909791, "uuid": "5a9a8aa0-a175-4b84-9e8d-49d3a3d530fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707909791, "uuid": "fd20c8c8-d881-477a-ad2e-1ea383f633ea", "value": "SecuriteInfo.com.Win32.PWSX-gen.2380.7253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861b9ab3-cb56-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707928297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707928297, "uuid": "b5a1f30e-46a3-455d-9fbe-4e4f1a2d3e3b", "comment": "Malware payload", "value": "2694270c61fc115789f2f145d3f205cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707928297, "uuid": "3f9d9538-9aea-47f9-8677-0be5bbfea2f0", "comment": "Malware payload", "value": "706d8753aeb1b965908536b007533075f4e026307b9fb2f516e322c65f546bed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707928297, "uuid": "fbee07c1-e800-4c73-9fde-86036a38d655", "comment": "Malware payload", "value": "406e041fab93a1b03eaf8414375b4d61ea594884", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707928297, "uuid": "a850d8f4-f7ef-4faa-be0a-98a346eefb01", "comment": "Malware payload", "value": "8566cb078ea9217bbeb1529a2cbbc79062b2d40e3bdba2761b81e9082f9d23dc4a8c17d032ad45d4df28747da3f72786", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707928297, "uuid": "3160027c-f472-4d62-8bbd-361d053a18dc", "value": "T186E73369AE82C074C47EA6F989D49260365CBA67B643F177C36024CD3D62C8F8981FD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707928297, "uuid": "9d601a18-52e1-486a-beba-4383c9ea20f4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707928297, "uuid": "32aa65dc-7f92-435f-8045-56705a7f1749", "value": "1572864:TrziNx5qYcBCk8ZNbIk2kjVd112He54Z3UQF8LNJaFVAB56EiPL7:mx5qfotWk2Ad71OtR8RIw36EUL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707928297, "uuid": "471cf5e6-fa1e-4e3b-8439-cfbeadc51324", "value": 69071816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707928297, "uuid": "a35f65d2-03ea-443e-abdd-b09b942e8b86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707928297, "uuid": "30d99f9c-6fa3-467d-ad79-8239d2d9a8ba", "value": "ForestOfDream.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced10126-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707915963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915963, "uuid": "39d65759-6c89-40b3-9934-4b3a45b059a4", "comment": "Malware payload (AgentTesla)", "value": "8f4189e72ae5c5d4073d14777fc51c29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915963, "uuid": "c4025512-7591-418b-a474-ad6928d202c6", "comment": "Malware payload (AgentTesla)", "value": "716f031d6df4bc08cc13347decbefa0fcab4c5fa52a3cb27678af2c372b8b403", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915963, "uuid": "995d6d03-6348-46b1-8618-a1cdf92a954e", "comment": "Malware payload (AgentTesla)", "value": "8777eb91479c34a2efe478014aa41f3b248f7100", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915963, "uuid": "44505383-f962-4e85-a331-5744b9291bd8", "comment": "Malware payload (AgentTesla)", "value": "6646397327112fcf762ea6561af9d7a3588e3ef52892ab4a65d326cb1b65823ea870977e47ce9c8b221f07b0558e0cc0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915963, "uuid": "09f944cd-4c38-43f1-877d-601ddec402a8", "value": "T16F85333388C1186BEA659E379D4A08639D2F6F8FD4C11B994D24F324DD62D6F660F0B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915963, "uuid": "4ca4f945-4c7a-4468-90ac-fb396002ab1a", "value": "49152:hKf5yz0nkFW5yOuecE1wlleIDBhlbcuREU:2yzt/Oue/BID/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915963, "uuid": "3aaf26e8-8560-40b6-b442-bddca91b34b3", "value": 1805028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915963, "uuid": "27bba974-7a75-4f2e-a22c-776fe2517840", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915963, "uuid": "2b9c9c6e-1999-4be1-85df-3b7faa727002", "value": "Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8158d2c2-cb3a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707916263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707916263, "uuid": "3c6f2f1e-6e9d-4b43-b36d-e72ee12b09f0", "comment": "Malware payload (AgentTesla)", "value": "37597b767c76b377694eff972ff45178", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707916263, "uuid": "ebb24b29-0d94-4e22-9ec1-c3657b4ea6f8", "comment": "Malware payload (AgentTesla)", "value": "71f5ee1f2818fe32525676a403776d620101dfe96ae3873a3e325016ff136002", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707916263, "uuid": "c859a420-e756-42db-99ae-6b4bb2a89173", "comment": "Malware payload (AgentTesla)", "value": "54f4a460292c478c7ef4fa127fe9d0eb58465a19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707916263, "uuid": "21ede41e-aa62-4cef-a7c8-705d7cfac7a7", "comment": "Malware payload (AgentTesla)", "value": "8ff6f1dd0de37cb3882e87cbc11c4b622e45f568c2a256a09ed5a8aa505e65ee7f749afcd7ec915be3cf657c9f3d3804", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707916263, "uuid": "a207dc0e-390a-485b-8d05-73e41639be55", "value": "T11C25B021B9D58C36C2F323B09D7EF366563869260332D59B27F43925ED714426F2AB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707916263, "uuid": "26bed8e9-f444-4228-956a-02caf800c1cc", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707916263, "uuid": "439004e4-6df4-492d-b335-8e5a0e5b7e05", "value": "12288:2hkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aKY/0DnmiJ/nPdbgFDkD+U:mRmJkcoQricOIQxiZY1iaZiJNbgFDkD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707916263, "uuid": "47753257-021a-481a-b6ce-9a4edaef4397", "value": 962605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707916263, "uuid": "924f77ac-790a-4d59-9fcd-62448b730a4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707916263, "uuid": "06b57585-1c7f-4472-9936-663f71a41cc5", "value": "PO-4500628950.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab11dcf-cb19-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707901890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901890, "uuid": "f0ea479b-8641-4e39-b38a-63a9d7d72482", "comment": "Malware payload", "value": "aaba4d78688c6323dc3bddd0eda7ea63", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901890, "uuid": "a33538fc-9b72-45a2-baa5-56297489e99a", "comment": "Malware payload", "value": "726f2a4c4592d5ec2a1c401a6e427e16c21d0e7e4ff93d6495e2689bf6f2e9df", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901890, "uuid": "e5aab962-f0c6-4e65-915a-a2b9cfee3597", "comment": "Malware payload", "value": "f1bca22ab6d4a83166a57f827e0e384dcd627f77", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901890, "uuid": "2bad2102-47f0-4c05-b5b1-0405c9e40499", "comment": "Malware payload", "value": "e130729cac0535d1bfdfe656af404fd163688d04aa0813bc9b3cced5f1be7f36ab29a79cc06d20bcf885221a7f1a1857", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901890, "uuid": "70e30d2b-0ebd-4601-8144-b5eb7ee74af8", "value": "T185C601A03CDA0026F0AF11716AA9FF79E12F6F722F3525535150BA19FD322436E14F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901890, "uuid": "3121c765-7c2e-4343-9d7f-8c1accac160e", "value": "607d0c9fedb370b1ce70573304bcd084", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901890, "uuid": "aa8f9ae7-85c4-49b8-bfb7-58b9a4cbfeab", "value": "196608:lWx2zpdra2YbT8yN+8Mne5nd7g25FjZC8OH7RbFd/Or+GvJbU9RDf/kuFLOyomFI:lYCrdiNTF5nZ9C8Ud29JuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707901890, "uuid": "488e8c83-33a3-4d75-a91d-5b27a29757cc", "value": 11922432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707901890, "uuid": "f200981b-83b3-4b81-a737-99dde28267cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901890, "uuid": "101d6626-004b-402d-8744-bfabdd3efdad", "value": "resources.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf392e3-cadc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707875747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875747, "uuid": "4a5593ac-2cc4-403c-8316-02c37af53fef", "comment": "Malware payload (Mirai)", "value": "bd57da4ff19674dba15cf093cf78a67e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875747, "uuid": "9aab9fea-e762-4341-bdaa-f7317ac5df6c", "comment": "Malware payload (Mirai)", "value": "72e8e8b0f3f19f74a6a1de826905e5afe573e8f1da5e930e7381c099ad4ffb7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875747, "uuid": "c597d830-6631-4ad6-bca2-e3d95add28b5", "comment": "Malware payload (Mirai)", "value": "32690738f8faa0c9330c232447079d670dd9bdb1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875747, "uuid": "66c93737-0236-4210-859c-d36788819d16", "comment": "Malware payload (Mirai)", "value": "e93d210649009d0ccbb95a367cc109bbfa5384b2441d5c314f972afeef5f59f9f0c5c76bc46a62ec540495180d4c5ec3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875747, "uuid": "53dcee03-9234-463e-89c1-4f5c3577410d", "value": "T1F0D2D02CD94D7D45DAAD3EBD50CD9AB5288C70C0A35DE68E17628448F62BB8BFC070B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875747, "uuid": "acad22d8-43b7-49bd-96fc-976b6e315f17", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNg7LJbUWUn:kbDs06t4BEub4sU/MbUgnYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707875747, "uuid": "83f0f989-c55b-45ca-8c3e-5e7b1e2c8f14", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707875747, "uuid": "ec2efde3-de66-48a1-bc97-ff6049545042", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875747, "uuid": "a9acffe5-bb12-46be-9887-d4b2ef418b88", "value": "bd57da4ff19674dba15cf093cf78a67e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8794db-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707915904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915904, "uuid": "db0fafe8-c11c-4382-b8ac-be9756e3b351", "comment": "Malware payload (AgentTesla)", "value": "0c328d6ee61b77947574f1fecdf8c16c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915904, "uuid": "36f75184-37ef-4691-a3e5-9cbcb278b496", "comment": "Malware payload (AgentTesla)", "value": "7396ea71c444282bd3d1cfdd8ed9044b101d6b4b635296f84071f190a7bca8be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915904, "uuid": "3040fa7c-f91b-4d56-96f5-17a973418773", "comment": "Malware payload (AgentTesla)", "value": "337594502cb1526d77b45adc97264f337fbefecc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915904, "uuid": "89940152-a220-426f-babc-2f5f5d92fca9", "comment": "Malware payload (AgentTesla)", "value": "1d07513b7bd5143877cc7ce1998f31d8d469a69fa2cde099a062ffc4ddca074e6812a34c4fb9f53a40687963a742bf5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915904, "uuid": "c63313be-0bdd-4b27-a9e5-0ed13d10fe91", "value": "T12AB39287B6884792E91464B184EF593043E17DCB2A32D2D53F0CB79D1E913A3DEC2B99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915904, "uuid": "d16e5865-630a-4b62-833f-6f3dd4001128", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915904, "uuid": "52e85c50-9ee9-4a50-b9c9-c2b04f201836", "value": "3072:Vfx5WWVTMFQObHxnMlHXYs03x9CFyuSrTIXAJ:FWWmFQgHxnqXYs037TqAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915904, "uuid": "0f023064-0f95-48de-b40e-f30daa553f58", "value": 107592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915904, "uuid": "6e82769d-574e-4192-9030-c7c3774b7b0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915904, "uuid": "76e9168e-1f5c-4df9-ba2d-a3678bd77dee", "value": "DEKONT-14-02-2024-98766789098765456789876567898765678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f443049-cae8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1707880987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707880987, "uuid": "15c314d1-61c5-4262-8340-83d042a250af", "comment": "Malware payload (PureLogStealer)", "value": "98362171cdf6538ea7a4ba392566a4bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707880987, "uuid": "b5e23103-b7f2-4ddf-93e4-a92e3ce101e8", "comment": "Malware payload (PureLogStealer)", "value": "744b35626d389987fa9922b941d0f8e063ef21aabd093f54ffcea20874c5d2e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707880987, "uuid": "215bb79b-fe0d-487b-a6f9-31028ba09d8e", "comment": "Malware payload (PureLogStealer)", "value": "8db1f374bc5a2e78ee8c9af724b289f7180bc3a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707880987, "uuid": "95bdc04d-164e-46fa-9963-c389a1223970", "comment": "Malware payload (PureLogStealer)", "value": "9137e90a3c04a42cba9adf4940c7e7a8cdbae188ed245f9c434cdf2a48f55d8fcb68337e5d2167bc25baecdb8b34c0e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707880987, "uuid": "322bb141-64d8-4cac-8b09-713946947d49", "value": "T12776233FB268763EC9AA4B3215B39360597BBA51785B8C1F07F4041DCF265702F3A61A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707880987, "uuid": "982fdff1-60ad-47fe-92f7-277150115cf7", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707880987, "uuid": "6d1f97cb-b5dc-47d3-8903-2e8258086efb", "value": "196608:DIMB27tERzglfs6Tg4DD833whm99+66bpiU:Hc7tERzwfs6TlXW3Tw66bsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707880987, "uuid": "8a988270-edd1-4524-a69d-d83452f06db1", "value": 7572112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707880987, "uuid": "e1a10064-27e5-4d6b-9d5c-3a1b0edd76b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707880987, "uuid": "17d953f0-530a-446c-b46d-6473bedeb8e3", "value": "SecuriteInfo.com.Program.Unwanted.5412.881.13731", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6004114e-cadb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707875405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875405, "uuid": "ff77a055-5e47-452f-bb7b-492e944605ad", "comment": "Malware payload (Mirai)", "value": "ea3c552e1373090943a84de9d3fef849", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875405, "uuid": "816fa28b-903b-4906-b0d3-83aa2d705ca6", "comment": "Malware payload (Mirai)", "value": "74bd0d32a1c685c4092d00ae61c0306fb2faa0608c8180fdc451752475fcedd4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875405, "uuid": "a776d1d3-b375-40d4-957e-ccb714f6e861", "comment": "Malware payload (Mirai)", "value": "bce863e7bce11cdc5dda292444ab0c4ac7f99353", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875405, "uuid": "47d37eba-2854-479b-b4dd-11d7c9e842ce", "comment": "Malware payload (Mirai)", "value": "2ee4fda01f79bf1e301160265f313bc243eef7dae458e96a999a91f91a0c25ad74c1275daf285b53b75a96bacbaef541", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875405, "uuid": "d4f2ec5b-7266-4bb7-b463-54dbc5a2afee", "value": "T13AC2F1BFB7E52967FA5C233DE035801B03E9F51C57A92B9727404532A99E81E7132CD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875405, "uuid": "8279dfef-8e57-45e7-a79a-8773c74757b8", "value": "384:MX1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHykKOGB:qMwxdyoEUnDz+Y8tqHWXmSTi70N5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707875405, "uuid": "77117f1e-4a83-4dce-9c23-0864fbf889c7", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707875405, "uuid": "be23471e-f13d-4d06-98ee-fb5e0b02c553", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875405, "uuid": "a687a4e7-0722-4b61-802b-ec1eb15e1033", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481292ea-cb05-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707893403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893403, "uuid": "de981aa7-a1b2-4c53-a5ca-8a3cefc9fb4a", "comment": "Malware payload (Mirai)", "value": "09f9175ed8f3c338e9e6cc195faec143", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893403, "uuid": "5f146f43-0b72-4b9c-9b6e-5152847a87bd", "comment": "Malware payload (Mirai)", "value": "751e96775a4bb35c54592ba93bdb3566c73f7b73c42a9febf12e43e9689cf3b0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893403, "uuid": "87d80ab5-3be4-493c-b58c-3d44dc1651e4", "comment": "Malware payload (Mirai)", "value": "94f6f5f8da5f7fbe10515741e464f4fd4fff54f4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893403, "uuid": "ccfb14c1-99a1-4a4b-8ec9-192899e40538", "comment": "Malware payload (Mirai)", "value": "19897526dab8149dc9f9ef3d906fa0adc5b968c0fcb5ab4c8b529ef6f6c9af25a3b14c4f737a0e5996c03a0fcda51e04", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893403, "uuid": "4e47f4bb-3e71-4015-89ce-3142f78a8087", "value": "T14C3302136201DD61E9A42D72F7CF88CF3890061DE6FCB872688D5DA9E1C159B87D4A8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893403, "uuid": "895db7d2-3720-4592-9ab8-ae6fe6e8b081", "value": "768:vfZYvZxNZeMC+TGISOteF1dF4et6+Q1oRxH9q3UEL2qEK5J6OAsNTGjf2tl8XOYV:0P5C+iIERF42fZ4L15J6RN2tAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707893403, "uuid": "e22d4609-88e4-4b8c-bebf-efd853823eb5", "value": 51432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707893403, "uuid": "957710d5-3fcb-430f-af1a-e48aa06e7903", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893403, "uuid": "97bdb914-93a7-4487-994f-8b526fba543d", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9b3f87-cb1d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707903744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903744, "uuid": "35fcae59-b095-4837-8ddb-1e97906016e0", "comment": "Malware payload (AgentTesla)", "value": "f0e97dbf4a7426d991a22c7c93d31e02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903744, "uuid": "d6d734a1-4cfa-437b-82dd-90b6bc4fca3b", "comment": "Malware payload (AgentTesla)", "value": "75bcefdd3318f8f72dab3f8947ae996ff740cae6c656e531cf65f6c6278f7a2c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903744, "uuid": "a99a21d2-f455-4808-91c4-f4afbde62aff", "comment": "Malware payload (AgentTesla)", "value": "2e660c568342b257e6c99f2b897b3ed65b3330f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903744, "uuid": "adce4f64-27d5-4c65-b9ee-17420091e5d6", "comment": "Malware payload (AgentTesla)", "value": "fee6d19716eb459f701c6099711278c1f5b25441ec43426d1fd31ec32c022962b38e39bb108db75d509a4ec69dd14fce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903744, "uuid": "79d1cb0c-a933-424d-9ffa-32e1a578d891", "value": "T153B2E018F062E2AC8EDCB5DBD27D409B82204D2D48BF0478BBC84127F5D2E6995E3A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903744, "uuid": "38f6dce4-42fa-4de2-a97a-c68ddb8cdd13", "value": "384:lQcPuJcVgI+x3JiqbaZsvvFFnJkncYfUNVbRU4F1o8JjLdsLpAXQCX+:yxcVgI+x3/nCcYf8IuO8caDX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707903744, "uuid": "08a14cb2-f511-4bd6-a9ce-a88ea54e7107", "value": 24790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707903744, "uuid": "6855fc5b-b5b1-483a-b587-7b9f730b1665", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903744, "uuid": "4144c721-3e2f-4b3e-9bda-449753ad24ac", "value": "GMT58609.html.r13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7a2fec-cb1f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707904521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707904521, "uuid": "a1612c7b-4a7e-4cb7-8615-f29aed2eeece", "comment": "Malware payload (Mirai)", "value": "b2d093b3f735597fc4477a2500a680db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707904521, "uuid": "1b0e9d2a-dd55-4262-b2eb-09e65775e2f6", "comment": "Malware payload (Mirai)", "value": "76b76542964fc692984f9c95019d9865c326990f9a03246dfcd867608cf29f04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707904521, "uuid": "62732fcf-f9b5-4d1a-ac48-ae20f65d69f9", "comment": "Malware payload (Mirai)", "value": "0d66f0389b54b3d1330b1a51f19f0fc207fa983a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707904521, "uuid": "a1efd78e-2510-402a-80d8-2d9fb770fb3a", "comment": "Malware payload (Mirai)", "value": "99335acc744ecefa56e95c385f653bbf8622e95b0240f0668aa672ae9f206a19f8ae30c4e1fa1a30e84837dae08b8ffb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707904521, "uuid": "39d52007-467d-482e-8bb5-5b4a1ec22dd9", "value": "T1A8D2E177279E5EE7EF589F3D4519EE831484B84CAB7837046E9E53E3927E0113A082C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707904521, "uuid": "a9a0215f-62bf-4c03-98b6-517f8f5e0062", "value": "384:MuLMxbu3N0ktxSpKSRRHXOLIB1xacKdpLDVXv5EeIGIsz17pZ0ICTOsZ10LPa6i9:HMxbeDSUSPrB1QcKHVXhmUZ0ICvxY3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707904521, "uuid": "a9717fc6-cf6a-480c-8ad1-d0ded984a3ae", "value": 28524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707904521, "uuid": "5ac5fc91-239b-4c0e-8f67-5c0535214617", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707904521, "uuid": "b74f7dfb-74e4-4a52-a6ba-7e488227c007", "value": "b2d093b3f735597fc4477a2500a680db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea03b44-cb09-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1707895347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895347, "uuid": "250ae023-fd87-4a5d-b8a2-79a27b5caa55", "comment": "Malware payload (Vidar)", "value": "a5b295d5166a6ffd1191cccc9d1dff8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895347, "uuid": "1b1ea9bf-c4b1-4396-9857-f57694d40e31", "comment": "Malware payload (Vidar)", "value": "78c5de231f5085d084f126c4b49db26464449b0008a6f665bbad998e7c2c8141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895347, "uuid": "0b15b521-94e5-4ba9-a59e-7f168f2e3a99", "comment": "Malware payload (Vidar)", "value": "a9b537a09ce7c3937c16944c06d8d00c8c3ccdfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895347, "uuid": "11c390f3-7baf-488c-a6a9-aeeb076968ea", "comment": "Malware payload (Vidar)", "value": "7b00119a46d631dd932e4c52a68c7b7c109ad2a2fcbf012a915143f8247980e7c0e7438bf7418a85a5b0faebfeba5eaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895347, "uuid": "2c01be38-5d6b-4a72-809b-61e548ba787e", "value": "T1CC146B3275F58032D62115B0EACC73EAC9F8EA315271183BB76A0F3879611E68519F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895347, "uuid": "8934ebb8-c5d4-42cc-b698-125e88bad433", "value": "9f7f0b9085b628f0bac4f05bc2d2bce2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895347, "uuid": "e49f501a-d9a6-4cc3-8bc6-ebe1ba8982e3", "value": "3072:BvzA6O0w5tsUTQsVgOc8yvY9emTKWBoynYenXZoLG6XwwTWtlg5:Bs50Itjks6Oc8ygNKDyYeIrCtlg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707895347, "uuid": "6d63b24c-0d89-4725-bbad-1f5bcd2842fd", "value": 193536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707895347, "uuid": "bbf58e5f-aff2-4c74-b9fa-145badd92715", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895347, "uuid": "613f9928-9ca4-45de-808c-ced19365fd75", "value": "a5b295d5166a6ffd1191cccc9d1dff8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d84ab6-cb42-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1707919815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919815, "uuid": "0fa89d9a-907e-47c6-8f72-443baf2864bc", "comment": "Malware payload (RecordBreaker)", "value": "231b61bd55c92a2e2a5d4b9f2ceecb21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919815, "uuid": "0ab9847e-4795-417b-8f6e-6209fd228046", "comment": "Malware payload (RecordBreaker)", "value": "792ffcaac46bcdba41b9353711635fea5e59a0e94c6da5a4b863f06aabedb0b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919815, "uuid": "fe07900e-960c-433e-895b-475cb58375fa", "comment": "Malware payload (RecordBreaker)", "value": "3e0ca84f78567b8ca141deb40a339102db4ed398", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919815, "uuid": "2bffd8d6-ccc1-464e-97a6-db0c3d99455c", "comment": "Malware payload (RecordBreaker)", "value": "d3b65901b3edd87c274c8095a1bf92dd5cc1cba68517399fdd7537da61c790b7bac6b8add4e2ba71fb14c1d4897a20c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919815, "uuid": "1e386b61-19ee-41f9-a72a-f26dd49a41b2", "value": "T14D549E1023D89CB1F343313485A4E7B14AEEF853A2527A8F7F95E63E1E38295953B319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919815, "uuid": "c54777e2-95d6-4ae6-84fe-1f757c737949", "value": "7a16202dd7202181174ee4ca5dc3433f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919815, "uuid": "967f59de-ae3a-42ae-a40c-74a99766381e", "value": "3072:pziRfFi3WzI2O7Ek85+CAkg+wLSSkgZJ5ZLwRzzx288JUxaIa2VM:ERfFDJk8Akg+92ZJ588JUxaIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707919815, "uuid": "e078ed3f-2556-4f4b-9917-8493eab7e0c0", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707919815, "uuid": "72ef89e8-a5e0-46af-bfe5-4a420270ec51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919815, "uuid": "b382bec3-bdaa-4370-a0b3-b5819eb44bef", "value": "231b61bd55c92a2e2a5d4b9f2ceecb21.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fd9964-cb3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Fabookie)", "timestamp": 1707917673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917673, "uuid": "884ca2e3-fc47-4a78-8d86-1fcbd7818d60", "comment": "Malware payload (Fabookie)", "value": "ecd8b5c6b681a6fd1a8869a92361c806", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917673, "uuid": "ff73a9e1-661e-4dfc-b25b-d76c712f65a3", "comment": "Malware payload (Fabookie)", "value": "794fa053bcc3e8c7c7060b7e5e10f9c7e89904078df7ec3627edbee4e30e5170", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917673, "uuid": "a43c8c59-5800-4eab-aaab-459dd61d5d76", "comment": "Malware payload (Fabookie)", "value": "292fb4fee926c37663b89ab84e13490ccf2c42ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917673, "uuid": "af3212db-32c7-47f2-ab66-f4959454382f", "comment": "Malware payload (Fabookie)", "value": "b2e418ec8006ecb985ce40621e79026134099644e83faa16d1d8d08c00cd7e93e77e43d6ee5aa6ebde0f5834f5040424", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917673, "uuid": "b0cbbc45-e85c-46bb-94af-851ea1d96c67", "value": "T19EF42B56FBBD4272E061C135C9A6E7B5E6B27C855D30970B2345EB2E2F335118E3AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917673, "uuid": "fdcb30f9-f038-4324-ad5e-f913693f6568", "value": "f2fcd0efb031ebebeaa83cd4cd21090b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917673, "uuid": "b10a908b-b60a-4cd8-a8ef-ee10ead070cd", "value": "6144:nA01Nd5uvxQWQSYYaE5CinBdRxQ7cUBmCUiJbc77ZvfuYuEdGxTC2OWf7xLUnw+V:ndo5QWJnnBIShtdGxTC265JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707917673, "uuid": "73a88d0f-196f-4968-a887-441c6504bd35", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707917673, "uuid": "6223765a-0aa2-4809-a37c-776ee50063d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917673, "uuid": "76888209-bdb7-4939-a166-890b4d21d9b4", "value": "SecuriteInfo.com.Trojan.DownLoader45.60881.24471.13291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7800d1cd-cb36-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707914529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914529, "uuid": "db03a4ad-8b2c-4ea1-9d3f-efdaec032b6e", "comment": "Malware payload (GuLoader)", "value": "175347cb1c91ab6450e994f2f3092176", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914529, "uuid": "64580d8a-3296-41b6-a767-5b6a0f0c43de", "comment": "Malware payload (GuLoader)", "value": "79615e60c7ca68b522e02e056ef6b688835a2d28eb188d3860fec0c74b5f5e9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914529, "uuid": "bc8b48e9-7c6a-4ade-8f7f-da5c98861510", "comment": "Malware payload (GuLoader)", "value": "074f0edd0fcfe75d38aca8dc72cfd5d538c3818e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914529, "uuid": "f3a4f2c7-a321-4d34-b95f-3865e3bf3779", "comment": "Malware payload (GuLoader)", "value": "7d40645dda1e291aa163013f737f23ced2e677094a83e35a49bbf4dc713ddb0b86d48669abe1131736d9f6df92d1088b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914529, "uuid": "4c583b03-1f3f-4f45-a5ae-e5e0c7783a80", "value": "T121F412542B58CD13EBA212349075F37D5B34EFAC291AC743AAEE3C9F3A667596C28104", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914529, "uuid": "23052962-3b9c-4869-8366-e8b975a5af68", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914529, "uuid": "c1cfd7aa-19c8-4a93-81bc-1bb818a8c737", "value": "12288:QcgyG3BVhAEFAOvBodsvSdZIxifyvYMaQyLi6R/LohEdIxL33vfR:QSCB7FJvSPAiqvYML3eU33HR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707914529, "uuid": "a1e564d7-7b5b-45cc-995a-8fd3b16d54d0", "value": 732496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707914529, "uuid": "aeaee302-ad68-41c9-b1ac-a98ee1cdd1f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914529, "uuid": "c2067ef0-4a63-4418-9a6f-f4f4674f4c27", "value": "ekstre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0e06dd-cb38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707915373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915373, "uuid": "5aa5cfa5-9f28-42c2-bd2b-db4dfe8ada38", "comment": "Malware payload (AgentTesla)", "value": "cd46efc4af6482fc2c6cb1b71d5ebe77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915373, "uuid": "d6ee105b-0ce6-4ee5-a288-febc1030c595", "comment": "Malware payload (AgentTesla)", "value": "7980d2f7bb43e83e27db24f256a7b34cb1afe6b5116ecad523af7dfb5b12864d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915373, "uuid": "290691af-0255-4138-b4e6-f733b0e64d66", "comment": "Malware payload (AgentTesla)", "value": "8fb870d961aef617b0d55971856d085cb9a84443", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915373, "uuid": "07456484-9daf-4177-b238-a31a0d03594e", "comment": "Malware payload (AgentTesla)", "value": "e68a90c17e0afcac584b41cd5983560f4ab4084834d0b7cd39acc4d3df0a83174b33ff44d5d0ae5ba5e02673090effc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915373, "uuid": "ec8bce91-50d6-4762-a76a-97c997d7934d", "value": "T1C365DF377783FED6EB6A0D34DDCA11544D809C6B976CA6A8B8C87B6A51F3100AE50DF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915373, "uuid": "7d1f6504-88fd-47ea-89ff-e9038c332673", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915373, "uuid": "16a7d5b7-8c1f-455a-a367-6b4bbf150f6a", "value": "24576:z0Z/cFrj5M9Qldz1zriQt+8U0qZmGpP5uhmAlKuUWN:AZ0RjW9MHOTex2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915373, "uuid": "e1750d79-c1cb-4f38-9dd0-9adee569c64d", "value": 1472000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915373, "uuid": "83bfc94b-d12c-44af-aed7-c0823e45435c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915373, "uuid": "e89afd8d-ce44-4a1b-9e51-57fd7687fc60", "value": "Doc_251_71190_06123pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0518abdb-cb10-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707898016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898016, "uuid": "8e096c52-7135-451a-9fe2-a195053f277c", "comment": "Malware payload", "value": "b606f1162fe532baa61cee900fd3fbaa", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898016, "uuid": "2c5259cb-14da-4c5b-9a86-52b45fb45546", "comment": "Malware payload", "value": "7affa68cf89e4b82d2a4736c192a6cb88452a882937fb7d7117674654c00f33a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898016, "uuid": "7f6de8ed-721d-45a4-829c-3b89a3811f17", "comment": "Malware payload", "value": "20e5c6d27e25b8a22335f524c1cbd75973783908", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898016, "uuid": "2a502009-c2cf-4d8e-9e96-aad808d93fcd", "comment": "Malware payload", "value": "bbf556678e409fa41496d60ab2f064e9d6ea1d7eb59d70cb0013c4c57d090d7f5b7da587f69730e2aa1a307224ae19be", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898016, "uuid": "e64bf83b-8e44-40a2-929a-af4db5a20b12", "value": "T185F0C24167F94608F3F32B08957060A14E7A7F97AD2AD54E42A00D0C0EF0F848CB6B7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898016, "uuid": "da3768ed-56c9-4688-a0e5-5eecd8dabce1", "value": "12:QllOi2kX2NCpT+8B10++8B3lg7Dq8BWnxBX94sBH43F0Ff8fAlqv:QlEixK8BmqB367FBoBXa9GFf8fAlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707898016, "uuid": "e2221593-1ed5-4095-98f0-2049997ebb1b", "value": 634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707898016, "uuid": "b38029fb-1433-4f85-83e8-a793f2609c79", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898016, "uuid": "e796bbef-d3c5-42f0-b751-d0936f30d653", "value": "Payment_advice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c2b7f78-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1707915744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915744, "uuid": "94d79058-917e-47f8-bb07-000a8479d4b6", "comment": "Malware payload (SnakeKeylogger)", "value": "c7c63a90c42a93f7cb4480dc2415218a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915744, "uuid": "2bd7f558-e4e9-429a-a804-a502819a6d79", "comment": "Malware payload (SnakeKeylogger)", "value": "7b9b1c3da12184ec5b5d3f190e1705dfad08789b1202a8c8ece394f870d8e133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915744, "uuid": "cad0fe6b-dcc9-4cf6-a255-bb342cd2ada0", "comment": "Malware payload (SnakeKeylogger)", "value": "5e355628d6b34ca37101a6b74b26f3f806354bc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915744, "uuid": "564a31dd-38fc-4e35-83cd-b898cad9317a", "comment": "Malware payload (SnakeKeylogger)", "value": "9456fe9eaa427235b8deae7143e7e58a59b01692b5b60d44a749161454ae3d0033b1b3a8f02284f82a6bd0864d9199d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915744, "uuid": "f9f01073-175a-4cb2-9b8e-52c514692106", "value": "T154D423213D6C4B57D9A883FE99204CD56BF867186560EF9CAD91F0E71973FA01A3038B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915744, "uuid": "27226ae2-7031-49b3-9f3f-1f95b042167f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915744, "uuid": "30331a07-62b3-424b-8b45-0a41fccd3054", "value": "12288:AiD2xkluEKejEVfz1iwiSg+5xsI3deGJpLKWCD8pMMcI8:eg7KekRoS1PZ3pfLKWa8pMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915744, "uuid": "be6853b7-25d6-4145-be21-b604cfc20667", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915744, "uuid": "e7ec9497-cfa2-4650-94e9-37027e40aae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915744, "uuid": "b761d506-3812-4a12-a2c5-9139739a8bb0", "value": "Ordine d'acquisto 9100033466 dal 14022024.iso.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f5de7a-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707947436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947436, "uuid": "62aa6068-9023-49eb-9795-3ef36d6de031", "comment": "Malware payload", "value": "0ef77ba2aa07732ed5ba07f1cd02254f", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947436, "uuid": "3b1221be-e80e-413d-9d8a-f2c71cbab69c", "comment": "Malware payload", "value": "7c33787e1663f8c08d12eda0cc3e69a0bb183de28a5cb4297dfac13d35af6859", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947436, "uuid": "5fcce2a3-0c37-4aaa-b290-b45108cb8973", "comment": "Malware payload", "value": "e494ee5aa810d94368a641521b3c2fed97eb5f6f", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947436, "uuid": "f25c21dc-6625-4ea1-b3d5-4278d6135a4f", "comment": "Malware payload", "value": "b98416585c5fc52f6e1560a22d338b8fc9493be1cf1cf9c5e4f10b5a6e0672e56b84368f97f7da3df0653a98f60767f4", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947436, "uuid": "6f3a225f-c8f7-48e5-b96b-4f6864601686", "value": "T1AA853311546C71A3E50AAA8E54FC13AE7ECAC34D42320ADFB5158BBA5F5034F8E8257F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947436, "uuid": "297402ad-8b68-45bb-ae5a-6be5a46b9748", "value": "24576:lLJaBHvFKLMEBbIGVGrUEW0rWdlvw6nbtPOMgU8Ua6JjQI8/MepcN5t26maJgg:5JWfOIjW0Cd9dDgU8UaKQI6dg5tog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947436, "uuid": "43d3d712-2237-47a7-9e16-2762992f1933", "value": 1841268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947436, "uuid": "c310e46e-cd09-44b7-96e8-de5cc1bd6d38", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947436, "uuid": "97202ef0-a341-4880-aff1-72cdd43bc10e", "value": "Payment.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb08e91-cad2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707871804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707871804, "uuid": "1bb4da50-123d-4aae-bf83-bb06dce07319", "comment": "Malware payload (Mirai)", "value": "10c7c45737aa8197b3ea39990c484c97", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707871804, "uuid": "68b1ff3d-4a64-4b08-87c2-3c27fcee8522", "comment": "Malware payload (Mirai)", "value": "7e997c93e4e43661543c17509067ebf45e408f8a7be9363199c37fc9309a23e6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707871804, "uuid": "6f4b4814-4ee5-43b5-b192-8c30ac06cccf", "comment": "Malware payload (Mirai)", "value": "7d6efd26d0ee504adcb577850e5ff8689bdcc8ca", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707871804, "uuid": "aa608de4-53ec-4907-893d-6b306158e83b", "comment": "Malware payload (Mirai)", "value": "4dd043cdcfb2e003684e9d8f0f2d622323afc2b86a341c297aa47191c4f2290dc740bd6a7e6d31f2678ab6f450783ece", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707871804, "uuid": "f0479f7c-b616-4931-a563-ae91c261117d", "value": "T1144319C4A4C3F8F6E801147C207AAFB2ADB7E17EB475DD9AD7D81523E901A02D50639D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707871804, "uuid": "a9e1bdcf-6f05-4dc0-9474-69dbb3c91400", "value": "1536:yP/2+OX+hs4pIq/qxSWk/zvwt33U3zo7:O/2+++BAxSWk/TQ33mE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707871804, "uuid": "1369bc56-d7c3-4620-aa7f-920294e8f40b", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707871804, "uuid": "9bc23910-39b6-4eca-8caa-7f761c4870e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707871804, "uuid": "c8f64241-85b2-4859-9394-42d266d188ed", "value": "b3astmode.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1856e7a9-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707915657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915657, "uuid": "31edf580-0d9a-4283-924a-f86ba342ccea", "comment": "Malware payload (Formbook)", "value": "4e3fe9f609e247c8128c7527db63c15d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915657, "uuid": "3b00b8e9-59bd-48a1-8569-33577ac713b3", "comment": "Malware payload (Formbook)", "value": "7ef2b6d55979b8f14e246445992ab24c73f677a061a7dd447efd40a4cc2ca05b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915657, "uuid": "f3e96d16-82a6-42c4-b26f-e07aa64b99cc", "comment": "Malware payload (Formbook)", "value": "050e37b046aa9c1224ec6c5ea047920ce45fb455", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915657, "uuid": "a8202fe8-fa97-466b-be3f-e8c3ad07161c", "comment": "Malware payload (Formbook)", "value": "7ba693fbb029553303c8738950d2a1d47fd667e26ee5d324aa4a4117ae28bdaef369ad97561f74ffe57ee0ea77f2997b", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915657, "uuid": "784a1fad-93ca-4b5e-b1f1-7a777536b678", "value": "T1A3E423943A796F27D8CE83F8A4325D8817F4624A1892F79E8CC064C31E67F6456E174B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915657, "uuid": "8b86aaf2-0463-47dc-98a6-a71068fcf2df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915657, "uuid": "59414ffb-c6f5-4a2f-8a70-c35c34c1bde2", "value": "12288:KiD2J9luw/ZgOZZP8dmejyja8ggZfs1fJHTFhrycE+e8EAubX79X8RzKVutqJAOK:07zBgM8WffsdJH51E+XqXhX+zKLdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915657, "uuid": "30b4348e-367b-4e61-9448-9c99cbb6c954", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915657, "uuid": "c7d7874b-c3ad-4abc-9005-17d090d81682", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915657, "uuid": "4dfe4ba1-87e9-439b-9a18-0f7a736146b4", "value": "DHL_AWB#6078538091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48b973c-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707915973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915973, "uuid": "2d1dc8bb-77f7-4535-bd0f-2c0d65f02702", "comment": "Malware payload (RemcosRAT)", "value": "1ea8537ea3ddec9e0730821cc642673c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915973, "uuid": "6b3826b9-9657-49c4-a997-183d1e7825d3", "comment": "Malware payload (RemcosRAT)", "value": "7fa317ded5966fbe87a173f7376325f7232b9b7430b27ccfb3ae86006903d5b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915973, "uuid": "388ec866-fe2b-4ba2-96b3-3e5bf235bf53", "comment": "Malware payload (RemcosRAT)", "value": "4b36e8ac16bddc0c718b17c9b06509f0966c3186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915973, "uuid": "2d4b47ff-c33a-4536-8fca-0fbbd7eb8166", "comment": "Malware payload (RemcosRAT)", "value": "a7ea6ec42b94475a54a294ad76b188577518f0bf344cbee1378ed573f59e25f1e6a5bb8e1e1d718e7451c9bc70fe26e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915973, "uuid": "73b3f6b8-60dd-4e43-86cc-e4817f6fe97d", "value": "T163B4CE85FB409268ED2ED7312936CD7102237D6DA172AA6C79CF3DBB3EBBA525001417", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915973, "uuid": "e3a546f1-fa27-4ce3-bada-b06647418681", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915973, "uuid": "c12ab96f-a183-444e-93b0-edf92105c6c4", "value": "6144:KClMw2Xp5wLj3OcbQxfxtvm2vJ3L1NsQbuk7l9yFMI:K8Mw2XwLDTQxfx7vBpuk7l90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915973, "uuid": "9d515f6f-eaab-4b0a-bfc8-4880b8d2c370", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915973, "uuid": "4112624e-e742-45b4-b367-137638f29463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915973, "uuid": "0afb3288-f524-4b6c-b556-7e7e67c686db", "value": "pdf09fdp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebccc4c-cb78-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707942887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707942887, "uuid": "89ea7a54-b513-4500-b424-64907746655a", "comment": "Malware payload", "value": "658b0a61fec5a7d1f50bcdd3061dad0c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707942887, "uuid": "9910c652-48de-4c8b-995b-42da93c788d8", "comment": "Malware payload", "value": "805d58e29ff1120136393c36b88a38b62bd5d106504f773c212bef251fde2b99", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707942887, "uuid": "b6bf33c3-f78f-42b9-84cd-8a8bfc8c7766", "comment": "Malware payload", "value": "4a19a9664888d4be9ad4ab4ddebcf79a8fd08e69", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707942887, "uuid": "45ff1bf2-ec32-4e41-bc93-040f5d05c995", "comment": "Malware payload", "value": "e1f3e647d796beaf6d4bcdedc4a0943dbf3b1145917359666c1e90c30a90893770f9f8f946835f25c1c76958c3d5b2d5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707942887, "uuid": "a9127483-ef41-4d34-8eca-73fad7d01d04", "value": "T1D006AEA17DC804A5E07B03314F99FA78F16E7DB01EFE31971292F629A936D410B1C66B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707942887, "uuid": "a6bd8ce4-2495-4be0-bd18-26b4fdbd56a0", "value": "607d0c9fedb370b1ce70573304bcd084", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707942887, "uuid": "739454c2-9268-4cb3-96a2-de9f9d8626df", "value": "98304:5wrMZ1Fm2dvuvPSyzxUY9TdxbfPhHFLOAkGkzdnEVomFHKnP:5DZz+dxbfPhHFLOyomFHKnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707942887, "uuid": "8d4f513e-bc0c-40df-b7ed-75ec6bde74af", "value": 3771472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707942887, "uuid": "be92a17e-2373-4cbd-b64c-f498845ad4b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707942887, "uuid": "b4729835-3193-4e69-99d4-7039d850ccf0", "value": "WndResizerApp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c2ce01-cad0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707870851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707870851, "uuid": "a9e3c1d2-d73e-459c-8d9f-50342ab92896", "comment": "Malware payload (Formbook)", "value": "53e55c7aa44a2a7c24ccb5530e4aa142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707870851, "uuid": "3846f6bb-7633-464b-a9f5-395a7d6ef697", "comment": "Malware payload (Formbook)", "value": "81a7838ccb236673b22b689c771c82c6f3f28500b7e473a1f2c32635f885e98d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707870851, "uuid": "938c875d-7716-4d1e-a610-e04f665ea815", "comment": "Malware payload (Formbook)", "value": "1359b36a7f0b4bf46ff65e1d0755453e2a85a26f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707870851, "uuid": "f9307cdc-0f2f-4783-b87a-dc7ac5ae9cd7", "comment": "Malware payload (Formbook)", "value": "0ca9e8513cb850a04403be8fecbecd769133a8adbabefed4ab6948dbed93d5bd754d504abe642b41a3993478b3775171", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707870851, "uuid": "044fe0e4-dc2f-498f-91f6-2247134493dc", "value": "T191E423113E6C0713C1D89BFD6873848887FE269A5223E7589ED0F1C6BD66FA14D7068B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707870851, "uuid": "58319003-1bbf-4679-8eb8-c127509d2feb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707870851, "uuid": "1c6d2fa2-89f4-4523-962b-13606b6c435a", "value": "12288:eiD2A0lu9deI/0eDXODoFrdK4KNNUikYeQpZUThNNNL4mfkyFelYFQpFy:tw+Xz9oNRUQmXR4m0lYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707870851, "uuid": "b65d4a12-8b15-481b-a70a-ade35cac6a61", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707870851, "uuid": "d36f928e-1406-407d-b685-62d9188e45c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707870851, "uuid": "b275f72b-0abc-4dbb-96e8-b384cfacf8a4", "value": "SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.1381.31942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf343d07-cb04-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707893201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893201, "uuid": "3840e72b-a690-49aa-9031-271824cfc508", "comment": "Malware payload (Mirai)", "value": "19232a6789e5ab61a7b2ebe914928b65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893201, "uuid": "12cf1c00-5c00-4c52-ba97-231532761901", "comment": "Malware payload (Mirai)", "value": "83eeffd4bb6009ba7e90a9b414e8552c3c85127197924ae2fd07a6583f006883", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893201, "uuid": "09729d8b-bf95-4aaa-a725-2631c316416b", "comment": "Malware payload (Mirai)", "value": "ca5e82dc866688f841fb7c6e7fe07bd0c0ca6c0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893201, "uuid": "c7e48375-5d06-493d-90ae-52127bd47ed3", "comment": "Malware payload (Mirai)", "value": "89eecece1406a3411db991ec7f16df45d24cfb57b8f184193e487aa4489949467c246f4c23876bc413e30702540b37a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893201, "uuid": "8ab2c2f4-ff1f-48fa-b0ad-d58acb5d9e47", "value": "T106431A55B8814B22C5D512BAF96D128E332357F8E3DFB2139D202F603B8696B0E77D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893201, "uuid": "769d7485-ee1f-4a46-bb7f-b0cab6b0f587", "value": "1536:Monaan3Kolm4IcTczRQAMF6inQDLQKAg:L8DDLQKAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707893201, "uuid": "48004ce4-b303-4a5f-a5d7-4a44c7fb0fcf", "value": 59812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707893201, "uuid": "1af307f5-5b10-4140-9b7a-1e60602e4038", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893201, "uuid": "9f5283d3-59f1-4e9b-9a8e-1c3e98cf2541", "value": "19232a6789e5ab61a7b2ebe914928b65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c903eb8f-cb09-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1707895338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895338, "uuid": "36343ade-48ef-464d-a723-5182127bf995", "comment": "Malware payload (Vidar)", "value": "7ed18c9a539fac6ae1dd3dd7e09a1f5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895338, "uuid": "098f135a-4852-47c7-bbee-a0bf4510664e", "comment": "Malware payload (Vidar)", "value": "847e76842877b9ade008ab9bd4ca32bcf8173b785de1e32c4a4e77e06c891efb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895338, "uuid": "5064ba08-a85d-403d-91e7-608ab38d98c1", "comment": "Malware payload (Vidar)", "value": "0ce425b7ada9a4e12ad822c512a9955de4f64983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895338, "uuid": "eadb5395-26f5-44d1-b3b2-ca962674a0fe", "comment": "Malware payload (Vidar)", "value": "636c66ac37c783396ff9472cfa26724be15a94ea8e1ddd5da6f25deaddbdde50f66390cec316765161fa942705b6fc3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895338, "uuid": "4876753e-d45e-44a8-8f58-96a24f6ab8ea", "value": "T134649E311EC0B629D88108FAC659BDD31F5FE4A74E12F8B2D60917572924FC26F346AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895338, "uuid": "87a19049-1c58-467a-ab30-5e3ac6d9d669", "value": "dcdd7fda4b828a13bab9a0dd63981aa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895338, "uuid": "5fd054d9-0dbc-4eaa-8e23-b0e069ff15f0", "value": "6144:HJlYPdDk+IQSoGruvi6ryAv6vm9TjFxIxNeI/tSl8:HJlYPdMEGr4inC9TjFxIxN0l8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707895338, "uuid": "e49ac462-78f8-4338-892c-1016756ddbdf", "value": 336552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707895338, "uuid": "083beead-90d5-4eca-aa9a-ab29bd667aac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895338, "uuid": "ce6be6be-4821-48f6-aad5-4aa455c85779", "value": "7ed18c9a539fac6ae1dd3dd7e09a1f5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6090398d-cae8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707880989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707880989, "uuid": "9359aa07-3cde-46cb-84d5-3217d9d9c144", "comment": "Malware payload", "value": "4646672e254598b8243e7b63701282d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707880989, "uuid": "951b5956-efb6-4a38-865a-003931be2e72", "comment": "Malware payload", "value": "85774c163dedd186c77a67d252d6591dbf95d054425a9276cfb21223b8ae995f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707880989, "uuid": "3210091d-382a-4669-aef1-a2f3b0d26991", "comment": "Malware payload", "value": "1677a087d0230e19fc62e115a50bd3bfe955319c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707880989, "uuid": "4679ef7f-ef2d-471f-afdb-6db8733a8d80", "comment": "Malware payload", "value": "7deac3001458b1a0b0a4fcd044b5463a0ddcfb809183310889c3065ad1ce257d968a6dd3333e36337d125d559aa8fa75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707880989, "uuid": "0ac24516-b161-4d40-a23b-c31896565434", "value": "T1CA935B51B5D18871E5771D3158F8DEA05E3EFE605E218EBB3398022A0FB41C09A36DBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707880989, "uuid": "1643130b-3e50-4142-9fb1-5985f6f53811", "value": "6d33a22c7100b3fdbbd5b7f693b7b06f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707880989, "uuid": "4dc86f76-ccbc-48c5-a105-892e59f03a38", "value": "1536:6gkpi6fNrfIsW6EK9q3TtutVD9keKHtCXHsWGKPtcdGNSKfjREPqZBpj8:0iuhws3xA3TsHDCHtAwGDfjREyZBV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707880989, "uuid": "eeb0921f-88c7-4315-935b-9632d5600432", "value": 94416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707880989, "uuid": "fa82dbb2-67be-4781-8885-89d66144ca99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707880989, "uuid": "2496631e-51ac-4715-908e-bd1dc864d7b4", "value": "SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.ConnectWise.gen.25164.9324", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8aca778-cadf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707877379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707877379, "uuid": "ead6e99b-f228-4b0e-b89a-0d64aa28398b", "comment": "Malware payload", "value": "260d5154f8609bed0656395da0816ef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707877379, "uuid": "183ada5c-d57f-46bb-8d91-611111be340a", "comment": "Malware payload", "value": "86071f75bb07bb1b50df3fe82860d9a6f5f55f2808384e86100e3546dd8504a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707877379, "uuid": "cbd7cf83-4cbc-4620-b06b-06c4bae9bb69", "comment": "Malware payload", "value": "c28b8ad898453de4e10c470f58f453174c66a228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707877379, "uuid": "d1d7d739-62f1-4145-8d58-0a0a0c5e089a", "comment": "Malware payload", "value": "ad38bd263189a69d4cdbd2422cf3f2228a1f710a3af918bf1c56d2f442a91771d913752cd464bbf267660b5180759b81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707877379, "uuid": "af037248-0c4c-48e3-88b4-65535ef58ff3", "value": "T1EB156B60D6D044EDD6F006B27C2893303E28AED42FDB865DC6D8B85B29A4D415FB7E36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707877379, "uuid": "a313b4c6-ebce-4a5f-82d3-20800a4fa486", "value": "42d651751c1d75ed4fa8fe71751854ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707877379, "uuid": "2bf2191c-d64f-46c6-b5eb-5f6c342cc363", "value": "24576:GNsfiTdYSuVzZH9tH1v1ds2roP8XcOZa0UV/I:mT2pZ1S2rLU0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707877379, "uuid": "b345c05e-c47d-4780-a98c-926102fe806b", "value": 884160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707877379, "uuid": "1c3ec779-b507-42de-b073-0988a1517ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707877379, "uuid": "0fcbe4f9-842c-41af-963e-e129730ccaff", "value": "SecuriteInfo.com.Trojan.MulDrop21.62536.31085.31912", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a8067d-cb0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707895842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895842, "uuid": "53ffb560-6954-49db-9ea1-0fa2a9021b5a", "comment": "Malware payload (Mirai)", "value": "21e6101629ed8ba4776b49ec0af8e2a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895842, "uuid": "d914032f-16a5-4b07-a4c8-420880279256", "comment": "Malware payload (Mirai)", "value": "86e24225669fe897c534f64ba813f0ccb557a3e56abc417b0a5d384f89d2111f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895842, "uuid": "cadd0247-9254-4dba-b6a4-c3af17a1067a", "comment": "Malware payload (Mirai)", "value": "392ecb586c29c8a1577a8745bff92f01bfa6e084", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895842, "uuid": "206ac4d8-ad1e-4554-80da-fb8c9a0ac34d", "comment": "Malware payload (Mirai)", "value": "e067d0bc639bd8fe1fa13d48b6abab9a1d067e3a27837ec53592dcab8ead55ef5cbff540a0a1dc1b3d1f16befb87d06a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895842, "uuid": "389d955c-52f0-43af-aca8-37b6d06010ab", "value": "T100B2CF11D19598F1CEB36039F73DD8429BDB92BC41F96333201282B47B8958E5ABDB47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895842, "uuid": "908a0e55-006f-46cd-af25-afd1f86956e3", "value": "384:4oBE5aNSS75BOI+ypZ5vTlYIwcvsdTf5MF1icXjw9qFeV6ub/unIYtDhymdGUopj:IaNSq5sOHpTqncvsdDePiSr0qDs3UozB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707895842, "uuid": "965a7719-7dc6-429d-8fdd-1749203354f8", "value": 23728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707895842, "uuid": "68f3d61e-2db7-4ab5-9211-76c1335fcd6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895842, "uuid": "1a9bfa69-e653-4e3f-bb3d-b685abf88b5f", "value": "21e6101629ed8ba4776b49ec0af8e2a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00446a7a-cad3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707871808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707871808, "uuid": "54de763c-ba95-41ad-a743-4b918d9305b6", "comment": "Malware payload (AgentTesla)", "value": "cca2c4f7847f3a31b4c9fd2631a1574c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707871808, "uuid": "173cdbd3-4f0c-411f-9c30-3914b95b58c8", "comment": "Malware payload (AgentTesla)", "value": "874c55082539da1029b7ee6316ccf5b21b8ee93787c3ccdc11ea3cf6e6604706", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707871808, "uuid": "dca7e354-ad00-4b03-943b-61f22793d98a", "comment": "Malware payload (AgentTesla)", "value": "25cfc56858d7c2f947bb2fefc0d62871a528499b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707871808, "uuid": "3d74f289-38cd-464d-abaa-871cea75eaec", "comment": "Malware payload (AgentTesla)", "value": "cf45119c550240442628482ac77090fa086572a2d3430b275bcf3305efd3c212a0208bbd2efe6a777cc8247ca7042da5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707871808, "uuid": "7cfaf22e-921e-42fb-99d7-4aa329cf801b", "value": "T16A14073933D74D99DBAA1A3299F191124772FE255A2BC30FF98C329D2F763860940723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707871808, "uuid": "9df48eef-d833-40ef-bb3d-f111af136207", "value": "1536:izVT3cGeR+/ZQA349qCV/hOU/yjTI8nVb6SBkoZ4ZGtRZSEXFjLBM:ihcBRYALyZ88Z6GkoZUGtRZSEXFjLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707871808, "uuid": "2651eb92-abcc-4172-aeaa-e8cbe331ecb7", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707871808, "uuid": "340016bd-8ce2-4dd9-905d-e4463cfa0662", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707871808, "uuid": "0ed9e934-2508-4ef9-9094-d819b3d005a7", "value": "ORA_1588453_2024_1_122_8022024_pdf .img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1c6933-cb3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707917709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917709, "uuid": "3a716b9f-a184-4a39-8265-4c2bf9497875", "comment": "Malware payload (Formbook)", "value": "7320aee4c89289fec30a46f0e860f26b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917709, "uuid": "420a90a5-3a71-49bb-aeb0-6c95f070b45d", "comment": "Malware payload (Formbook)", "value": "874f3129ac908dc7fa89227e09bee24cd77143094ad6f40ac4c4b724071aeb45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917709, "uuid": "e970dd3d-0a17-460d-9e27-7df41ab37d8f", "comment": "Malware payload (Formbook)", "value": "c7d145ed3d3751146b4bd4ecc0a0091c0cd74796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917709, "uuid": "da04f323-279a-452b-8bf6-e163ea8a5092", "comment": "Malware payload (Formbook)", "value": "316de93011b86922ef8d5573caf7d2099a3d92c7f3980000f8f4d0ed2efb386436fb3d1958407cb2e6af9ceeda690843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917709, "uuid": "54ad11d9-02f8-427b-b4b9-716e8ebf9598", "value": "T1252502A632C8DB27C56DDE3834A121C746B06C61D268D2D81D9D6DEB3EB73B044379E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917709, "uuid": "34104fbf-2845-4e85-a024-62214e71fe6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917709, "uuid": "92a5fb51-6086-424d-9b40-2636f07aa31c", "value": "24576:W0JEBP67F7I2qc2GXd519P6F1wgnhfz87brh8CS1:rJEBP67JiO79P6F1wghfz87hDS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707917709, "uuid": "31d0ff4e-f2e1-4bd5-a866-f0cf1b8936e6", "value": 1017344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707917709, "uuid": "50e6796d-947d-4dcc-ab5d-f7ba4901e089", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917709, "uuid": "f47889a7-60d5-415f-9f2e-19f86aaeae5a", "value": "z1TTCOPY_IMG_00029921.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c4f359-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707915913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915913, "uuid": "c6a15c61-674d-42ac-b731-bd2d9faf1b73", "comment": "Malware payload (AgentTesla)", "value": "218d2983f7dde2a82717ef9fd30847ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915913, "uuid": "a7ce5b99-a803-4f59-957c-9a4b593276f5", "comment": "Malware payload (AgentTesla)", "value": "87efe43a204f48afa245e2c7c9019dea76283b0c3ef9338f745eace84dc2ef36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915913, "uuid": "c80cf927-6d60-4916-ba12-b40111a33c50", "comment": "Malware payload (AgentTesla)", "value": "22322e42c479a0fc6bf43fc04d3313d797335cfd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915913, "uuid": "4076a483-2a00-44d7-b828-30a7dd91cc2c", "comment": "Malware payload (AgentTesla)", "value": "c6d65e1cc8cb58441bdf93e5ba9c61b39074d6c347e7aabe0dc18a33d71fb24ae54be4f73895dd6398a114217fa07a6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915913, "uuid": "253f56a1-df3b-4e5b-945f-a3525faf278b", "value": "T151A3B303BA985B51C81529B284EF593543E07EDB6633CAD93F4C73AD0D413A3DECAA49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915913, "uuid": "d145f29f-9a35-4606-a8a6-3ef504a55259", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915913, "uuid": "f8bfbcc2-df6e-4fb7-942d-a54bebc5219e", "value": "1536:b0ue2DP0MibkvKMacmVsfax5H4D4eDQRyfN1PyjCr7HxPFTI75Fi3hFNj:tXP0Mzv69afaxOD4eDQRy1yurrTIXAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915913, "uuid": "f8c05473-d49a-4341-9c62-2b2c907f3bf3", "value": 105544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915913, "uuid": "2bd5194b-deb2-4223-bebd-c2423786b5af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915913, "uuid": "9cfbea4a-b8dc-4c3e-97a5-09d517a76e31", "value": "DEKONT-14-02-2024-98766789098765456789876567898765678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28503822-cb0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707895498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895498, "uuid": "a01e18b3-d577-4373-bed3-0fa1f56ba6c7", "comment": "Malware payload", "value": "ff0838a9b329a42820eb824efd11c58e", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895498, "uuid": "ed3d7f43-ebaa-4760-a69c-76a0833ccd67", "comment": "Malware payload", "value": "8930434ff6b03734e2a5deb45c6149017a441be1def9ee514837037c7204ebad", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895498, "uuid": "7fec09b6-bec3-417c-97d7-6e5f829ecb14", "comment": "Malware payload", "value": "a34668789a9238660453e5d8ccec13e19614bbc0", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895498, "uuid": "a6b70d52-497f-4731-8fef-b04be2499168", "comment": "Malware payload", "value": "2e4a0daa5e460fd380ba943eefee3a20983576928d6eed16e7c6d14f7f3dfaf3c7485fe09f35072c13f05355c6b0ede5", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895498, "uuid": "c65d3514-e453-4405-bff8-6c7f591131ad", "value": "T1FAC40140FA818B47F46A0A704AF74F9A6729FD819B528B0F315CF72E3DB03955E17622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895498, "uuid": "b413b89a-0166-4df8-bb14-c51a3768212e", "value": "12288:tTk3SEXMcbNedomzEDb3bVarMIdOJJhI8h1CM:GSSMMednEDb3bVAOOs1C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707895498, "uuid": "6642ce24-9bdc-4d64-839a-b38970b2dbf8", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707895498, "uuid": "dc996608-259e-473c-bc86-47bbe0bc4341", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895498, "uuid": "10670479-7ce9-4ed4-b20c-7ac8da8f878d", "value": "EES Offer VT.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac538ce4-cb54-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707927502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707927502, "uuid": "e3dfcdca-f5d2-486e-aa42-909d6c9f055c", "comment": "Malware payload (RedLineStealer)", "value": "ec041db32c4219351d2a228d57fd30a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707927502, "uuid": "6c41fd87-e3e8-4c91-aee5-8f6c8f1d7b86", "comment": "Malware payload (RedLineStealer)", "value": "895ae146dda77f84b891419a4110fbff79e9b3ad2441fe1f76b44c05e3ac0ce0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707927502, "uuid": "ab1dbec1-6b2f-4687-8140-02842d6f6ed9", "comment": "Malware payload (RedLineStealer)", "value": "a9540d6a8a55331184398785e7b970b020713750", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707927502, "uuid": "2570df31-7858-4e68-9eae-1850c8199a12", "comment": "Malware payload (RedLineStealer)", "value": "3adf48636208accc30197efe7282ac326a1a4e0da29d581fd14933f777cbf2d5c516b8e720228779c9c5f536bfd9373e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707927502, "uuid": "9d562add-0c5a-4ef2-998e-27df7f6d85cf", "value": "T131D412517480C1B3C4BB053544F5CA3AAE7A707657BA96CBBBAD13FA2E102D1B2353C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707927502, "uuid": "2931d508-dfab-425b-8ee9-8ed0e97cb398", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707927502, "uuid": "f6c3eca8-08c3-44df-bfd5-f81bb709aed4", "value": "12288:kh1Fk70TnvjcXXrEHlqbr9X1XDjPWy7+vjszs7h1TTrtX:Kk70TrcnIHlqbTWyOx5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707927502, "uuid": "b6d5f21c-2f54-4c7c-9b69-fa257c98dd83", "value": 655328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707927502, "uuid": "a350037c-4781-42af-be76-8214b437df37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707927502, "uuid": "b94f3a40-ac5b-4985-932c-baf1954f9049", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f070a822-cb8c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NetSupport)", "timestamp": 1707951668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707951668, "uuid": "9ca6a92e-fc9f-4428-b0ff-8e1f228b8196", "comment": "Malware payload (NetSupport)", "value": "67dc90ce87a154aab36ae1eda92fc21c", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707951668, "uuid": "a4dbf773-1836-48f9-a856-e9e3bacbec04", "comment": "Malware payload (NetSupport)", "value": "897a91bc526362d7266bd3ca6d0439677fe19348e7f7ec261a5135f0a16a7af9", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707951668, "uuid": "dbe4b35f-92fc-4aca-bf4e-0f96b9845b64", "comment": "Malware payload (NetSupport)", "value": "c9e169260a0b3d7aab5da15b72d8a958d68ad7a6", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707951668, "uuid": "6ec6208d-822a-4a51-962b-1eb0ab9501e0", "comment": "Malware payload (NetSupport)", "value": "04acd84bb8464fb04327239ac7e9e6889eb6aea4346631fe0b804b4a4b715d83e436c2edf9c59bd0e07d37b8e1e94962", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707951668, "uuid": "8b506d02-e01a-4758-92b3-d2c1507f06aa", "value": "T15BD533526393F7A6C0E2F67BB09DAC161E6C607C94FA3A630C7FA9D2D636451C46F402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707951668, "uuid": "6d7bb122-945f-4645-95f7-4b3dfff98c7a", "value": "49152:3lAQumelDlEDThXBJOhHLw6J6h2SFFGf0RBNTQfYc9jh23eWeB3/YSBm7WIqR/gF:3l7/FXamhRFY89YYc9jh23redpmQRC1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707951668, "uuid": "b7d33e2e-0480-4792-b8fd-59d6599f3794", "value": 2944972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707951668, "uuid": "0ab3ef65-0f9d-4184-99f8-e94a82fcf963", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707951668, "uuid": "5fb66de1-58f5-4e36-b5ad-1287628e10f5", "value": "VVV.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef700ea8-cb2f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1707911723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707911723, "uuid": "750911f8-52fa-496d-bc4e-32e1d4f5afd0", "comment": "Malware payload (Socks5Systemz)", "value": "19879f6acf693b56910c07faffd375c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707911723, "uuid": "45f1e8ed-76d8-4a97-8c72-873b48c725a7", "comment": "Malware payload (Socks5Systemz)", "value": "89e1cd7b16ad87f6ef1cb0693ec15c807ce42ad600dae87c1ecb491225035ba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707911723, "uuid": "fc74bcea-1df6-44dc-879d-72accb8e1fa6", "comment": "Malware payload (Socks5Systemz)", "value": "6e681bf6f5497836b32c70d5c98276880262cee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707911723, "uuid": "85a72158-1f41-4b36-ad57-92fdd896a45f", "comment": "Malware payload (Socks5Systemz)", "value": "f8d3f937deef5f0f6fbd5d279f296c07a1cf3c8f42c2e94bdc1bd4d75958c4e26fd030104d09f19ceae1771038f4a345", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707911723, "uuid": "f10fc8fa-dfb4-47ac-bc20-4cb625570aac", "value": "T18754AD1023F4D0B1D343113486A5E7B14BEEBC22B622BA4F6F95E63E1F38E969517319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707911723, "uuid": "85a1d249-ce5f-447e-a664-d5881eea72e3", "value": "7a16202dd7202181174ee4ca5dc3433f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707911723, "uuid": "6855827b-0abf-4be3-9be9-c32c4ee672f9", "value": "3072:0ziRfFi3WzI2OGwtySjMwOrDNKDcB+XlJ56Lw1xmUxaIa2Vd:JRfFDaOkc81J5oUxaIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707911723, "uuid": "887fc344-1ba6-4eb5-ac44-28ee704db7cc", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707911723, "uuid": "8754186c-68a6-45d8-93e1-050eed4474ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707911723, "uuid": "dc62ed50-7236-4405-bc55-91c7c9b7e898", "value": "19879f6acf693b56910c07faffd375c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1608a1d0-cb04-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707892890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892890, "uuid": "ad876325-1e82-4f52-bdde-b0542700f3ba", "comment": "Malware payload (Mirai)", "value": "15cb68508d074b2f7dfc809c20b8a389", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892890, "uuid": "0a7b10f2-f630-4425-836c-1cc2c3c6c556", "comment": "Malware payload (Mirai)", "value": "8a5a3c7c2e37c734b1e9a61310cfac62700e98079f0c98b3a4a25adb5bf3c9af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892890, "uuid": "754bee77-d9d8-4d98-866d-26c6a9ba6b24", "comment": "Malware payload (Mirai)", "value": "e6358f1796b07ba78166c570f56bb4a81f339ed1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892890, "uuid": "dc85bed7-aee3-45e9-991e-c0b7c165bc36", "comment": "Malware payload (Mirai)", "value": "abeb7de83f61429ab660a6e40d3e3ef59fe9f26d8fa231561e88b0348f9bf5e732e94d6931e14f64bc5ef031baeca91a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892890, "uuid": "efae0cd7-516c-4f7e-9cd1-daee8190e909", "value": "T16D53B615BF650FB3DC6FCC3705EA2B05288C654A22E87B367934D868F54B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892890, "uuid": "9f6bf540-02d3-4b0d-aae0-ea48be47c112", "value": "768:Xq0PX0mnZmIrBjKeHne+qeDNBkxlZszfXiowAu4I8qw:XqSX0m1u+nXq6NBkbZszBJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707892890, "uuid": "2e69a386-4ea9-4681-a47f-e36238f7182f", "value": 63940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707892890, "uuid": "c2ad7d30-3533-4c78-aa57-f6b8ce3ca37e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892890, "uuid": "6e6fcf3a-23df-49e4-b7f3-48999b64b8d1", "value": "15cb68508d074b2f7dfc809c20b8a389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4d55aa-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707947445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947445, "uuid": "dbbaf300-370f-47ba-a3f6-8b80503b34ce", "comment": "Malware payload", "value": "32746efc594bf427d7c805a0b1569313", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947445, "uuid": "2cc39797-aa68-4468-a6a7-f8e55b9647de", "comment": "Malware payload", "value": "8c2271ab20b6934c7988cfd586fb8f2bb22b3752aa6e73e6897af5b11255f7ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947445, "uuid": "d0719ac4-4695-44d5-bc6b-22744b86c2a1", "comment": "Malware payload", "value": "acf7647636f1c885a5165a1ab8e4c9625d969e6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947445, "uuid": "4264b37e-e043-4e50-8c94-8836c4efef54", "comment": "Malware payload", "value": "878091ef8fdc805988e85d50497eff7b111625ce2a16a1bdbd83c5f994a2a82847fac4a64a14e990ac3b5c376ea57c0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947445, "uuid": "86420720-55d3-419a-aa73-4fc17e493e2a", "value": "T1A205E09C3650B5DFC85BCE368AA81C64EA60353B571BD607901712EC9A0DADBCF252F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947445, "uuid": "a3cac271-1639-407c-ad98-975ce9a05542", "value": "12288:ZHBo2DdqUdwcHa7pgq5vgv+1v1yMM8x3qfv6YyErQ7E4RT/toMayELTnNJhC/g9P:VBo2Dd9dpiyqZgv+OMMe3gFkV/eDpnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947445, "uuid": "2a5b3f58-6ea5-4456-ac21-54be3d202620", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947445, "uuid": "a8fbc6a9-1bba-4a3c-991f-221ad7c88833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947445, "uuid": "53c7b3e0-c694-4a70-8138-c4cc44a72ca9", "value": "RFQ_588202411200ILC004923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17cb9d5-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707915941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915941, "uuid": "27b3894d-6d27-4e36-a810-ce95a43d0862", "comment": "Malware payload (AgentTesla)", "value": "66a6cd16d3f402326c3d87b18ea286d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915941, "uuid": "82c68a42-3d8d-4d59-8ee1-e444fda6f40c", "comment": "Malware payload (AgentTesla)", "value": "8cd9365e199e3337d7c324fcbf33c0df9729f3c459b42aa6ffb50d2aacf90367", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915941, "uuid": "bdb210a9-28e5-4882-b27b-12e60781b7a5", "comment": "Malware payload (AgentTesla)", "value": "cbacca9aa25b34fe95548c1e7873eebc2b4cb662", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915941, "uuid": "7224340a-2ff7-441f-8eb1-6f2d3297b8e0", "comment": "Malware payload (AgentTesla)", "value": "4afc9c320bf83aa402fff2e10766af232f7302e4e88b85a70a0e06525e2cc09e2c757c7341d09c17b28bcc766b30288d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915941, "uuid": "988ab235-8348-49a9-82fe-b476075ce4be", "value": "T198B4F121B7FA1A6EF5FB0BB77EB694164E77BE923916D65C1060008E1836F808971733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915941, "uuid": "d5cd18e8-3bb2-424d-a4d9-5614761da65d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915941, "uuid": "9bf41c7c-b99c-4e00-91d8-12188f68cb11", "value": "12288:1frrB1o4hZe7pcB2QwyPLMjHEr3Aq2c56rMmyf7:1/B1o427pXQwyPLMjK3T2c5gMmyf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915941, "uuid": "6c532d13-5136-4285-96d0-a8fac214b6ab", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915941, "uuid": "8f93de18-4cf6-48af-b380-5ecf416bb658", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915941, "uuid": "620e5ad3-ec09-4fee-833c-bf194e4cce8f", "value": "soya crypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2b0620-cb15-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1707900386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900386, "uuid": "4336467d-89e5-4d2c-91f8-4b61b08409a2", "comment": "Malware payload (CoinMiner)", "value": "a0eb024cb13b9c02849ba0729f2e5b1b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900386, "uuid": "165c626b-fc42-43fc-8191-77a812dd14ff", "comment": "Malware payload (CoinMiner)", "value": "8dad514c01ce5564c635629f624bb0818fbd27d030bf74027b394b0ca8f673cd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900386, "uuid": "0316a111-966b-413e-b60c-71877a266a08", "comment": "Malware payload (CoinMiner)", "value": "0f6eab3f3cfe650f138b03a9b21a325846f99181", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900386, "uuid": "c371ba5a-7cd7-45f8-b683-93f9ae3de375", "comment": "Malware payload (CoinMiner)", "value": "d5cd8d594c678307107f5631fcb56a168485e26c0d40133781e35379e8c5cbc1396793aced3b41f8518c3d851976bfd8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900386, "uuid": "7f3b899a-e644-495a-8fcd-8b1378dfe9fd", "value": "T1D495338547080D5506F5BDB8F378D26129BCF6B04B8DAF6CA04628744FDE5B8A227BCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900386, "uuid": "e6d6fb51-6997-41bb-bb7d-c50b8e287167", "value": "24576:XkPzFlYrTt2yK76bDStavvPdRWJ8XVxHUukz7bCquzozHvKI9U04C4Lf3Hf8OO9d:IxleJ2yaauGXGfiaHCIKU/Aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707900386, "uuid": "8feeb52c-fd79-4577-a87b-9ffaf4c492ff", "value": 1892572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707900386, "uuid": "f6541cd0-d563-4107-b22a-27d5b427b1b9", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900386, "uuid": "17a46496-3261-4678-9533-818bfca331e0", "value": "redtail.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e893b4-cb15-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707900297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900297, "uuid": "c1774295-4412-41d0-b75a-1ea0a7489424", "comment": "Malware payload", "value": "73c56b6585ec6b3a6fb180d12ec312f8", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900297, "uuid": "1f8610ba-dcd7-4ef7-95a8-713ce53e6148", "comment": "Malware payload", "value": "8ff5ae82390178a13604aa06329c05295ba6631bfacc4fab7004b56efee885d6", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900297, "uuid": "1037a319-9ca1-4822-8940-8d62a467618c", "comment": "Malware payload", "value": "a5bcf1517d56eb7a2a6ea1acf4d95c0eaa2edee8", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900297, "uuid": "3258547d-d70f-4393-92bc-e4417d757575", "comment": "Malware payload", "value": "41df9a393f8fa84ea872d4f82817334739b4f8a27fc2bb21990776827a31ac90bc87d21ba06a3986aa4a3018146a360b", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900297, "uuid": "cd61ec99-ded3-4ae8-b4f6-c17b81f01b89", "value": "T10845532D9F020067F27892704AE56313F7F0AD5733B1854372DC435D9F6A6942EA0A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900297, "uuid": "9e586a4d-6b48-4845-96b7-7fc90f965ba5", "value": "96:5KFvsbpV1UmMJB2/N4cgHVHaxO191aIQ1UFiY46:A9fBo+Y0HIU8Y4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707900297, "uuid": "73344a2d-aa1e-41d8-959b-f8bb19f8a69d", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707900297, "uuid": "a2fd9e40-850a-4288-9a42-238419528bb7", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900297, "uuid": "a3741b36-4a07-44ab-9df8-7e4aa760ad26", "value": "doc20241402070611.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb291dc-cb18-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707901604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901604, "uuid": "cc71928e-6b09-4f7a-9f49-1222a8b81039", "comment": "Malware payload (Mirai)", "value": "e08a9c4d636024e60706896348697125", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901604, "uuid": "dcab26a9-5bc2-4cbc-b336-d0dbb0ea660d", "comment": "Malware payload (Mirai)", "value": "910b545b79026c029fd281d6544bdbf66182e03dc364d81247f5095f391f0985", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901604, "uuid": "6e63f93d-e8c2-4740-91f4-eda9d968b9f1", "comment": "Malware payload (Mirai)", "value": "9c548620be5c07dfa87d907ff86e21df425c22ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901604, "uuid": "33628894-0e33-43c4-941f-6ec6e4221260", "comment": "Malware payload (Mirai)", "value": "5ecef8e03766d29ca1e6ef1f190067de016e070525486aed7c44de8a589b5b9aea10d21f668cd416069404a22e2efdfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901604, "uuid": "52fc7e95-f2d7-4a01-a969-7c61607ef103", "value": "T1FB634C85A8025E6DF6CBE2FD41625E0CFD21222161A30B27BB9BFCD37D72168CE55E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901604, "uuid": "ca9bb559-9267-418c-9b88-c0d8f955446b", "value": "768:/cP8C8DANi844SyZcJJu9MSUscV9Z74mQ4Y2N/PgFHqZpjduC0HApkE81FXfYLOq:/cHSJu9TUaCIFwpjsC0YkE81dfYLs8XN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707901604, "uuid": "c2a0b697-f8eb-4f9b-a181-e77cafbcaa5a", "value": 66728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707901604, "uuid": "26fd0788-2754-4701-98a9-faf141792ce1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901604, "uuid": "4c32be81-9564-4344-a43f-05f7864e7d69", "value": "e08a9c4d636024e60706896348697125", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568e95d5-cb18-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707901588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901588, "uuid": "78d82283-1943-4e2b-af52-ff159ff65f0c", "comment": "Malware payload (Mirai)", "value": "8b730e6225535c7773811f6c3e0790e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901588, "uuid": "2c5d00c6-012a-4bf8-be39-e5efef121bb0", "comment": "Malware payload (Mirai)", "value": "914ac579ffb65cf2f989cb79b7b251907a9101b92dd85c4a106885432271c103", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901588, "uuid": "50f2e356-ff46-477a-8dc9-b1a947a9c7bc", "comment": "Malware payload (Mirai)", "value": "fdd120572f9db6c1d55ad478b2edd2007527e539", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901588, "uuid": "9caa291e-1acb-490c-8abe-8a190a4b3084", "comment": "Malware payload (Mirai)", "value": "dfbec2899405e4206a1d98a1478c2c73b172a4201985204f683c506ef259feedc30498de6d9a5b8d89f32246738ea73e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901588, "uuid": "75775c55-c3cb-4666-96ee-7c96443fc445", "value": "T12EC2E1AAF91D2E7ACED4B2336C6C8F598331B063B2E34A1677C140061A1D3A75F24DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901588, "uuid": "ca1d972e-6373-4fea-b061-1037f4b42e14", "value": "384:MBgxD/wwryRUr2mMXjblHpLPcJmsFDc2YsrXMnhG4CSXsX+ZPiIO+g+3yQ:jD5yRoitHeJmsFmsTM/CSXsuZPhbgpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707901588, "uuid": "b5802b50-342e-4e6c-8ebc-7c202a9eb8ef", "value": 26824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707901588, "uuid": "7304a80c-9a4e-4cb4-afce-88cf30d1209c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901588, "uuid": "c26fa699-8789-46cc-a0be-bbc52e120b0d", "value": "8b730e6225535c7773811f6c3e0790e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d699b27f-cb3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707917694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917694, "uuid": "3def6b3f-d107-4322-a0c0-adfd0945a18d", "comment": "Malware payload (AgentTesla)", "value": "69892029df2ab0c6a2f80cc343bc8113", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917694, "uuid": "20a49455-b9d2-46be-91e0-204a0d139765", "comment": "Malware payload (AgentTesla)", "value": "9242b8a3c6395a2f6bf415f8244cf4e0ded94860543c2b9d4b8bee8d30c5351d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917694, "uuid": "598e7936-716a-4699-a4ea-bc210504e90b", "comment": "Malware payload (AgentTesla)", "value": "b9e897698717d3d4115975c5fdd4925638608c88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917694, "uuid": "020ab2e1-1421-4c32-94d8-0c27f09844ff", "comment": "Malware payload (AgentTesla)", "value": "6b6b7d4786b1146874b4b5b9613550095d969751db868ac3bd94cca36ab2017702f1f6ca8edc1a94733224fc5c582cd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917694, "uuid": "f7c43988-a42d-4525-a886-07a7503699d4", "value": "T1B0254AF265B5D929FD512BFCC9E9E2154B2B1D31C222818A33B43B1D2DB3EC2361E615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917694, "uuid": "c96bbef7-b14c-4503-9646-59b502413ffa", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917694, "uuid": "8c4a6b8f-c7a1-45cb-bdbc-5062575f2178", "value": "24576:4RmJkcoQricOIQxiZY1ia89t5IMIqCCvZQ:9JZoQrbTFZY1iaCtirCvZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707917694, "uuid": "534edc37-d9f9-40d4-b7f2-75c7f89f9de7", "value": 1007327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707917694, "uuid": "a7a5599d-3989-4b78-99c7-da3a1c74181a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917694, "uuid": "d656fff0-5a1d-4e49-ae9b-9ca512a8bea8", "value": "rPO-4500628950_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a33f58e-cb05-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707893407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893407, "uuid": "53622ec7-851b-468e-8292-87267ba71f49", "comment": "Malware payload (Mirai)", "value": "04d2d1d2f949eaaff8ec6215613458cd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893407, "uuid": "daa47087-919b-4de4-acac-7cf73cdd2dbb", "comment": "Malware payload (Mirai)", "value": "946ce0d1992339de82f1c9b963c1a8994e3008e5c4e3428878c28bb245c4da7d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893407, "uuid": "34e18347-f272-4591-9487-7406ef95e40c", "comment": "Malware payload (Mirai)", "value": "7b26695fcb7190cd14d42445241e2961675bfe4e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893407, "uuid": "999017b3-db0a-49c9-b568-bc4bf02ff724", "comment": "Malware payload (Mirai)", "value": "9ba717094ef52b96bd90f01eef270170b8456cdc778f6923fe11e77194388a1aed2f05da4f21b070d44ab620bb28d8dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893407, "uuid": "2164e8b0-d203-44e3-bff4-09a809da2467", "value": "T1B1C2E132913E5C70C29188BDBC7ACBD782D71E65A0B5B17A35180B6AD1A351747BC8F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893407, "uuid": "cdcf3e88-0380-4de3-9c36-d63f81d14936", "value": "384:kXNSIfjdxuZ1DUofVOyPqMAuPnWFhjm9HN5L8J1hIR4yGDvhymdGUop5hP:AjKX9AuPnW3jmFNlS1hiqs3UozZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707893407, "uuid": "c2883feb-1fb3-4e8b-8074-ac9218dae98d", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707893407, "uuid": "3c7d126f-c17c-45ea-a309-cf2149299a95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893407, "uuid": "dba9565d-15ef-4568-899a-44fe95a904a6", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac7a521-cb2d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707910856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707910856, "uuid": "f4baef69-bcf7-4566-bbee-c36d862536c6", "comment": "Malware payload (AgentTesla)", "value": "a6bfc51e7bd91aa2985be958683740e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707910856, "uuid": "98b5696d-60b1-4257-b494-08cf7fd94a53", "comment": "Malware payload (AgentTesla)", "value": "98bae7b4e01794d824bc755112dfc3d2816e58c8be3ccf253f471dc925624acb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707910856, "uuid": "1246e315-daac-4714-9f49-06924d4a8681", "comment": "Malware payload (AgentTesla)", "value": "6d91815052012d605487bc1e090278f9cdc53e5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707910856, "uuid": "dec28612-edd9-4882-9e68-915e950ced94", "comment": "Malware payload (AgentTesla)", "value": "415b27ad313c0b57a001128daa906c77ad12a8dfc9420f43f7b3f46d4a65b65dc8d2008d643d0c52cbb527ef4b1ea99e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707910856, "uuid": "71b7e9bb-a675-465b-bf9a-25a714703d37", "value": "T1574501203790863BC3A7873253F967987675DC0C360A9693121CB746BDB2F97AB4B1D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707910856, "uuid": "04102f78-5503-40a8-a69e-e3886f37ff3a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707910856, "uuid": "9d3c4aa8-d22f-404c-be46-1b18d5ea9dec", "value": "24576:CT5kVnZ5A87Rufq6K23kTwkL/XrKsvyJpo3s:Qel3A87F6KEmLbvx3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707910856, "uuid": "d0c90ba5-57a0-4ce7-a8a1-a6f970c4a65b", "value": 1180400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707910856, "uuid": "d01763cf-2b64-499a-8035-e1f5de037a3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707910856, "uuid": "b1d480cb-a927-41d2-8940-66e243d7e8bc", "value": "PROFIL FIRMY-ZAM\u00d3WIENIE 001-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd1fc171-cb24-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707906941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707906941, "uuid": "c6381e43-9ba1-49d3-88b7-b5ccdca7b033", "comment": "Malware payload", "value": "ee5ceff4974b7e5c42476e9537820a80", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707906941, "uuid": "d5e8f3f1-9aa0-42dc-aa9a-c92fa3eb2025", "comment": "Malware payload", "value": "996070dc18f95ec4256b2ad134d23f5b21211a3ca73156cce0d63dba0b3fc656", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707906941, "uuid": "da038684-3487-45a9-b6cb-15b29d0261b7", "comment": "Malware payload", "value": "039f57997b1106b08dbcade7a850bd6335e09ffb", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707906941, "uuid": "214dc897-258e-487b-a0c6-6d97da90cdfa", "comment": "Malware payload", "value": "5a0b8c050c219ae2f2e0a67223289624ef5a887d801d0af257216a13e55dba158fa47ba946337e156a8c1fcc395eebec", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707906941, "uuid": "764a4a1e-75d7-4164-ba7c-c7580322f955", "value": "T11075D0227386C537C96E01303A2AD6AB5579FCA74B3140D7A3C82D2E9E744D1A739F93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707906941, "uuid": "412fbe1d-f674-4544-989d-878756ebea36", "value": "49152:P4TvYpW8zBQSc0ZnSKeZKumZr7AYmLnj:0YQ0ZncK/ATnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707906941, "uuid": "e0204908-29fa-44fb-a51a-6e69c275f219", "value": 1634816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707906941, "uuid": "7d858a4b-1855-4f25-bdfd-542515e4187a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707906941, "uuid": "f1352d66-f4d2-4531-8ec3-4fe2bd3b2d16", "value": "SecuriteInfo.com.Win64.DropperX-gen.7461.32401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a0763a-cb46-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PoshC2)", "timestamp": 1707921454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921454, "uuid": "63bea809-0ffc-4a69-92d8-1a5223409f74", "comment": "Malware payload (PoshC2)", "value": "44570b59b21c1a35fe275b929cae1cb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "poshc2", "colour": "#657DE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921454, "uuid": "6e3163db-a602-4a40-975f-8023aff84777", "comment": "Malware payload (PoshC2)", "value": "998c6e82bf33a5610b411307f3dc729d5c937f7f61def6821605c042489723e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "poshc2", "colour": "#657DE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921454, "uuid": "f0a87fd2-b08a-40fb-ad94-a56c6637eff4", "comment": "Malware payload (PoshC2)", "value": "76005de735b74a830390f276d87af34e3add5742", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "poshc2", "colour": "#657DE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921454, "uuid": "c59e620a-d45b-4016-992c-910631cbf6b7", "comment": "Malware payload (PoshC2)", "value": "3bda7488a6dfdf2a3329168d536a97f5aea7e5dc13e35f9b1280ad9628500fa64943aaf6ab4621513c34f5598ce0a81d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "poshc2", "colour": "#657DE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921454, "uuid": "b6a558d6-0a2b-459e-b6e4-be26070e0ec7", "value": "T13D82184D7BD9D704C5ED4B7848B2631043B5E716A932EF9A2CC941CA5873A818A50FBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921454, "uuid": "bc560f43-2fea-408d-9f2f-a3f3b14bc032", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921454, "uuid": "c3095cb9-4a4e-4792-97a1-2986192355fe", "value": "384:yUG1jjA2c76wQ/J1O95acb43vK4oTb7Vnwbz/4w5/jKXuQD:s1kUBcfVneDrKXHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707921454, "uuid": "51792e2a-e1fd-43fc-8972-0e64b6f11d54", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707921454, "uuid": "5cffec00-64a3-43f7-a703-caf9ad327d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921454, "uuid": "354e601f-76d7-4866-b794-3d74b27ec95b", "value": "44570b59b21c1a35fe275b929cae1cb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2238145f-cadc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707875731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875731, "uuid": "ec3e040e-2432-44a6-b560-107c0bc93789", "comment": "Malware payload (Mirai)", "value": "f3b7c83c1ddb3a24cfbef8b30cff2143", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875731, "uuid": "9cbc3b2e-fe7e-4716-a4d9-1e7625016a73", "comment": "Malware payload (Mirai)", "value": "9a84da9d74aa008082b4e794885ffa2f6805864e10abd3b055748fbcbec5bab1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875731, "uuid": "81110b9e-0a88-44ee-810d-b8d05f5d2fcf", "comment": "Malware payload (Mirai)", "value": "7a6bab42144d354e230efa950e898a7146835d53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875731, "uuid": "3ebc91c6-c6b0-49d4-bb52-09d4c800a9cc", "comment": "Malware payload (Mirai)", "value": "8a11a0b23c38711bdd4e7fffc6720d8df2630a41345037d0b0bc56944a35d406583ca8d1b310e6f7d838355b966838c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875731, "uuid": "c7f5feaa-429e-4959-a168-0a0ff2e10938", "value": "T1DF539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875731, "uuid": "deb254f9-f84b-4ed2-93b3-bc3f65d0f360", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707875731, "uuid": "38d2f539-0523-4e92-9616-d04a4bbc285f", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707875731, "uuid": "63828d13-568b-419c-8cac-02350b6b7356", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875731, "uuid": "5dac4b5f-3bf7-4544-8c08-6d7f2f199309", "value": "f3b7c83c1ddb3a24cfbef8b30cff2143", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d120de9a-cb3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707917685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917685, "uuid": "76478518-32f4-4b4e-865b-fe834d617266", "comment": "Malware payload", "value": "3f7ddfa9677d6f62737da03ad8f7f04b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917685, "uuid": "2635131a-9af3-4a02-b17a-e1e8f4c6fe61", "comment": "Malware payload", "value": "9aaa05d2a94d558491c99aadda9d5333cad854e42bfacb2848f694965884d661", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917685, "uuid": "36025362-38c8-4b73-b685-d8ab67975b7f", "comment": "Malware payload", "value": "c79c1d7c28a686c62584b86a8e88fba0ebc44daa", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917685, "uuid": "be0180a8-7439-42bf-abf8-7feffa617c3f", "comment": "Malware payload", "value": "7d89329ff9a7975c0ede160253acbb6f4e95e4a498451ef82198fa91df72d56e15938f1aafad1d3091996dbb07f41164", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917685, "uuid": "b8a2a9e8-eb35-4ea7-ad7a-64abe25a2c71", "value": "T12385BE78EB833DDBD1F9A489C42E1DC5CE618C5F82206A09BB59B2B76CFB450C7154AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917685, "uuid": "da3edf52-45ec-4219-baf0-0db606ce2e7f", "value": "24576:ibbzU4JA5g17ST/0F1tjX48FSYlb+7jx9N29q6neR6:inBA5g1uT/G1tjX48hw7jB6e8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707917685, "uuid": "b044ba79-2e55-48af-a7f2-8832e80a1925", "value": 1791237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707917685, "uuid": "f12ca955-265e-454b-907a-b610a6c2aa04", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917685, "uuid": "5f728211-6e1b-42f1-8457-22f99c714c2f", "value": "rNordahl_Andersen_Order_no_106673_xlsx.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbec9841-cb45-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707921086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921086, "uuid": "35986ff6-c3f8-439d-855c-151f88daa11a", "comment": "Malware payload", "value": "5b9b1707bdf6d2219ade95c964675033", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921086, "uuid": "00985b03-65a7-4f44-b0d2-cd3da7f916db", "comment": "Malware payload", "value": "9b9d3270a631ca1690ab9b5a03e213eb7731964748a57c7cf6e789829472026e", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921086, "uuid": "f8178ecc-7c04-4b18-9b25-e164084eba57", "comment": "Malware payload", "value": "3f8a58729f274622fe30f08fccb671ab2da24085", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921086, "uuid": "d4eb4fcc-1643-4c57-a73b-70408731112b", "comment": "Malware payload", "value": "c6e23d92cf02648a67d02bece5037f4387c96bde3ff5c6eebdee7ea993a4d45d43a5e11543b502bd57719bd8ee20547c", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921086, "uuid": "bd39c7fd-5efc-4ba3-956b-edace815d1fa", "value": "T1912309128C675425527BC99D5853F80BFF18A353D22A114379BCF3882F76187E2E8DAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921086, "uuid": "3e7737bf-0ed5-44df-bfce-7b4787b76e78", "value": "768:aZb75RByZ6xc6mIx94C48bb7aICW01lfBaqyMbUTnb6w5VbAWR5u:aZb/4Z6xl9JSB1yMbUSw5VsWR5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707921086, "uuid": "3c13cfe6-7f13-43d2-99ad-ef5cab3844e0", "value": 48940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707921086, "uuid": "89d2597f-40e9-4d1f-9707-89ab9445bc56", "value": "text/x-script.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921086, "uuid": "6e61aa45-2feb-43ef-9c7d-084790d463d4", "value": "Simos-Modmenu.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ad6df1-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707947439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947439, "uuid": "66989c51-948d-47b2-ac85-455d25a014ab", "comment": "Malware payload (RemcosRAT)", "value": "e91267c0eb0905fdfc71e6c2690d5193", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947439, "uuid": "2ac047e7-c56e-456e-9210-ed37ae5baf3a", "comment": "Malware payload (RemcosRAT)", "value": "9ca104a4d297fa10fc88ef3400b3764834b4142552b0d7d8c9130b8484fd7849", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947439, "uuid": "1c41566c-a699-48f5-b6e4-72ccc1c5ab36", "comment": "Malware payload (RemcosRAT)", "value": "2f51e0fa1b72cf404aeee26bb78e73ff7f0623bb", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947439, "uuid": "d8d8d5ae-86bb-406a-97a5-00e66fac8fa5", "comment": "Malware payload (RemcosRAT)", "value": "6e322eb5c063deb14f7294fbe34aa9e21bc9e9c16993fdb85591691b83975c7549e17bbbb07cfa0d1965ed97a6c8d0a8", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947439, "uuid": "3706494d-a95e-4daa-894c-7d2546c323e1", "value": "T1FE55BF7A69711CBDE02F313D4C2BA66C3929BD71BEC86C021AB55A9E4F78141370D39E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947439, "uuid": "55752fc8-f298-4f43-beeb-b2d488b22f30", "value": "24576:NDhYhDuIPT2ldxxUmup3FjetpGgDhGX1r6GnHNswsMZUuiPZ6b5W:ND/p1hQ1r1tswsuWZ6b5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947439, "uuid": "261f1b9e-4191-4488-b7bf-e03c00c86242", "value": 1392640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947439, "uuid": "02f40cc8-bb3e-4ec3-830b-d2979cc6a0b5", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947439, "uuid": "766bc270-e88c-4a72-8320-525f93fc2e76", "value": "Proforma Invoice P002821.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a08b973-cb1d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707903607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903607, "uuid": "3949f998-75a3-4c45-a97f-da4e57c1fa01", "comment": "Malware payload (RiseProStealer)", "value": "04dc62d6b03455da50065b063ac302cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903607, "uuid": "b2c0e509-5cc3-4b10-a4e7-10679dbf110d", "comment": "Malware payload (RiseProStealer)", "value": "9d06a37de434378a4fee4162ff4fff0df03aef0ba732788ad6966dd1d4090ae6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903607, "uuid": "55f5f315-5b0a-4ada-a84d-ee9b512155a3", "comment": "Malware payload (RiseProStealer)", "value": "9651c2bc9ce0b894558ed916a9f08b354011d1d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903607, "uuid": "46d6ed94-33fa-404b-8bde-9e7dd00f6d5f", "comment": "Malware payload (RiseProStealer)", "value": "edf5cf8dc38d64926535b6feb88c0a21c2fabbe833633d0d19b568c7002abcbf037bac38ff31ae75af1291c05bb4198a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903607, "uuid": "767c54a2-358b-4678-8a70-6de6e3479723", "value": "T142E533CAAE054967DAC42F3104C1FBA901E7DC917A5464DF6CC8BFABF9369091627C2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903607, "uuid": "0075aaa0-3510-4ac6-b6e0-b8641e2af621", "value": "59aeb10eab81e92b5597d86d6e338bce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903607, "uuid": "97af7b2a-27ba-4b3f-87d4-42753deb4dcb", "value": "49152:c5h1bP28QCimsTBoL47pPuYrmNGOU0PE5gGOTQuGqDsp6GUB:c5DohTh7yNGSJvQge6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707903607, "uuid": "6ed466bc-ef3c-49be-81b2-aec5c5b65714", "value": 3067392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707903607, "uuid": "f2b02c4e-6dfc-4708-a40c-5812f8378e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903607, "uuid": "ed36fd7e-8128-4a95-8b25-9568f26e6483", "value": "SecuriteInfo.com.Win32.TrojanX-gen.1905.22029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589c9edb-cb0f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707897726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707897726, "uuid": "bac8db7d-12cc-47d4-aab5-47613e33035a", "comment": "Malware payload (Formbook)", "value": "45e0301a621992eafae4acfeb591b762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707897726, "uuid": "59bc880a-cb76-434e-b4bd-37cab57fe2b1", "comment": "Malware payload (Formbook)", "value": "9d89a5e2d91ba21398e5435288bfd1560c4dcfd109afb1ff7ebcae272cc04d87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707897726, "uuid": "19e03a0d-90ab-483f-80fc-c978752b2b27", "comment": "Malware payload (Formbook)", "value": "831225313514afc279745183e420f6aa250ba545", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707897726, "uuid": "c6460d58-3ac8-48f5-aa88-7f44932fdfe2", "comment": "Malware payload (Formbook)", "value": "7f20e84e939f6dce4f1178ad9cb44ead7f6230221fab8e2b69cf5a0994bdf887401b375b9d6d4311d822279883a34fd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707897726, "uuid": "df8c3358-730d-4e34-88a2-2499743d094e", "value": "T1FE233901B3E84732F9FF1F7768B691000231F76A7813E64E15D856958DB3B508AE37AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707897726, "uuid": "70848422-c684-40d0-834a-beb26dd06737", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707897726, "uuid": "5305a07d-eb44-4f07-8b59-dea2d688542a", "value": "768:ZCjgC6uAbcBBs/gyGZkuh8DV5rVWupVkpqkeZsLbVvkid/:ZCjgwAbN/gpZthI4Kkpq5AVvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707897726, "uuid": "dc9ce678-9f4c-4fa2-901a-11c3c2567142", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707897726, "uuid": "922258ea-0b91-4142-99ea-c43ea70b737d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707897726, "uuid": "cc12fc64-733b-4566-8468-2752465ff3f6", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b6bc04-cb43-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707919918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919918, "uuid": "0a69200d-1c24-4078-a8ee-0f0eb11487f8", "comment": "Malware payload", "value": "4aaff5899224b70497afbbca21ae3722", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919918, "uuid": "15e78f46-19e6-44de-b1b1-ba847213e089", "comment": "Malware payload", "value": "9dc63016a5bf29908a36136aff87ee64a6df502b7c9bf09792364224de1784e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919918, "uuid": "c6f61114-44f5-47c7-8b4d-8012df1db529", "comment": "Malware payload", "value": "37b44dcff5ed922bc4ba15f1fcd7efadc99a0010", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919918, "uuid": "5434ddb4-cbb6-4473-8872-d4002086055a", "comment": "Malware payload", "value": "83b3a512713e3103552e096625d41d35d326587c65edb92813bf1a486cf8fbf8759e0691d184d9bc5957cb7deb9e5f2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919918, "uuid": "7408d81f-2909-4f8a-ac29-6355c527cd75", "value": "T1D5853D06E621F82EE893C0B07528E66F65187D725290DE1BB7815F1A35712E3B8F4B1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919918, "uuid": "8abc19d9-30d6-412e-af06-fdce533f44b7", "value": "ffe94bd1ee51f5d603cfffc345a71b08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919918, "uuid": "9669d5ef-883a-479b-9e5d-34598358bde9", "value": "49152:sQ/DgVSOCY2YCgvddNVgRqjGoxTD6xjuGrWcLHhwdl+7eAfOp11z:ROCY2YCgvddNVgRqjGoxTD6xjuGrWcLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707919918, "uuid": "d67bdc0a-bf2a-4622-9550-261ba55145b1", "value": 1740800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707919918, "uuid": "0742a233-7446-4a33-92b3-e694f77cf4d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919918, "uuid": "7da4aecb-0c8a-4554-ab77-c2d1c665f206", "value": "z1Autec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764067a5-cb45-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1707920969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920969, "uuid": "f97c7f22-951c-406a-b11e-0ef978c0bbc7", "comment": "Malware payload (Pikabot)", "value": "56aaaff21d1c3fdeeaac1abdc11852ca", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920969, "uuid": "5798e834-1611-4c80-8611-1ef94f98be8a", "comment": "Malware payload (Pikabot)", "value": "9e22ec6b12cda4c1de28a8b8b074a05c56ffaaa120b3f2bb841b32492cfb6d0a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920969, "uuid": "1f711be6-74eb-4f16-845e-a2473cfb1068", "comment": "Malware payload (Pikabot)", "value": "8d5a688f27ddbdedcf3b32109938b93873877c95", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920969, "uuid": "13eb7a25-4ad8-4856-9c7e-2972741ed808", "comment": "Malware payload (Pikabot)", "value": "5cd2f0531d6db4c8c70ddc48a8ed092b5dd572eff2485aa23d32ffaaef3b0264666ced755b5fba11223bc032a1bfce8c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920969, "uuid": "765f6ee4-50dc-49ec-abb2-f0ffb9771da5", "value": "T1BA742340DA6F8290CEAEE771645A282D484969F2C2E27B0779937C5BC13DCF146C5E37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920969, "uuid": "675d1bee-b1c1-4a25-b751-638e78292989", "value": "6144:6mHkhZRMqYn4qfVev93QG4B9XQdKuPKwdWBsw3eO8RQrFXg3iWA5iHDXMItg:66kbRMJ4qfA93BdTk3OeFXg3iDWgItg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707920969, "uuid": "cd0ab190-9fb4-4a33-85d8-d40612c0cca3", "value": 369521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707920969, "uuid": "d180ae64-ff56-4fa7-95a1-d01439438daa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920969, "uuid": "8e180d75-6e37-4233-a9b2-694371b834ff", "value": "DOLORUMR.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08b9c92c-cb43-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707919926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919926, "uuid": "2dc71a47-fa8f-4458-8030-bd41d90cf658", "comment": "Malware payload (AgentTesla)", "value": "96aa0904239b06b6d2607ad4040e0381", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919926, "uuid": "aa0160f2-10f5-4be0-9c70-77a1060a39f6", "comment": "Malware payload (AgentTesla)", "value": "a06ee0f172ed12289f69c8790929be3de2c2fe8368dee7278c14c7c082d6be4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919926, "uuid": "98f9c8fe-72c2-4ee9-bf8c-66b6dad47f2b", "comment": "Malware payload (AgentTesla)", "value": "1b0f6592a7e8a4befe2ae9e4a5071251e4a05b7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919926, "uuid": "a37b43ae-7e3a-434a-a8f4-d5b841791a46", "comment": "Malware payload (AgentTesla)", "value": "93f32d65a3488f9cfe096d4e1522da151e148b31c4a0ce1251c78f131742860bea0b1ab1b72e19abb76ea2c798796121", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919926, "uuid": "76d5a748-793d-4e8c-b711-25364a722c0f", "value": "T199D423A62FE89F3BCF39877BA094621483B718A7B8E5F3DC5D4170D614E1B69D980813", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919926, "uuid": "7eb2fdd5-4675-4c26-bd33-09aafd415828", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919926, "uuid": "8f80ed7e-354f-43af-813a-090e4311494b", "value": "12288:larcMBrActqc6eI5HiIrQx3p/5Dtegv7tGByb5uDLWgyeTGlt4zN:l2Bccj6x5iI43pFYQw8boDKgyeTGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707919926, "uuid": "af21134f-8360-4990-8b2e-a48a8123e637", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707919926, "uuid": "5e52b641-b998-4436-80fe-70bf2b25500f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919926, "uuid": "b3a36083-4ffd-4c5c-92c9-d29e52b6b69f", "value": "z3125934-FLOWSERVE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e74df614-cb53-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1707927171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707927171, "uuid": "b5335685-b736-4143-a45d-c0a40b8c8de3", "comment": "Malware payload (zgRAT)", "value": "b185278aca85cd10746cc04092914e45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707927171, "uuid": "88eeb9bb-871d-42d5-bde1-f10279c0d96a", "comment": "Malware payload (zgRAT)", "value": "a0bf5798773651e218f1e86a196c1c497d39b3f4fde9c8f9e680c09154331aeb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707927171, "uuid": "686e19f7-3722-47bb-bc1e-e3fc14b47863", "comment": "Malware payload (zgRAT)", "value": "b88193457e8102c7c0ee3d48b30c75ab08a89f34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707927171, "uuid": "e812f594-7e69-4389-9c71-968eb545bcc0", "comment": "Malware payload (zgRAT)", "value": "0d13769088b99af3e40326d5a08325dbf3a5e0eebf3a47bcfafc25a14cd8e47375d13f16b3897d8b938247b93a916915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707927171, "uuid": "158c8de7-98ab-4aec-8bf7-e358235c84dc", "value": "T1BC36BF93BA549E12C64A6633D2F2202053B6D5C2A76AF30B3DC633E91DC23EE5CDD549", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707927171, "uuid": "bcc9cc21-3d21-49e2-a282-4de216020bea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707927171, "uuid": "82c4acf0-fae8-4c97-9151-4b49c4f08fe9", "value": "49152:sIEepEl/azGt4gr4lpS28/OThw+E3iltjbNCjlEkfy2wxnf+Y8mxBRmQcuWuQAgf:s3ascw+E3+MEJLFxuQdQADP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707927171, "uuid": "416f42a0-c04d-4b3c-9ba2-60e67f37af15", "value": 5140640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707927171, "uuid": "4b382a0d-9564-42f0-9013-c79286bbc3ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707927171, "uuid": "dc91f8e1-50be-4fda-b1ad-a39fd0172ced", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113cd08c-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707947428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947428, "uuid": "eb1411a3-428c-4f77-8f08-78fb7ba8f306", "comment": "Malware payload (AgentTesla)", "value": "05db291a8c9db4bdbf8add96a9312c10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947428, "uuid": "a64f9821-758f-4ece-ad74-ccc3ace09b85", "comment": "Malware payload (AgentTesla)", "value": "a0e93c294f55b8a95583599573bf57de8438ba0465d6973bb789dbab2e9270ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947428, "uuid": "d83ca7ac-b3d7-4385-a847-df10b77ead1c", "comment": "Malware payload (AgentTesla)", "value": "d3af50b2d501c60b80735f3bee5adc48874b91dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947428, "uuid": "00fda3ed-fc7c-4c56-b41f-e3b35d9781ac", "comment": "Malware payload (AgentTesla)", "value": "857863ba5fe4ec8eb43c2fe30b9a6fe6652e68d57d3f78f885d421cd8c4d8dfbb24d1959ed0dc6e10b729df6bacd8a37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947428, "uuid": "3efe7668-751e-44a6-ade9-f0f7ec01a269", "value": "T1C2D4230B550D29F1A950B986805837B033A3AF9F22D7F9A229D5F82FD16B1B1E5CC335", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947428, "uuid": "5c99c1d3-b98d-4467-a558-55f7fad2d208", "value": "12288:Yb5IzF8uSeL/LqcQUaWFqtgxhlOAzq42JoYWY7rKyL9XaxV/ATYWUvZ:Np8uSMucHaWNtXMW8n2hATP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947428, "uuid": "9f835319-3d26-4fe4-9434-f1fec2602e6c", "value": 653170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947428, "uuid": "64a25a2c-a9d3-4cfe-8930-bff02247fa36", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947428, "uuid": "5439ce0d-9830-484f-a453-651f46e53b03", "value": "dekont_html.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528e169f-cafe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1707890415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890415, "uuid": "c8fa060b-9ac9-40a8-af34-8d9fdaf43756", "comment": "Malware payload (DCRat)", "value": "e5da04f464d0064dd9f2c350c1aa6005", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890415, "uuid": "6e40450f-53e2-4e19-b2f9-1eec0d662d46", "comment": "Malware payload (DCRat)", "value": "a1005cbaca03a4045fc23076acb503cdf728650c668317fe2ea880fd3dc2e26a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890415, "uuid": "39d4561a-e6c3-4131-bc9b-25fdb30474b2", "comment": "Malware payload (DCRat)", "value": "2a3885200ce58c984d9b59517c11b5e447b4843d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890415, "uuid": "e99ff685-e9fe-4fdf-8638-1208b6a0a734", "comment": "Malware payload (DCRat)", "value": "0872372da80bec81fa4e10972e64859a36f2f869ca584f69ea59e2f1a9c9b3f084b5f7f57ab4629f6bcbaad4cf3af439", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890415, "uuid": "c5fc6305-3fda-433c-b66f-54c34dba9dbc", "value": "T1EEF533837AD1E972D8B2287B5A703610993E39312B56CDEFA3C15D6D9A217C0CA317F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890415, "uuid": "390c0fab-d56f-43f2-ad36-a976dc1e61d6", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890415, "uuid": "33e99b2d-a34e-44c3-8486-315079aa2ad9", "value": "98304:kTWWdNuJMDJG2fS7mQJe+2Mk0lPkqdGaJhUF:kJdNDtGcLQM+9jJhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707890415, "uuid": "79b236be-d0d8-471e-ac67-22899fe6465b", "value": 3589885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707890415, "uuid": "fe09fd0d-4cc5-405d-b430-68dc44370923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890415, "uuid": "c400569f-630f-41ed-be12-09b9ea251f44", "value": "e5da04f464d0064dd9f2c350c1aa6005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf65832-cb33-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707913330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913330, "uuid": "4cfe90f7-ef9f-45c1-aee7-f7c74325053a", "comment": "Malware payload (RemcosRAT)", "value": "56de3f4de890ed5d08ee23d162ccb5b3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913330, "uuid": "817bc734-1e40-4feb-9ea8-e430b35842dd", "comment": "Malware payload (RemcosRAT)", "value": "a12adcef2a153e0926843befaad18c7378d8d1b698400c51a69b229f99979d54", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913330, "uuid": "06fbc1e2-42a2-4c5c-8b45-4792394b5e5d", "comment": "Malware payload (RemcosRAT)", "value": "f945339ba02aef28ac7fcedf922081fe5507b397", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913330, "uuid": "ffe8b999-9efe-4b3a-9866-c5e80609675c", "comment": "Malware payload (RemcosRAT)", "value": "172c517e97d1856ee4225c98ae6ff4310d4630ade321555e0d9787ac73a301ee72d19deaf383cce718e844577e147fc9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913330, "uuid": "304fd458-2b2a-4e89-8cfd-8db298b607ad", "value": "T1CA3522256AC08476E27327301EE1F6B1D5BDBA410761C2CB2B5C251A6FB17D6B32C39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913330, "uuid": "1cfb03df-5594-4357-8920-46952300534f", "value": "36603b42a93421cfa64e8207b9ee7696", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913330, "uuid": "0b2a53a8-24bc-43bc-87c6-74d65e37f05f", "value": "24576:lzCmT/4sKowJXrP+garXNKZQCawrKdIQZgMCNBypVD1yX36G7fbZcK:lzbT/dw7kXaawrMIQZgMC/yv1S36G7Ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707913330, "uuid": "c12a3a00-f6b8-4fd6-8cfc-53a173698777", "value": 1125590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707913330, "uuid": "b9bc99cd-8e78-4ec9-aa45-f697dbf24aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913330, "uuid": "ca5f2f0d-734d-4a22-9678-22897356f9bb", "value": "5_MedicationRoy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a51c77f-cb12-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707898937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898937, "uuid": "66350501-1ee6-43cd-bf8c-1810211f076e", "comment": "Malware payload (Mirai)", "value": "a5d66c117a66fe86e146c1ec3022a091", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898937, "uuid": "85f39915-b7d0-442d-817e-50108425e042", "comment": "Malware payload (Mirai)", "value": "a14b2f7634316eaa99dc1a443e67c484a7fee497dac6bd6d47377e232235c393", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898937, "uuid": "db0967c5-d7cd-4cc3-bbdd-25291443e7ff", "comment": "Malware payload (Mirai)", "value": "96a7683d920e713f37f2f31ecb7e1d84d1c6c603", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898937, "uuid": "6191dc7f-a95a-433d-a282-701b7ba5c902", "comment": "Malware payload (Mirai)", "value": "1fd2045e86cdf6134527c14abbe90d38989b5e1649be5cdd90ece3b63457c763043a6361d38b04ac296c537db1d6de98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898937, "uuid": "57f26a54-fea7-49dc-ac89-f9b5fc136664", "value": "T1B36339C0A593ECF4DD1607B43077EB374A77F136512AE9C7D3A8A923BC82A41950B29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898937, "uuid": "640d89cc-fc32-4c34-903f-3c9ac7ff8a37", "value": "1536:h4uwwSB8qv117K/Mn9O/Eb/vRkWNZLF/EfNatGSk3Ja86t3zzcS5KfXQE:hBxEV3Db/vRkWNZLF/EVatGS8aBlcSQA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707898937, "uuid": "006c0fde-54fb-473e-813c-74e082e48fdf", "value": 70672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707898937, "uuid": "b32e7069-c6c4-4314-a863-c5e0a198ee9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898937, "uuid": "0eb2933f-4304-448d-aca6-c8028af8706b", "value": "a5d66c117a66fe86e146c1ec3022a091", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7256d40c-cb2b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707909795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707909795, "uuid": "8a58166f-bbae-49d7-8a61-5f101df50531", "comment": "Malware payload (RiseProStealer)", "value": "fff5667ff795476ba4349568bca1e9ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707909795, "uuid": "356b8ef3-501f-4dc6-85d0-46436258bc01", "comment": "Malware payload (RiseProStealer)", "value": "a155d022a79c1de510108b2d58984f70678a80c665709538bb64b3411791b2d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707909795, "uuid": "f74858e0-21d7-408d-aa42-43b56b433cc1", "comment": "Malware payload (RiseProStealer)", "value": "456105435a9e94042929aea5209784a0a95d8327", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707909795, "uuid": "2a77dd4b-93ad-4aba-9552-4dfa8b0f494d", "comment": "Malware payload (RiseProStealer)", "value": "d00439d7ba37788a9d86c70cb014a327f56aa17b9a81a849a10c93d731066ba1d16c64e4dded9506b11c5e640a1065c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707909795, "uuid": "e7712d1a-d84d-404c-8514-6621483df999", "value": "T1ACE523EBBE61918BD26072344CC2EBB850AFEC55B91064DD8CC9BFA3F932D0D1817A55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707909795, "uuid": "66f1afe0-11f2-4ec7-b42d-89e78dc094a8", "value": "59aeb10eab81e92b5597d86d6e338bce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707909795, "uuid": "6e7f1285-4738-4a30-88bd-6ce097ab25d2", "value": "49152:b38ElXcJLFGi+0fPp+8m95rRgE4VGk0N9Jq/amHdDABx1aErDKbS:b38EF8pnpy5r6E4nqWCf1aErDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707909795, "uuid": "10b7620b-d35c-4f82-98d4-73334f7c808e", "value": 3084800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707909795, "uuid": "25acea4f-216f-4867-9176-5c7d9e7ac33d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707909795, "uuid": "50d9c381-9eb9-489b-8ca6-be92b794144f", "value": "SecuriteInfo.com.Win32.TrojanX-gen.29663.14829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09158c2d-cb12-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707898881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898881, "uuid": "a598ecb9-b329-43cd-9efb-6f8d608c95b4", "comment": "Malware payload (Mirai)", "value": "b83b2b8a7c57e9e9cb0ac1ca3c71bc75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898881, "uuid": "e9c70233-3f1c-486d-8dab-5ad6bd4b847e", "comment": "Malware payload (Mirai)", "value": "a1d65989576c116d4eb81f19131c9d5df64f6ece93dc82164fda499f1cf3d644", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898881, "uuid": "e5c99558-55b7-495d-9489-8ca70003a5e1", "comment": "Malware payload (Mirai)", "value": "beeb3c4f19fbe31cef7f6b3977e089fcf18c9be3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898881, "uuid": "482c8666-24e2-4d8a-8ead-985a0ce1eb32", "comment": "Malware payload (Mirai)", "value": "18d49d92a0bd526ae3f80e625922b320eabb137e72dca7c4bd64330e1a4b792d943a6f1b09cd42810ee63e191ab1107f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898881, "uuid": "8fa4d072-d481-4d23-9baa-178c376deff5", "value": "T14193E896B8C28E15C5D423BBF92E00CD331667A8E2DF72129D106F2477CA92F0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898881, "uuid": "b879d5b5-fc18-43ef-a6be-6e1df3bdcf5b", "value": "1536:lwNn21vn1P0YAvT7C+P7V2o6Ahb0rkHP8UWj6XLw6M1HxCwU85u//5CFYcpIziIy:lFP1sYu7JPZ2oP0r+0UWj6bXMFHHq5Cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707898881, "uuid": "7ecf79c6-efb5-4ea5-9d8e-ff15039f065c", "value": 91440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707898881, "uuid": "6dd44871-4249-424f-9d60-65f449ed4b60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898881, "uuid": "f3f2b4c4-0d09-4953-b048-707b68cb94ef", "value": "b83b2b8a7c57e9e9cb0ac1ca3c71bc75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9304fd02-cb19-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707902119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707902119, "uuid": "bcd708ae-8c66-45b3-84b1-634fb2aaf402", "comment": "Malware payload", "value": "5ec11b7e4a764cc46bcac75db14a8940", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707902119, "uuid": "dc4e4645-40b5-43a9-96d7-2987e50acc13", "comment": "Malware payload", "value": "a24f7169f7f6f4f470fc21f8789efeaf96edb581479db9e8dea2e3130fbc559f", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707902119, "uuid": "07cf870d-245a-492d-9097-ee7e6fbe7a00", "comment": "Malware payload", "value": "8e75c857a39a6b4dbd5ae1191e21db5de3d340cb", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707902119, "uuid": "2315d62a-e271-4f48-9bd2-c8a79ac6d04f", "comment": "Malware payload", "value": "c1ed17038e76a6a1de34f547125ff2fe0e3ee3b83e785a765627f3949dc483fb167dc2424f6a2ff68459551957d0b55f", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707902119, "uuid": "ba9fcda8-7498-478d-9b47-8d5350286f57", "value": "T196D28607F2D6CE16C12990709B568385216BBE109F79C68BB55F7B2E3BB72F06A0074D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707902119, "uuid": "cdb4d97f-5cf5-422e-b7f4-b5b1dcc8019f", "value": "192:cISuN7b2bRk4qT/YACVL3ee6/6rvhmjZuR+XG4f3vg3BJdnblQ3TakTUTN:ZxitkT7Cd3eeiSvhmLXG4ffg3bd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707902119, "uuid": "ccd49abc-21a8-488f-92fb-2a3f3a74114b", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707902119, "uuid": "55eba5b9-e2c3-4877-85a2-c686f38d0eb1", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707902119, "uuid": "7224a99c-2256-47e9-9615-21035f1844e5", "value": "5ec11b7e4a764cc46bcac75db14a8940.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d50e3f-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707947437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947437, "uuid": "f8244fca-3bea-4be7-bd53-aa36f5efe6a2", "comment": "Malware payload (RemcosRAT)", "value": "2f1e0734a563b7dc3c8f923c409f1b08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947437, "uuid": "3ed759f3-eb23-40d9-8e69-b1510751bc15", "comment": "Malware payload (RemcosRAT)", "value": "a2ef2840d2cb8314c387373d91cd579a556a338b852ed4c2ee0502c7f387c26a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947437, "uuid": "cd833bbc-550f-4e40-b4ad-8c24e228dcf6", "comment": "Malware payload (RemcosRAT)", "value": "0026f5fc8c09f4403cec8534d53535cbd0913b75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947437, "uuid": "f0751d8d-8bff-43e5-865a-428fdf7fcb22", "comment": "Malware payload (RemcosRAT)", "value": "cf695bd7f5fe960ba7ed9c1ee8fd327ac8f1d0735ed80fe9ebfa130cb133266ff5d08310e3a1e0e14a0ce53ddd58367d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947437, "uuid": "56ff0ada-211e-43fd-875a-b858cdf398a5", "value": "T18655BF7A69711CBDE02F313D4C2BA66C3929BD71BEC86C021AB55A9E4F78141370D39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947437, "uuid": "63d4d2b8-0861-4da6-8f25-0e30146f395d", "value": "1a06dbac007de7746c351c3ce81e4d83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947437, "uuid": "8433784c-0f12-4328-b67c-171bfdf5fb2e", "value": "24576:ZDhYhDuIPT2ldxxUmup3FjetpGgDhGX1r6GnHNswsMZUuiPZ6b5W:ZD/p1hQ1r1tswsuWZ6b5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947437, "uuid": "6539aa8c-4839-4f00-be94-e818db8d3387", "value": 1390080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947437, "uuid": "dbf87832-d5be-4827-964c-f6afe3e580ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947437, "uuid": "fc32c336-5599-4664-8cc8-dec23ff40b86", "value": "Proforma Invoice P002821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb7151c-cb51-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707926268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707926268, "uuid": "7a8a4316-45c8-4323-a6dc-439e00d2d4be", "comment": "Malware payload", "value": "2e5c10224f9973ff0695bc76d57aa3dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707926268, "uuid": "8eb71484-dd56-4605-a740-bd7e7b092fab", "comment": "Malware payload", "value": "a32254cc825e4fd2bcc3c2dae2ca7fd17e50f387f96d23d019d9a7ae8f3372ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707926268, "uuid": "95e71efb-fb80-4260-883d-e9201d8b1894", "comment": "Malware payload", "value": "52704f7057cf93790ea344506011625dc435d063", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707926268, "uuid": "e3460fc1-b519-48c7-b4a0-2d1382e1e17f", "comment": "Malware payload", "value": "abc6de90f9ed715a13a81da3115a785b65736443e1bb469dad569abb13185fb420cef238932d0a63a0aca6508f3a9820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707926268, "uuid": "ff6a8d62-2540-40dc-9b49-6bfbc28f1267", "value": "T1DE08336716457029F4693BF53E3DA9AEE628C5413B81A4F3BC8652CB8C418E7E81C47F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707926268, "uuid": "e16edcb6-7a46-4bee-b08a-39610658645c", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707926268, "uuid": "ce1ca662-1f57-477a-9ffb-7fe4834e5954", "value": "1572864:ur6LBY8Oku1U8jp+2YQcxZHBFdNYZvpXm6IKEnvw:uyuLkp8NRkzFC3IKEv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707926268, "uuid": "d2071e4e-d3f9-4fab-aa49-c99b3bd3a1fe", "value": 82571826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707926268, "uuid": "90626f74-c009-4ebe-9891-8a0a9274be01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707926268, "uuid": "462ef3f0-c61a-4f8c-8f67-1349760d4fd7", "value": "Planets Therapy Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc79f074-cb38-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707915503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915503, "uuid": "82c6bc32-9d3d-4dc5-b051-6fbe2fd8dc79", "comment": "Malware payload", "value": "995e31b03b0c0c6164bb486d39346833", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915503, "uuid": "3f7ee28c-58bb-4c91-809a-8330e465322f", "comment": "Malware payload", "value": "a3456c4ba41324f91608a8413501f399d6aad6cc6613f8c952526ff30f515709", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915503, "uuid": "e3d9625c-4d30-4d0b-b8e5-4985ae3114be", "comment": "Malware payload", "value": "29d0266bb24f01d1708d0d3a366675185f1edfef", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915503, "uuid": "5b2052b4-2737-4933-9617-ba0d385781e2", "comment": "Malware payload", "value": "e03c2eb33918dbe2334b3143a67483463e63fd3e02e42b235cd80ab617751523eec3cb2a46434620449e109f1edf0e37", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915503, "uuid": "92054807-1355-43c9-89b0-b1c71961c244", "value": "T15F952229F6839A6BE32AE0B58AD7815D93447C02AE451C07375DB3DF387BE62678350C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915503, "uuid": "d0a89e12-5911-42a7-8cc1-23b8dd14b95d", "value": "49152:mptLT0zuDcYlhkDfZZW0op+hRDeJIpbmRXG6LF:wtLT0aDllW1Bu+hcJmGGkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915503, "uuid": "ab26224b-1d61-4d77-9499-1be20f8c95e1", "value": 2046976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915503, "uuid": "be78a813-f349-430a-97c5-6cee866dd8a3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915503, "uuid": "f522674e-3f63-4bd5-9dea-9cdfc615402d", "value": "MP REDDEMMA.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1951f2d3-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707947442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947442, "uuid": "18cf5412-845a-422a-803d-f82336242d34", "comment": "Malware payload", "value": "3f9ea1793cfa28f2f04e58473619c524", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947442, "uuid": "c628915e-a0ab-498e-a7aa-2aa9446a454a", "comment": "Malware payload", "value": "a3aab6edcf2be04ab937de092f6505433c49bbc7ba6699da036a196013d4d557", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947442, "uuid": "727837ad-ae66-4d74-9afb-3962ca95bb1d", "comment": "Malware payload", "value": "ae2921b1d870b09436f53628875c2ddb0a776e03", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947442, "uuid": "21fabf86-424a-43d6-8f56-4e701d87d406", "comment": "Malware payload", "value": "74e316e71072c0494879cadfb3e263199aad656106ffeb02c823298e08f23cf17e6be03bc47e98314a2ce21df0af6586", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947442, "uuid": "74b2c071-99cb-48ec-b3ab-e663b0e1af40", "value": "T1E7452900B3E84332F9EF1F7768B652445374F6A63513D64E369C12944FB37908AE26AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947442, "uuid": "5b82148c-666e-4895-b8c1-5ee5d8166d06", "value": "768:gvAD6uYEEBB4/gyIkGXopA8hb9zzSXhtvfawZsLbVfkidU:gvANYEh/grkDA73HtAVfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947442, "uuid": "39133f9e-fe49-4011-9370-35312e9bf3ce", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947442, "uuid": "1fa65991-39f9-4cf2-a183-00e7aa1229ed", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947442, "uuid": "eae4403c-1851-4d49-bba0-87ed8c397a85", "value": "Purchase Order_1.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be7b4ea-cb3f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707918455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918455, "uuid": "71960466-7ef4-4764-a1bd-2b29b06d6cc9", "comment": "Malware payload (AgentTesla)", "value": "da5719cd690f52bd6ac6326605b0fccc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918455, "uuid": "673a4f33-583c-4542-a72c-2aa217b7769a", "comment": "Malware payload (AgentTesla)", "value": "a44cc5b971dcc6bb80c84e850b2529ef6f3e78cc24ce574ae3d2daacc8b9ea51", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918455, "uuid": "e6751922-dc48-451d-ba96-e9cc404d1db8", "comment": "Malware payload (AgentTesla)", "value": "32a887dd95ee47ceb60710060416992859db380b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918455, "uuid": "a825bd60-68c3-48d6-9c8c-913042b1f5ac", "comment": "Malware payload (AgentTesla)", "value": "c0be7503f2b97cd4c60633bf04dc9e4908e9b44bc39bb0c7750b27b665eaebabac7bb2a46190a286b2e755d64f65305a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918455, "uuid": "22ce621f-76df-491f-972f-ec5df5e41cca", "value": "T1C1E423A262B4473BC56E03FAC4F4158247F222A43844CB47AFD224DD647778AC656FBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918455, "uuid": "dc77a08c-7aa8-4506-9af9-fc940a8ae5a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918455, "uuid": "6befc87d-40c6-41ce-85fb-b3e49547ea66", "value": "12288:Wc/xeQ5vziw7D7yPIn7AqBmgIFqA6Uh7hOpzhHEgn0g3IUp004xWE:briID7ydq8gmqTIhOpFT0qbCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707918455, "uuid": "df7cc5a2-7b3b-4461-9bdf-ebcd47f91b94", "value": 678400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707918455, "uuid": "652e0a1a-93e9-4603-a15e-c1f5646eb13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918455, "uuid": "d228d4ef-0173-4611-a35e-aef6d9449cbf", "value": "rFiyatteklifiIs.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0bb985-cb42-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707919772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919772, "uuid": "c62d18a2-2ff3-4675-9071-ce82a55e422b", "comment": "Malware payload (AgentTesla)", "value": "6545c776acd79c87487ccf65e2708693", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919772, "uuid": "ee4c5955-6eac-47fc-a775-d0122f37ccaf", "comment": "Malware payload (AgentTesla)", "value": "a471005428df2b40174de80a9d27db29284fb99c8a6a0b167d3e441f8357ea65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919772, "uuid": "155b3d86-009b-4f79-8925-8b1f53170875", "comment": "Malware payload (AgentTesla)", "value": "d9fe7f08451156c67b84fbedaa51e2fbc06c3eb3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919772, "uuid": "286f5cfb-7915-4b45-be36-002d1e724393", "comment": "Malware payload (AgentTesla)", "value": "d90e83a1f66aea3476e751ffa36a6a5471cb6e696596eb83e1e4051bbd0042f67a09cbe1a51118f868ae1a9f8e207981", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919772, "uuid": "b2d43d5e-240a-4963-b573-58dfb376be2f", "value": "T18FE4239178B803A7FE4D87F8A13168C603B9D3A5F291FB5EBDC1A0C21E96B719150787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919772, "uuid": "2543aab7-0f85-4066-8a41-41b7e54500b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919772, "uuid": "a8fc4e53-6ec6-4f74-bb23-9fd422e0c317", "value": "12288:oiD24Clua7GokTDM8dJ6oVx23+NCi8arWT6JZlym7E/3dK35UU:jmuP3M8dJDzK+NR8aCTYe/tKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707919772, "uuid": "99eaabe2-cf9a-413c-9740-e4237f281422", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707919772, "uuid": "36aa4151-2ef3-47d3-87ed-a19a9281395f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919772, "uuid": "a44c9306-6165-4935-9974-da304e5ecd5e", "value": "Quotation-PWTC-0939-2024 FABRICATION OF ALUMINUM SIGNBOARD FOR LIFTING EQUIPMENT COLOR CODES..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c5e328-cb7d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707945149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707945149, "uuid": "745771a8-872a-4f14-a7f6-dd889fa33a76", "comment": "Malware payload", "value": "3dae6ae3cb5ab9fd0a2eeb00e8b7fa23", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707945149, "uuid": "2c23d8d7-2172-4879-928c-f7b7bf5cca01", "comment": "Malware payload", "value": "a4b2b440a8786db994d20dc3c92c534df6c137a24207bdeea07de1fabe1f0fa3", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707945149, "uuid": "584b5deb-0720-4224-b479-d27a9f772386", "comment": "Malware payload", "value": "7c653e046b263201be1b636dc64dceb7d86cefe3", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707945149, "uuid": "a8c8ea1c-9b14-48b3-a582-f6bfd5459c61", "comment": "Malware payload", "value": "f24fba553693f814e4f04225045b4dcd91994af7e5cda90d425be6f44b717390d0d67e58e661702839b768f6606df601", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707945149, "uuid": "2c423e83-6975-4c47-a0ad-2da34979467b", "value": "T10343F1B5146F6C2BEA91983D0C8E03DD52147D6EC352B6DA3A68336C61C2C9603E97ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707945149, "uuid": "d519eea5-ece8-4c42-86f8-33b663a4f151", "value": "1536:mAToOEjzAw7Y2r7DUsV4XzY9t3jSagJYw8TE3JnDc:FoOAcw7nXDUsOjm3jTxY1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707945149, "uuid": "572625db-b792-417c-ac87-372eb1f4ccea", "value": 57704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707945149, "uuid": "fb624e8c-ac20-476b-8cb5-1270754eb57c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707945149, "uuid": "d07ee8a9-901f-4c8e-bce3-c54150261038", "value": "NECESSITATIBUSG.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40247f06-cb37-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707914865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914865, "uuid": "44530204-93e1-4b58-88f2-2a80ce173975", "comment": "Malware payload", "value": "40001ba041e525c7d8600715f40346e2", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914865, "uuid": "43117287-1cfc-48f5-880e-4e87e32a3205", "comment": "Malware payload", "value": "a53b6f109249b26a048496d45e78181c75b07d18a62322172497d2a5102523c4", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914865, "uuid": "e7450271-fe7f-43c6-ab68-66256f63bdc7", "comment": "Malware payload", "value": "574e7015d374932ffb5be33cd76e463b9b2e3e05", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914865, "uuid": "c0347a36-1a15-49e4-a833-d39a85c4cf13", "comment": "Malware payload", "value": "c4ec288af24429489c44a26760a1fb9714c503ce0fb9a1b0e749909ef4a1125bdb5d0ca4c9bded0720896819e23822f1", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914865, "uuid": "c1587a40-ae7e-4ce0-9557-1a3af256b843", "value": "T120C601A03CDA0026F0AF11716AA9FF79E12F6F722F3525535150BA19FD322436E14F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914865, "uuid": "8d6b1835-8941-4f61-99bf-70da2a20580c", "value": "607d0c9fedb370b1ce70573304bcd084", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914865, "uuid": "fa383499-a649-4205-a3af-901036a92052", "value": "196608:7Wx2zpdra2YbT8yN+8Mne5nd7g25FjZC8OH7RbFd/Or+GvJbU9RDf/kuFLOyomFI:7YCrdiNTF5nZ9C8Ud29JuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707914865, "uuid": "a7fd37d6-c71b-4fff-832f-f970ed51c3a6", "value": 11922432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707914865, "uuid": "a28acb08-9ca4-4c8f-b2d2-a02336d1f9e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914865, "uuid": "0f988990-be97-4532-98e0-e847391c4c36", "value": "resources(1).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513695f2-cb25-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1707907163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707907163, "uuid": "7732ccdf-18d6-4b82-9b9f-8f29a32a4777", "comment": "Malware payload (Smoke Loader)", "value": "9b65ca43d28bdea147a039143e759361", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707907163, "uuid": "ee7585dc-b32e-4c43-8b94-d46761574cd7", "comment": "Malware payload (Smoke Loader)", "value": "a5da18a9350a63a4d2ec54da2d3e49bf4277307209979bfad54538eff856bf9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707907163, "uuid": "7f5a3c68-ebfd-495e-ba66-d426c29698a7", "comment": "Malware payload (Smoke Loader)", "value": "e0b759566e97982e514be29db259b50c1970c67e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707907163, "uuid": "ace57def-12fa-4006-853e-15a99028af59", "comment": "Malware payload (Smoke Loader)", "value": "c768e526a06d788a632d959fb6ef2423b3980f9e31550923688f51f9a8d79e9250ba4c795b340804cb276a07dbdc29e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707907163, "uuid": "c1bd7622-c5ce-4b5b-8160-0ec308dcb8f1", "value": "T1C854BE1023D490B1D34311344561EBB90BEEBC25A262BA8F6FD5E67E5F38395B62730E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707907163, "uuid": "18a717a9-2c74-4fd6-b45e-e14effd1bfb4", "value": "7b013929d49f752f683cc55db1700a48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707907163, "uuid": "86079272-7eb7-436c-9a43-ae3978bb3f8c", "value": "3072:NjazK4SL7StnhPfuC0G7p7LVQ4zKjf7COAINF9Nmd1XJsxUxaIa2Vd:AzK4Gep7LVQ4zKBAIv3mDJsxUxaIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707907163, "uuid": "e072f84c-657f-4ada-b7de-eefb5935f13d", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707907163, "uuid": "6e7a43a2-a0ec-4a74-bae0-9a21d609eaa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707907163, "uuid": "55e76926-7522-497d-bc13-3c2c6750cee2", "value": "9b65ca43d28bdea147a039143e759361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb79f8c-cb3a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707916255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707916255, "uuid": "39b1fe17-b4e7-4c30-9159-fe06bd7247be", "comment": "Malware payload (AgentTesla)", "value": "ab99ac9ab9b07586d84c10eaaa80d6c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707916255, "uuid": "9d0dcff7-e1a7-413a-bcfb-0021b3a1b61d", "comment": "Malware payload (AgentTesla)", "value": "a603f947d120ab48ee654acc6714eb647d3bdce3cdf9f9018de0aafdd2e2274f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707916255, "uuid": "703680d0-e2e4-4466-9014-89c0f9e1e75f", "comment": "Malware payload (AgentTesla)", "value": "446fa1328a55b68fb81e0317f67dbb7723a3abd3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707916255, "uuid": "f2a54002-c8b3-4a6c-a332-d2fc19432f1e", "comment": "Malware payload (AgentTesla)", "value": "57e9dffa89cce7ad2152e19e67599618aa2ef0f1a38450b9ebbacb0daf25b39ff61ff3ac674e6b64f765799d59c0a48c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707916255, "uuid": "b46304b6-c082-4abc-a28d-35dd47203cbd", "value": "T1BF25C022B9D58C36C2F322B04D7EF76A573969261332D19B27F43925ED710522F29B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707916255, "uuid": "450a1d99-2941-449e-b67d-fde78815c897", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707916255, "uuid": "c89e7aba-f3f4-4d66-bddd-3b7831c3fbc4", "value": "12288:2hkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aKY/0DnmnwrkZ0X/Bss4Mc:mRmJkcoQricOIQxiZY1iaZzZiBLtM2c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707916255, "uuid": "4b45f25c-3b2e-48bb-8240-0bc9c5e87db1", "value": 979115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707916255, "uuid": "e2812ab7-26df-4fbe-8476-d95086ca9a4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707916255, "uuid": "988117d2-2101-4203-bcd6-dbeccdb0b800", "value": "ORDER_899E890399_8939939938822__________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15091b29-cb45-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707920806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920806, "uuid": "0aa4a8a1-6b70-452b-bd2a-0e2c611dd0da", "comment": "Malware payload (AgentTesla)", "value": "e08efb1b77bd8d867efd33e80e594c3b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920806, "uuid": "fb688f22-a541-4df5-b0a9-0d020306e97a", "comment": "Malware payload (AgentTesla)", "value": "a66e4f51630922d4131baab37ffb114b872b8dc5116c9821f7407edb98035803", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920806, "uuid": "3997cdb0-4277-4fc7-b4c2-b9f24c5d9297", "comment": "Malware payload (AgentTesla)", "value": "392509f5c9a07d91c5e21090d0b92805d5a48c68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920806, "uuid": "6db759af-4bd9-46b0-99f2-361c975beae8", "comment": "Malware payload (AgentTesla)", "value": "d56ecf177be157e160a498e07bf9f54c926a60983302165c0195fba8c4b987097cc31b5cc2738a92858aad2c3fad116a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920806, "uuid": "ecb260fe-6a17-484a-8470-a406b9b89998", "value": "T1E5D423952B6CDB5ACC7963B310B431254776F089E2ABFFE46D9C07CA4893B460061EF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920806, "uuid": "328a7b9c-c60e-4c60-b341-9237f2755db6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920806, "uuid": "c8062a62-29b1-4943-88d6-6dafa51b4535", "value": "12288:0mPQ1DPwBFx9vMAKsRgOuUDdzRcWhHcHWCe0tQcevo4WfvW58OzNL:AJSnufsRzDdFZ2wB6vWaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707920806, "uuid": "257bd562-14c9-4c85-91ce-ac91be85aeca", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707920806, "uuid": "346a5b3b-ba23-4e3e-b84d-e11490d3dcc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920806, "uuid": "1e2f97ee-7254-41f6-af5d-189cfd96bebc", "value": "Invoices 5611549092 - JHT0573001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea3dfe1-cb25-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707907158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707907158, "uuid": "96cb4686-fe70-49cf-a3df-e308109d74b3", "comment": "Malware payload (LummaStealer)", "value": "b711abfd1d3f342fd53e7234672e23a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707907158, "uuid": "77fee1e4-b56a-4cea-8e95-ec9bd4355e85", "comment": "Malware payload (LummaStealer)", "value": "a6bda3b1e990cdc4da5b889f8c4d5a717ac32107a22720e81c9268d0af553e9c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707907158, "uuid": "9cadb8bd-2f48-43ea-9280-67db24ca0c6c", "comment": "Malware payload (LummaStealer)", "value": "abba6fdf4ce45cfc9121bc8f93658b0875ba1f4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707907158, "uuid": "a70f9aad-8468-470b-98c4-617fc2b684f4", "comment": "Malware payload (LummaStealer)", "value": "467bcac254d65cbd6235994fb24c528208ba95269a0043d765bd80e5548b682a5808e9942981e3cb704b3840e4c23790", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707907158, "uuid": "20603b3c-3f58-4617-9c0b-2e99748a0100", "value": "T13A54AE2023D4D0B1D35302348661EBB34AEE7C1576227A4F6FD5E63E3E38695922BF19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707907158, "uuid": "5846b989-ecbd-4ecc-bf2f-7dd378fb1064", "value": "7b013929d49f752f683cc55db1700a48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707907158, "uuid": "0a35107f-19bd-4c19-a057-8ebf8f3d2910", "value": "3072:Wz6T6oy729nhffLbCWeia4bU3qrf9tExSD2w3TA4xFgIzSUxaIa2Vd:3T6o28XC7AU3gvEx/6TA4LiUxaIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707907158, "uuid": "e5bed48c-0fcc-4672-a4f9-1b9d7338278d", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707907158, "uuid": "ca9eca44-b9de-4c34-8466-b230ec205df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707907158, "uuid": "b890664d-d1b8-4ffc-8681-8016408458f4", "value": "b711abfd1d3f342fd53e7234672e23a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098a703f-cb03-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707892440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892440, "uuid": "292170be-16f2-448f-9a6a-63a9adbe2675", "comment": "Malware payload (Mirai)", "value": "5a2117f14b60f331ae4f6ddeade7c34e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892440, "uuid": "810100d5-00fb-40ea-8152-f5cfab574ae5", "comment": "Malware payload (Mirai)", "value": "a78ae929cc82a531cd28f0f2a9d33dbe59c9b0ad975baff920f8af7696f6b8ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892440, "uuid": "44a667ab-31ea-45ac-b503-bca5eb0928e6", "comment": "Malware payload (Mirai)", "value": "40bc9940e742d5d05835e3e3f400e23b374c750a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707892440, "uuid": "6dc6f8b5-f517-4715-84b3-7a61f1b5c3ca", "comment": "Malware payload (Mirai)", "value": "f8b763a51d649b887d22d1d3283c7f7dc89272aaf2be72ed5364a1f5e604d25cb00aa11620efefc86e4b69262451db11", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892440, "uuid": "5efe03b7-8f47-4ef7-af66-9831968e1d77", "value": "T12103F751BC829A67C2E1137AB6AE4A8D377163E8C2CF7217DD204B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892440, "uuid": "0c5af58f-ccd9-46f2-94fa-815903af0d27", "value": "768:mDg50gbpsG5f0OdnlUlIO5FVABwABb97HWGOv+b898qVyfoAZ/NlwWK:mD0bqG5f/lUlTvYDq9v+yoB4WK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707892440, "uuid": "889cb8de-c879-4cfa-bdaa-c025c53d2a17", "value": 40740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707892440, "uuid": "3438ea68-d7e6-44ff-844d-e6e1f112a91a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707892440, "uuid": "95f17b0e-8c60-487c-84b3-c52ce68a9894", "value": "arm5-20240214-0633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8da87d3-cb46-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RecordBreaker)", "timestamp": 1707921617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921617, "uuid": "38795c96-4499-4ffb-b90f-a0568c2e69d1", "comment": "Malware payload (RecordBreaker)", "value": "d0f3fda9bfe96872981a8de4ef913856", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921617, "uuid": "83d0d3c1-330b-42bd-805e-8c334f05892d", "comment": "Malware payload (RecordBreaker)", "value": "a7b430e703fe6d3cdebfd2924e992abf89a959fee3afe83d91a68c87f7783eef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921617, "uuid": "eb92360b-e349-4bcc-8a0e-06c72ea02209", "comment": "Malware payload (RecordBreaker)", "value": "d41a417994e15fa010cfb252d25e7ffbfe88bc39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921617, "uuid": "7dadd196-cca2-4839-a4ed-2cf8959e67c0", "comment": "Malware payload (RecordBreaker)", "value": "7ee70cf2cf75d0ac5a4bdcdb329f1f7774a524c2c05ca2b3673df1356bfc13093350df15bf8eb4e481be463f64f4b8e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921617, "uuid": "ab8e91fd-5880-474d-9ac2-4f575191b4d8", "value": "T16954AE1023D4D0B2D343123486A4E7F10BEEBC62A6627A4F7F95D67E2E383979527319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921617, "uuid": "f6f4bf03-42f7-45fc-af4f-129ca5007832", "value": "7a16202dd7202181174ee4ca5dc3433f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921617, "uuid": "e8e470c1-37a6-47ff-af6d-bc95770df008", "value": "3072:6ziRfFi3WzI2OHDbNMCicIQ1yEqkAhDexm0sCfCPvlZg2J5aLwutfUxaIa2VM:DRfFD6OCxFyEqkjxm0sCuZJJ5OUxaIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707921617, "uuid": "2185e37f-4f30-4b3d-b1d4-8bc208695632", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707921617, "uuid": "682b42e4-7eea-45b0-8dc3-9606e1af10a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921617, "uuid": "6d84186c-a293-42c8-a86c-03e1e86535be", "value": "d0f3fda9bfe96872981a8de4ef913856.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7cd6e00-cb09-11ee-b7ea-42010a9c0006", "comment": "Malware payload (WhiteSnakeStealer)", "timestamp": 1707895309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895309, "uuid": "8bad863b-6184-4ba6-b70f-ad82f6191565", "comment": "Malware payload (WhiteSnakeStealer)", "value": "1ba95614eb2142b52af7b83ac8929f56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhiteSnakeStealer", "colour": "#B8CDAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895309, "uuid": "145e15c0-1f3f-4011-a6fa-3d32aeca6bcc", "comment": "Malware payload (WhiteSnakeStealer)", "value": "a7bf2e532eca08568463c3819759c3f919aa91af51fbad72c7553d4404aa3830", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhiteSnakeStealer", "colour": "#B8CDAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895309, "uuid": "2a451065-d183-4d08-8d44-2db3c7b75bba", "comment": "Malware payload (WhiteSnakeStealer)", "value": "a74f0b20976459dcf7623637108a6b6b3c5c1e15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhiteSnakeStealer", "colour": "#B8CDAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895309, "uuid": "6dd5ed98-4198-4d58-a78e-6429c895e5a2", "comment": "Malware payload (WhiteSnakeStealer)", "value": "fc246b7008288fdbf9c66ef144614800e278c6a67adfa7a5cddd84584abf3d843e0ebd7b31213a81dbdc668b2c3ab7bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhiteSnakeStealer", "colour": "#B8CDAF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895309, "uuid": "e10a7766-4868-4f34-abdf-b09cc85343d9", "value": "T10F34CF4263E540F6E8BA53B199F347435A32BC909B3987EF2394D48E0E33AD1A536717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895309, "uuid": "4534e227-5dc3-47ce-b4e7-ab3b277dc1a3", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895309, "uuid": "ef5ddc71-bd00-40fb-959c-dff1c728d815", "value": "3072:9vGyYiSDnt155GWp1icKAArDZz4N9GhbkrNEk15cDU0FIqwHlvw4JV7Kj9qWRiih:f4Pp0yN90QEknCMvNxKTRrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707895309, "uuid": "e26578f8-7a7e-43f8-a374-261fdd562ee0", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707895309, "uuid": "dcead511-3f6e-45c1-9f70-3e25c3a72914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895309, "uuid": "e25280ec-71e9-4194-af6d-3753837b1ade", "value": "1ba95614eb2142b52af7b83ac8929f56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ace408fb-cb0b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707896150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707896150, "uuid": "8f5c1c04-44c1-4126-81a3-98d1ec566f43", "comment": "Malware payload (Mirai)", "value": "d21029097cf55e47d173218204e1570c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707896150, "uuid": "d19ce5c2-281d-43c1-b4fb-af40b9585099", "comment": "Malware payload (Mirai)", "value": "aa5896425f674ed27cacf370e6fb43adfd3a0b9adf880cd1a5149880e9fc1c95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707896150, "uuid": "47177c28-094b-4f43-a87c-1e178667c9c9", "comment": "Malware payload (Mirai)", "value": "dcdb827409f12a97f48988653622a527a27dbf23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707896150, "uuid": "bfa32085-80c7-46e8-a1b9-95420b5766b9", "comment": "Malware payload (Mirai)", "value": "e8b7916bd43d000d3d91f73df20994b33de72e0d5b356bdb662d911ad289283d7de341d5f7ac7da68258d7a1124c28d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707896150, "uuid": "2a76f462-bcda-477f-8630-5b2c2d758e9a", "value": "T15DD2D03A370906C9C53A76F48DA10B616DA44FB2F072E81E2353BCE767025487CAF5C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707896150, "uuid": "c08b1ecd-b57c-49a4-97c3-0c0cf88ad6a9", "value": "768:P4ylAtv6pqBIU/Xhc7LAVfU3qb/8GwSgUhPJgGlzDpbuR1JG:QMBGvu7Lukqb8mVJuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707896150, "uuid": "3d6f34e0-83c0-4de2-a467-77955050830a", "value": 28884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707896150, "uuid": "8c5b46ef-a29c-4b67-b70b-861face33dab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707896150, "uuid": "c4991c16-bd6e-4f40-b103-4c8f69d376a0", "value": "d21029097cf55e47d173218204e1570c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21e1c87-cb42-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1707919808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919808, "uuid": "cc48b37f-b68c-4017-9450-2ad4271c0c18", "comment": "Malware payload (Pikabot)", "value": "f32839de7b3209090778a9a4c5e14cce", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919808, "uuid": "71366caa-d132-4bfd-8e3d-09f20afe9ecd", "comment": "Malware payload (Pikabot)", "value": "aab9e3d3f923f7c17694df3bd395aea1112f87e63580c1762579c43056d3b2da", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919808, "uuid": "f9709952-7514-4032-9e71-d504aa1dbc39", "comment": "Malware payload (Pikabot)", "value": "ca33599617a5de46cb3e726d66eee9d48e5a78af", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919808, "uuid": "205ce37e-2d32-44a3-a9a8-dfc42b245929", "comment": "Malware payload (Pikabot)", "value": "a024f0817203d6c87749ab86e9b0f077f0df548ec18b965cf3eb09b9b383de5b7ace9376007c936aab7d473a973cc6f2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919808, "uuid": "bcceaf0f-328f-4ec9-970d-73edbb44d37f", "value": "T1E9A4BE407442C177D0AE0B311974F675856DBC344BF496EFA7EC1EAA0D282C2A572EBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919808, "uuid": "3b838b0e-6dc0-46d7-9a28-a27dcd81346b", "value": "370ebde54530b2016d14ffc9556403dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919808, "uuid": "bc562763-fba8-4f36-af22-c351ed6ab412", "value": "12288:v+P9B4JFF6iIJoLjIE0LO5Q23eankS0HsQBw:vHJaKE5L4US0HJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707919808, "uuid": "d9324d25-3e55-479d-a0ad-17319d77d04c", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707919808, "uuid": "2ae0f81e-99a0-4127-b255-bc8a2a9e9572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919808, "uuid": "2d3bac51-2844-4d08-9527-4f18ac256fae", "value": "317631.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f478ff11-cb41-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707919462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919462, "uuid": "8584f024-7ab9-48f2-ba5c-3051edf534bc", "comment": "Malware payload (AgentTesla)", "value": "ba4ecdcd616e5a3d4afec4bdeb957d28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919462, "uuid": "837ff0fd-276c-42a7-afa9-698d5fc8a581", "comment": "Malware payload (AgentTesla)", "value": "ab59c437de57f50a9b74d2510a2f7ee951f341c6e3bfe2dc209f0677c1542d30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919462, "uuid": "5f6f0412-3866-4f5b-b0b3-b1d3c92a3b54", "comment": "Malware payload (AgentTesla)", "value": "1ea145620a14c202cac38ea1ee003321ca114d8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919462, "uuid": "a368bf0f-43ea-4d31-b1c3-9a38fd671f17", "comment": "Malware payload (AgentTesla)", "value": "ac599a908740033f3193a3b6ee7029512eaf9a6f45a43d68ffa4bcc4f4f386de0a40e96d4801760856afcb40af75c375", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919462, "uuid": "333f9f3e-5a0d-416e-981c-d35cc09a2f73", "value": "T18545339D9F01805BF156A3330F986212EB709D8632639A59F6CC871D3F1FBD0AB7065A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919462, "uuid": "e6d02abb-d55a-4c33-9a02-566acc15bbee", "value": "96:5KHXdpizUvci04Nb5a9SPp9By327FaM9k3hnMty8RhqYdSz:AH/Kedn+xiRhqYd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707919462, "uuid": "dffe3545-7547-4b70-963b-5bd797572445", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707919462, "uuid": "a7f6c7f9-2bfd-4ff0-b466-a4deea6339ab", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919462, "uuid": "8e6bc0c4-fe89-46eb-99c7-ba414a4ceebf", "value": "ndoc20241202070611.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40c742a-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707915972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915972, "uuid": "66492dec-b430-4554-8c1e-9245c706831d", "comment": "Malware payload (Formbook)", "value": "6935cd887df428f18566b0fbb125bb37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915972, "uuid": "50eb4ad7-d413-4547-8990-35531ac6ca82", "comment": "Malware payload (Formbook)", "value": "aba591be8db32ef7723900ffb4541610cf3c3f6f4b32c5792566d61815403aa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915972, "uuid": "6ef6b40c-5163-45c9-b68c-b6b31cbc3b6f", "comment": "Malware payload (Formbook)", "value": "95ceb5998aee85440a5bb70922c60bf71080ad3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915972, "uuid": "0a682640-38b9-4751-82a9-e9b2a930bb43", "comment": "Malware payload (Formbook)", "value": "cf253daa73d10a71c1bb9caf6fbefaf0d5f579c0ecb272b3b0853cdbb96d43033517d4fcfe7b3481edca413039609a91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915972, "uuid": "2cf724fb-aaea-490f-96b6-f41bcfc86f1f", "value": "T115D423085B2A5772C1ACEBB218B197D45339319235E2EB6CCB9444E87BA837D01D4EF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915972, "uuid": "3fe0073d-2e04-4480-b64a-c2093a29ec86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915972, "uuid": "82bdcac5-0fb9-4714-972a-bac721f651b5", "value": "12288:DzNBv+SH8ko5kS0YKWJ6DF7HhjBNro1rdluJo73CtTkPhP3glAQNJd7:D3v3RnzZ007B9NroBxjZP3glA+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915972, "uuid": "0aab4bde-4aa1-40fd-b236-3d571d065f23", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915972, "uuid": "d328e251-0045-48b5-a3d2-ce3ea1861dc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915972, "uuid": "c5e9cd52-1076-4a03-a20a-c7c1a0a11eab", "value": "DHL_AWB#6078538091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a7361d-cb79-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1707943518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707943518, "uuid": "b7011d62-f2df-4533-bddc-fdb7c02b6613", "comment": "Malware payload (Loki)", "value": "a52b134316f47bee3d9ef3227437e4d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707943518, "uuid": "dca2be53-acc8-4e77-8f82-4e636daf6ea7", "comment": "Malware payload (Loki)", "value": "abca583115aa95f0bbf8da0cc7d73dd29ea0ef947afc7893f0d1028743578c27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707943518, "uuid": "6458b54a-55b6-4bf8-85ae-16760deefe5e", "comment": "Malware payload (Loki)", "value": "1e27f269e0d5549e6e72a16f62b383a6fe3fbef1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707943518, "uuid": "f9b6eec1-c28a-4f11-ae9d-bedaa0a07dc5", "comment": "Malware payload (Loki)", "value": "fdfa639e656cdaa48e8fc1d06c07a39d7207de9ddc44ce0274c2c8fb55d5d8f84d922c259f1af95dafb7716bcaf1e932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707943518, "uuid": "913e6245-4173-46f7-9a3e-e789b6e80d5f", "value": "T1D3E48E27B3D09833C21EEA794D5B86A8A832BE0039589D567FF52D0C6F3D29035F6197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707943518, "uuid": "d4b893da-a72a-4e6f-8b00-5d2b7ddc13e2", "value": "0d8c17ecdfceceaa1bed94b582732d86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707943518, "uuid": "9be19167-ec98-4416-9085-3ae0e6d6f9c2", "value": "12288:MuRU2z18HO+ftsEekExMEcBgv86L0PbCHWBnjJVWrtg:vK2iHO+f2kENcUJ4CHWjJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707943518, "uuid": "cf1de779-1062-4daf-9965-a2387251f3d7", "value": 670720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707943518, "uuid": "e5fb24b7-ccb2-4b45-86f5-3dc1475c8836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707943518, "uuid": "f2cce395-ce00-4c0d-9de8-908b59ea23da", "value": "a52b134316f47bee3d9ef3227437e4d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d175cdb-cb52-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RaspberryRobin)", "timestamp": 1707926510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707926510, "uuid": "44a1592b-9f19-4d9b-a3cc-fb93039bd38a", "comment": "Malware payload (RaspberryRobin)", "value": "e2fe09e0691f86121ec5bfb72143af9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707926510, "uuid": "f4e816bd-b94d-4b3a-9554-34186a7aff1d", "comment": "Malware payload (RaspberryRobin)", "value": "ac7393907c6d8c79e15fcdd437d984d7af08c6b179d53404fcd0cd6574864f74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707926510, "uuid": "98f5d3b6-0f24-45b4-a9e6-abeefa9d5625", "comment": "Malware payload (RaspberryRobin)", "value": "a045264e244e6324abe19d08f3d4bad953bf5001", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707926510, "uuid": "00505940-5bc8-4892-a539-4d9b2d34a94f", "comment": "Malware payload (RaspberryRobin)", "value": "f7672bb6058287bdf5396bf83239d7370710fbd641b091f01f8838da2c68792061b721a189080696c03738cc98ea07ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707926510, "uuid": "0fede08f-d56a-4c42-bffe-53f7664ccfeb", "value": "T143C5236176C0C470E562143721698193A93CBCB2AFB64DD763E13E6EEB30AD1DA31727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707926510, "uuid": "a755a94b-8f59-4bf6-a7dd-303f1940d442", "value": "10b73c5f7fc148e21f974da703236659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707926510, "uuid": "4ff0ef39-0a50-434f-bb1f-42eb916bf589", "value": "49152:1monDSPMMJyQpatSr49Hwi07OriiyiIRvJIGYEw+CIBG5fyw9NLj1kvO:1moOPMMJ8X9l8O1ZI5jYEhApv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707926510, "uuid": "8dd656bd-6071-4a49-ab68-26da38753c04", "value": 2677488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707926510, "uuid": "2550c0eb-57bc-48ad-9d97-9f67bf532df1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707926510, "uuid": "219fe0fc-e05b-4423-b6ae-37277b936c7f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8add3add-cacf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1707870323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707870323, "uuid": "3e6ccd81-0d88-4fa3-aa61-d7b0ac3bd048", "comment": "Malware payload (DCRat)", "value": "0527f896b1e3b970a68214959187e918", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707870323, "uuid": "d1def53d-0be6-4ce2-9006-7ad9e22267db", "comment": "Malware payload (DCRat)", "value": "acc04ee54eee32d4822a96882d020f2b95680878db2dff15818d91faa57c4efa", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707870323, "uuid": "bf0b46bc-3adb-4c46-93da-78e494c7cd24", "comment": "Malware payload (DCRat)", "value": "f6a19a54bd326cf087b2f8ec1f51bee91a883d01", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707870323, "uuid": "25c9ca55-56f7-4176-a4ac-b70deedab8a8", "comment": "Malware payload (DCRat)", "value": "0b7a13b6aca905a4e5e464495834bf78109297269d6b8d267e05d786c0fc8a384db5cdfb19c12732fa7cbeb91055c018", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707870323, "uuid": "636bee4d-fc2b-42e5-ba9d-d1552622414d", "value": "T179455B027E44CE12F0085633E2FF454887B4A9516AA6E32B7DBA377D55123A73C0D9EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707870323, "uuid": "88e07107-f0b1-47b7-9780-d14716e7e1b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707870323, "uuid": "fb212a3a-8055-4fbf-b224-30146256f45d", "value": "24576:wfkL552TkeiNqfwXHEeaNZc+rH25MI3gmri:wMf2TySwXk9NeM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707870323, "uuid": "426e2f77-6163-4ae6-a894-83b6e7fd6db6", "value": 1169408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707870323, "uuid": "5d0b79eb-07ed-4e15-b2c8-1286b1e3bd4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707870323, "uuid": "c20da49f-61ea-4b61-87ef-044adfc514de", "value": "0527f896b1e3b970a68214959187e918.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae2ecb62-cb43-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707920204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920204, "uuid": "affb5ccb-8029-463f-b628-49153530b816", "comment": "Malware payload", "value": "315e9607060eb77a77813a83b8d642a3", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920204, "uuid": "91a67cf8-4bb4-4d92-bb16-a2d101412518", "comment": "Malware payload", "value": "ad5d87b660c879631a1d1e5913f3dc1a4f56e0e20c8909b6eb976d1d7f5b6325", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920204, "uuid": "cbf25b4a-49a3-41e5-9cd5-4730f44198c7", "comment": "Malware payload", "value": "42f4eedb9dc21c5526aad8a5362151f11d293697", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920204, "uuid": "65cce89a-3a92-4b83-baa6-efed0289f15a", "comment": "Malware payload", "value": "27a23ed075ab85c79068559fdc77b6e113d67b52d931329ce704b5962f3515058c617fc5a05277322d510685ced00551", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920204, "uuid": "989418a8-85b0-43eb-8993-4825eb49a7a8", "value": "T10BE32C34EEAD522BEAB24639C8977202F8136C52F75FDE1A404362C754311D1AED6D3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920204, "uuid": "2e742389-6bf6-4f54-a9bf-c7b69fc4c225", "value": "24:82/ByKnC+/l6K4oOOGZHlZWulHlr4oO+47cVhohXl5dqbxDMAarab/B4f:8KPn6HztiPwVYXzdgCA4abBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707920204, "uuid": "f9b4f1a8-fe20-4b67-96cf-854e79070e9c", "value": 154631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707920204, "uuid": "e5331e10-b5ff-431a-b6ec-5747f7e71725", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920204, "uuid": "a828128b-9d2e-4cdb-94ee-9472b937d287", "value": "Scan_Zakaz_1416-02-24_13-02-2024.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c14e8f-cb0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707895495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895495, "uuid": "8482b907-6037-49a8-bff5-e3bde3cad62e", "comment": "Malware payload (AgentTesla)", "value": "e3d7cacc6c73e355110e6c3d53876716", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895495, "uuid": "976e7dda-6d48-4360-a90d-d8e1fde1c0bf", "comment": "Malware payload (AgentTesla)", "value": "adf35677174a56908f9bd964b510d283f08f5c8be591ac2deae86ad9fa57c813", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895495, "uuid": "67d0b36c-7b13-44f1-b5bc-93aa381fb58a", "comment": "Malware payload (AgentTesla)", "value": "e8816b108185708f563a05359be416c2d9d196a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895495, "uuid": "8b39db18-78f0-43d3-89d9-81187c19dd5a", "comment": "Malware payload (AgentTesla)", "value": "e381e51307fc5690c3cc26ee4c650904f70f91006ba475bf3ce1c094bffaf601f0de2e11f650726e4f260704d03ffad0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895495, "uuid": "ffbe7b8d-6cb3-46c9-8c35-97fd86bfe950", "value": "T182B3266DD34B02698F620377AB1B1E5541BDBA6EF38552B1306C433933EAC3DA1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895495, "uuid": "23e7d4dd-c50f-4e0d-8f0d-ad65ccc07e9a", "value": "768:WwAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjlquUU/zr9iDp55K3TJZ:WwAlRkwAlRkwAlRYqu7/zrcDzADg/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707895495, "uuid": "69803646-ee4e-47f4-b964-75767e11a650", "value": 107656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707895495, "uuid": "94076efa-bdbc-4ab3-b8f5-fe1168556180", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895495, "uuid": "c8e58783-913b-47be-b19a-239698ab8fba", "value": "Payment Slip.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523217c0-cb18-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707901581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901581, "uuid": "b1e5c913-e07a-49c1-b028-391c91b8fe76", "comment": "Malware payload (Mirai)", "value": "1cf4490e18200acb789a34500c00ddef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901581, "uuid": "db374dc7-46eb-426e-b116-62ca0509eee4", "comment": "Malware payload (Mirai)", "value": "afa9168fa054dd400c0ff50e8eb59e04098582472c47b3528c97e2b5aa7997e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901581, "uuid": "b7213bc0-4b32-453a-99b9-fe460bbe54b4", "comment": "Malware payload (Mirai)", "value": "f6318cdaccb266d138d765aadb7fcaf9b1b0b1cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901581, "uuid": "ceafb1ad-a91c-4846-a3ed-0cddff546491", "comment": "Malware payload (Mirai)", "value": "43046f6d2613059647ff549849292a5e5177e1ffd77967fd5485b14b5824e473e594f5fe1496022069772e6fcdd4dbba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901581, "uuid": "e31fe453-f71e-49b3-9023-daa1830e4c98", "value": "T1E833F2F1C95FF2E0CB336C715E5006E2239D06F3AFD278A61154DA20A69AC5593F258B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901581, "uuid": "4a73627e-d8d9-404f-b7df-0ca58fa3689a", "value": "768:L7AWnhvZoGfHFrjch+sq0m9FQvNCkGRNW78YC9q3UELBQBbb4YC9o0q43zXFMF:L/nhBz4h+sjv1CPRm3LBQZCau3xMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707901581, "uuid": "b42c87c3-fdd6-4829-8250-5ccc3f9d2d20", "value": 50328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707901581, "uuid": "18a04164-763c-47af-b322-118c6715afb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901581, "uuid": "fe0317ad-8ece-48eb-9d8c-208307258523", "value": "1cf4490e18200acb789a34500c00ddef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a1f716-cb38-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707915381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915381, "uuid": "3cbe20aa-f40e-4b5b-95d3-adec12483306", "comment": "Malware payload", "value": "d830ae69c7d32233f92a14939a56774c", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915381, "uuid": "934ec0d7-fd60-49b6-9bb8-9c51c83a92cf", "comment": "Malware payload", "value": "b16251ac78b661937e98799d27c331d5c0d80e8e267da4f75047158ac61cc787", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915381, "uuid": "352eafae-359b-4af3-947b-9859a4ca5ed3", "comment": "Malware payload", "value": "68748d4beb6c68bb9005145fe6bf1783655b531e", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915381, "uuid": "51eb5a65-e54a-4ca9-a9cc-f9dbf3834b15", "comment": "Malware payload", "value": "d2cd714cf6345a88df3bc7324c9a74329fdc3dbbe213ae657de4ed5b1babccc5c8bcf9ae4784c323c70b3836e0b8d247", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915381, "uuid": "8ced89cf-4291-4c1d-bb01-83fab6b111ad", "value": "T1EFE02BD059352E43D4AB2C72117923A3473F90BF12947D1F242BA865EEE7C704B847C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915381, "uuid": "df3d871e-bd43-4899-b6c3-947a23304a8e", "value": "6:5jx9ZS1yAzVExLrZIcu9imeF3gel5iGCLJwFAD2ln9ZS1QtBzVExLr0t+lRlX:5jxy8GENr2cu9ipRn5i91laxyaRENr0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915381, "uuid": "b079dc5b-d83f-400d-bf4b-84adad19b567", "value": 315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915381, "uuid": "13fb50fc-a067-4324-9f86-23e521933f08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915381, "uuid": "bc3be26e-ca81-433c-902c-26254e516370", "value": "invoice20240214064510.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9925c193-cb3f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707918450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918450, "uuid": "5e8d9fee-a803-424a-b4e6-558a94d7afbd", "comment": "Malware payload (Formbook)", "value": "ac7369be431a46342ea797c8bee58a0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918450, "uuid": "9716c547-11f6-4aa2-8a91-7e22d4b93f38", "comment": "Malware payload (Formbook)", "value": "b1f1237f3bf5667bf62719cf9fd741263e1cf7a61ff92741dc6dcb801cd35378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918450, "uuid": "475ddc4c-b26a-4a7b-8c2f-3e20052c663b", "comment": "Malware payload (Formbook)", "value": "b9da55749cb12d38a1af153e6dc773e016b7d55f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918450, "uuid": "2584f1f9-19f2-4e18-a969-0aef31db8436", "comment": "Malware payload (Formbook)", "value": "92ad100483984e8904c2208f66486315cf62dec10f5c4194f0c9b80825da9276520ee8aab67542d2e725b2510d107faa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918450, "uuid": "5f395ef8-be93-4d30-899e-fe0c83383b3f", "value": "T19AD4233B63FD5BB7C821C7B94435224683B9A044A076E31D7D48A8EE5A13B358A70F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918450, "uuid": "ca79f8e4-4cd3-4362-9226-7e7ecb303ecb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918450, "uuid": "61cdaab5-97b3-4228-9a2b-4e6cc9041fdf", "value": "12288:20ceOufcwI2OYVUbKE5UXMWXIGCjrILDSnEYPLxKOTWmBjfSrOHMzN:200mhhOxbK650LDSnEYPXnqaHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707918450, "uuid": "d8868718-17ce-42bb-b1d1-0e79237b05c0", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707918450, "uuid": "73908036-020d-4e35-90b5-7c1120fa835a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918450, "uuid": "2f262e5f-5b7d-4613-a5ea-33af60ceb611", "value": "rDHL_AWB6078538091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e881ca7a-cb51-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1707926314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707926314, "uuid": "c904c883-ba7f-4b47-a85c-9974b24a6b31", "comment": "Malware payload (QuasarRAT)", "value": "1f4df8c89189221420cd89ea0bdcf753", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707926314, "uuid": "f1dd098a-4a6c-4b82-8650-2343a7ec7450", "comment": "Malware payload (QuasarRAT)", "value": "b3573e1e395f30ce38648d8c9d5714ad35b0bcb93dbeabb1954e14b0199ca4d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707926314, "uuid": "83985b59-f5fc-4437-9430-171655d00c6b", "comment": "Malware payload (QuasarRAT)", "value": "30d7c89bd5d28870a5f6c25749ef2bb7b797de72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707926314, "uuid": "5b982b54-cb64-4125-b306-1e3a1746f11a", "comment": "Malware payload (QuasarRAT)", "value": "0a68e227b300b0a50b0365aceded9212c97da7fc73c2ea0a646804a580fce9ed3c1fee9d7e3c501fb821185bbf2f098a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707926314, "uuid": "082f660f-485d-44bf-a683-175882e4c2d8", "value": "T1D2E56B143BF85E27E1BBE277A5B0041267F0FC1AF363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707926314, "uuid": "6730c8ad-20f3-4041-9295-eb1f0b06f89c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707926314, "uuid": "448f8f4a-9317-4fa5-86f4-cc04f8f46e88", "value": "49152:3vbI22SsaNYfdPBldt698dBcjHwJRJ6/bR3LoGdJQ1THHB72eh2NT:3vk22SsaNYfdPBldt6+dBcjHwJRJ6RW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707926314, "uuid": "82006cb7-4fdc-4189-8ac8-8a40882a1c36", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707926314, "uuid": "cd78cbc8-db1a-4bba-8690-de265161748a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707926314, "uuid": "fcc4d4cd-7d62-40dc-a391-7a92183e64a3", "value": "Microsoft Gaming Helper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8fb104-cb18-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DanaBot)", "timestamp": 1707901677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901677, "uuid": "287b0e43-b506-4c1f-86cb-6ae4a8d56fa9", "comment": "Malware payload (DanaBot)", "value": "fdf5601f0ea77eb4af4793ed6a1320f1", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901677, "uuid": "88c0b1b3-119c-4a20-9a5a-cacfa8291769", "comment": "Malware payload (DanaBot)", "value": "b372599de6b5b1aeabab5f63e580c428698210bea95694c3708c23c8b22bb678", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901677, "uuid": "1e68a5d4-987b-458a-99ef-2fef0c671605", "comment": "Malware payload (DanaBot)", "value": "adb43316071603c4666ee7b5803186cca7e00c85", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901677, "uuid": "fe4e5d16-ca7a-4019-aa94-f4d82c0a8227", "comment": "Malware payload (DanaBot)", "value": "8cd1d39e882b0f4273ac1280be5159013137763a15b45b09f47bdfe6d934d291011d0717d02c63fe23650c9968b5e752", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901677, "uuid": "d3a1e4a2-d856-4c47-ad18-73bec8f43cd0", "value": "T1BEB1945071D0244933938B7F7A2FA9C5F8A8945928930C18F648B5D8BA4D934D6ECD3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901677, "uuid": "74f6b334-40c6-4b84-af83-62b242743618", "value": "96:Lc63A7CE9LaK+fOFk/F36LRlEyoCwVzOydmAE4N2D37wHxXgMO5KDlW6nb/vm28N:LyaQFkN36LRlEyPwVzOyPE4NI37cO5Oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707901677, "uuid": "7b9d61f9-b49e-45c7-8aee-2ce5fe3ad61c", "value": 5457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707901677, "uuid": "b13fd6b3-4c77-4f80-a793-d445875e9caa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901677, "uuid": "bca9ddb9-62d8-436b-987a-6fde3c6c0ccc", "value": "allegato_284.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa089129-cb40-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707918908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918908, "uuid": "3731f559-bf4a-4005-92c2-bd3905050534", "comment": "Malware payload (RedLineStealer)", "value": "d25ce1de74f37bc197bbb013d09cec27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918908, "uuid": "b4f4f67e-dbd6-4dc4-a259-1d64ec1d21e1", "comment": "Malware payload (RedLineStealer)", "value": "b40132ba856eb84e084fd7f7c1da10b87fff64301d823a664f99a8018a08059b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918908, "uuid": "fd5f2fe3-f2fe-4d03-9f35-11af787827da", "comment": "Malware payload (RedLineStealer)", "value": "c894e251c8935c5016399088ad0cb4c73d8e0f58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918908, "uuid": "dbe4db0e-10d4-47d5-b03e-48b3b652a389", "comment": "Malware payload (RedLineStealer)", "value": "b17a25f401dc8bde0e2e0dbf592147b3b01bddb7c031123f807cf5771ad68a1bcb7323cacf329f82cb2729e32db7233f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918908, "uuid": "9dbcdd3c-bece-4372-a126-f85a505b4841", "value": "T14C46BF03FA588D52C6492937F2DB611853B2D993631BF30B36C523662D433EF69CE689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918908, "uuid": "91c231a9-9902-4b32-ac34-48e7b498c5d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918908, "uuid": "6532ee07-5faf-411e-b273-ceebedf9c7a0", "value": "49152:6OBJUMhI5F3ZmNHcoB4y8/S9UtxmMizbonn8tqJe8ZLuD5jgHPxZS5GjXt7R1Gbd:VUMhI73a9UXtCLtEe8ZKDmzyqfVO1BMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707918908, "uuid": "a63ca544-04f5-4306-9354-0182a45942d4", "value": 5460640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707918908, "uuid": "45abe4e4-b3fa-4eee-b207-db025ac8cc03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918908, "uuid": "2f359ffa-1bdc-433a-90b2-f54c89ce3e03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e230469-cadc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707875724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875724, "uuid": "b9494825-42b0-46af-80e1-850b9100dd24", "comment": "Malware payload (Mirai)", "value": "370014bc8b4f0e5928d0b19ab2d60d2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875724, "uuid": "92c5680e-e67d-4cfc-bf4c-4fbbd2e11f1a", "comment": "Malware payload (Mirai)", "value": "b4060ff529d15fde08a267e158e6544206344ec082f6c67f703f8e2230934a86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875724, "uuid": "12b2a66a-d5b3-4a96-bc00-c13542d2d0e4", "comment": "Malware payload (Mirai)", "value": "5c894ec10dde67059b7e05a17e9866776fd7630e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875724, "uuid": "bcfe6481-db54-46dc-b4ea-1c52b2abdbb7", "comment": "Malware payload (Mirai)", "value": "6cc09178d169acb6b50bef93f3f5410134082ee84f6e07c79cfdfa61325175635654ec782c45b5caedf4dadc6129a776", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875724, "uuid": "6b4e04f5-40a5-4541-959e-52f1d8979d97", "value": "T120535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875724, "uuid": "4c39adc2-67f1-47eb-bfd0-556bfa57f6a9", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8y:N1GjR8EVGOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707875724, "uuid": "b8bb1b18-4738-4db6-908a-5f5e1295e19b", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707875724, "uuid": "0deb5b85-6891-439b-b0f5-86cc7969ed02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875724, "uuid": "80fe208b-ad5f-4189-a26e-cae34b3d346f", "value": "370014bc8b4f0e5928d0b19ab2d60d2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668098a2-cb4e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707924808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707924808, "uuid": "756d223f-539d-46e0-a344-822be9624df8", "comment": "Malware payload", "value": "3ee18161eb5082311621a9fa52aeeb4c", "object_relation": "md5", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707924808, "uuid": "b6c47c1f-b1c4-4ef8-866b-efee4d146e1b", "comment": "Malware payload", "value": "b4151783b03425374deacc2104740891f1bde1234895a86d2c27f94b89bd9dc1", "object_relation": "sha256", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707924808, "uuid": "0269ea17-5c23-4e85-b809-0f5534d37191", "comment": "Malware payload", "value": "68cfaf8e84ffc6fe3b3206eb7feef2b1d7bf2f7d", "object_relation": "sha1", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707924808, "uuid": "7fe33c31-f266-4f55-8671-996ca9b5eb39", "comment": "Malware payload", "value": "4c30c334f7f10a82aec53710a047dd58637ee8d39fbeee2e40979dfebca2db547ccb0662b051009c3eead070eedb9961", "object_relation": "sha3-384", "Tag": [ { "name": "EpsilonStealer", "colour": "#559F06", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707924808, "uuid": "2b4e7dd0-9981-49e5-90d1-e16a59eeac9a", "value": "T175E73372E082A57BC5E9053B43CEDEEA9B5E43E3B4054EC52F9A64BC65070933F90399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707924808, "uuid": "2c319001-3927-4159-a110-5732a76b2a90", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707924808, "uuid": "420589e8-d886-4e91-be5c-930c2610cd18", "value": "1572864:yDHLeM1Xw1PrHkpnwnfPswEWXQTYEyUcQJtk:4HLeMXw1PrH5nfPNEWgYstk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707924808, "uuid": "e428b1e8-ec57-40f9-a6a7-03442764fd27", "value": 63961562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707924808, "uuid": "afbb7f9b-2115-45ff-a5bb-cc9a6d9dc595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707924808, "uuid": "637ae006-1158-4ba3-a8cf-f44364facc8b", "value": "Debug of Planets Therapy (Try it if main file isn't work).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36c2da8e-cafd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1707889938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707889938, "uuid": "8f5408d0-2056-4b95-bed4-b39263948b42", "comment": "Malware payload (Smoke Loader)", "value": "ea8dcf2eee76f737f8796bdbf7e33a06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707889938, "uuid": "e2820813-51ef-49e9-a79e-aa30358f9681", "comment": "Malware payload (Smoke Loader)", "value": "b8a974ff0066513b4fac4f6a256a39933af90a9df9b03d6234d1a4bf88b7b0e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707889938, "uuid": "4058d20d-1c77-4029-900d-21d71496222c", "comment": "Malware payload (Smoke Loader)", "value": "a30a310bf397ac2c5c15df009f12c91b7a2641b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707889938, "uuid": "f710756b-70cb-424c-ad63-965033f9a6ef", "comment": "Malware payload (Smoke Loader)", "value": "29a20ca447aafa35ed901d28a09d7800ef774010f86a0c82d6e4e660c640fae8f728f16426308583f6eda7901df23b92", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707889938, "uuid": "6448b5d5-08eb-4c6e-922c-abef59f05a97", "value": "T1DF249DD137D1D0B2DD532533C6B8CFB14E6E78626321AA8F6BD6967E5E382D0862430D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707889938, "uuid": "7370b96f-e920-4053-9e0e-7ccd250a4688", "value": "2d17154530ccb4fb6e2b619cbec407bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707889938, "uuid": "4b14fffe-316c-472e-9c06-167754da2331", "value": "3072:d3tinQnUoC0pvo/Uw/3BofIclBYKw6tkp3P00gpUCL5HVFUjWjJkp:d3cnQnO+vNlBH1t4P0a65HYjWjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707889938, "uuid": "23bc06d7-9206-4c16-bb34-cd542e57d20f", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707889938, "uuid": "3a7f0321-5c3a-4e30-9d21-979e16a13c35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707889938, "uuid": "3a7f8c05-3578-45b8-b660-8e103d470794", "value": "ea8dcf2eee76f737f8796bdbf7e33a06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5041c6-cb35-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707914082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914082, "uuid": "7081dfb8-3297-4932-99e6-72e69c8d816b", "comment": "Malware payload (RiseProStealer)", "value": "5fed7bed39dfae7ea6f8b32c28e96e39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914082, "uuid": "37beb696-60fa-475c-aaae-082521cdfa64", "comment": "Malware payload (RiseProStealer)", "value": "b8c8754edec5d5802f505cc4fc3bd42c76571e6a8b1c6190df6cdcd6dbaacbc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914082, "uuid": "02651511-ead3-4c5e-a9c6-b1dca3873421", "comment": "Malware payload (RiseProStealer)", "value": "fc7fc1844ebbe1b739e7b902af6f715f6fea483c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914082, "uuid": "5604798b-7b5d-4570-8d95-373ad8fe6a89", "comment": "Malware payload (RiseProStealer)", "value": "2934665e50ef3de457648f1616ec36083198ee472402f6b170edeb70f4587c8d2dd7af07b42508f42a259a099cb31c46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914082, "uuid": "623cc288-3b39-4a54-85eb-4a9fba893e25", "value": "T1EFE533DD2C404023E1597AB88DC1FFB9121EEE46BC9864CEBCD2BF177A7095C45329A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914082, "uuid": "283c2942-bf91-4192-8861-b5dedeb6b984", "value": "59aeb10eab81e92b5597d86d6e338bce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914082, "uuid": "64d2452d-2758-432f-9a9e-a5d8faead84e", "value": "49152:B03GXsa4/8D1EYGyhLUwDgdxXe35DICUI/ZTBPXVtXEkEI/ogR4i77OD30z:B03+c6RLl2xXe3KCUIVF7EdI/HRjs30z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707914082, "uuid": "2c4e2203-2f74-4aa9-a8eb-6227f44c2510", "value": 3091968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707914082, "uuid": "8ce1ee7a-b112-4af8-ade3-6d347c1ac221", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914082, "uuid": "9d88bb2a-3fde-40f3-ab37-88fb76262359", "value": "SecuriteInfo.com.Win32.TrojanX-gen.7800.8466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "552b0f08-cb34-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707913612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913612, "uuid": "5a0bb0b8-ccd5-46b4-9678-85992092e516", "comment": "Malware payload (Formbook)", "value": "a79164a22990bded9173eea4eb176154", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913612, "uuid": "2e11eafb-f3d4-4cad-8a24-dc9680e51d9d", "comment": "Malware payload (Formbook)", "value": "b9d81be275f394c0a902634f605ab592bcac9ef3bdb0242f4f0b19125f51c824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913612, "uuid": "fc6a8fec-5c44-48a5-a96c-944182dfb8e7", "comment": "Malware payload (Formbook)", "value": "237c5343512f472994e7ffe9ee7dac71f104d80e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913612, "uuid": "1f3e0a20-4404-45d0-a4f5-fa643355847f", "comment": "Malware payload (Formbook)", "value": "2acf3164cc18ac7dfe69e23da75ff0556a3bbc978fde47b2a8602684127873bac9c3fb48dbfe489d4bcd680b698cdbc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913612, "uuid": "4f02ba75-cdee-46ed-815d-b631f9776207", "value": "T1E035D011B6958477C1A223B09FBAF77A9A3C6E360326C15733C42D777EB06416E1A723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913612, "uuid": "61b0db15-362f-459a-8016-0ff43c83290d", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913612, "uuid": "6f0ecb60-3d0a-4b2e-abea-67850615303d", "value": "24576:MRmJkcoQricOIQxiZY1ia9aeq+fgwfjiwNNq6FGT:ZJZoQrbTFZY1ia1q+fgwfWwvxFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707913612, "uuid": "841dac83-d172-478f-8f03-9d6f9bff3bcd", "value": 1058781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707913612, "uuid": "c56ef721-597c-448c-8cbb-be37469d82eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913612, "uuid": "b7f27148-6ac8-4e8c-9f89-490aeb4e7664", "value": "rPO-4500628950_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "929ffa2a-cb33-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707913285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913285, "uuid": "5e8dafbd-0be8-4b4d-8344-dd64615fd625", "comment": "Malware payload (LummaStealer)", "value": "5c511c94d4fc74219ff48e80147cad48", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913285, "uuid": "dbf1a6fe-746a-4934-b26d-2aebddab8fd8", "comment": "Malware payload (LummaStealer)", "value": "baeced1519471f5b87271beb193b279983078f0bba9ba4daef9af842b3c361b8", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913285, "uuid": "f7d9720f-ff9c-4add-b238-39c451609afb", "comment": "Malware payload (LummaStealer)", "value": "b7c2716fcd7263ef6ec434faf119cd7a0402af6e", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913285, "uuid": "8c048d77-1c91-4f71-9954-064dcfc2e83b", "comment": "Malware payload (LummaStealer)", "value": "b567b6070202263b33cda4396fcd05f54e332cbd5327cfbc78aae80220d50aa9210c30acdc36cea27ba58ea812b66847", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913285, "uuid": "545b51bf-d5ec-4fe8-b715-205b73b5ffd3", "value": "T1813512217AD1C0B7C6730330A9E17A61DABFFE410734949B5B9C1A195F323D2672D2AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913285, "uuid": "ff92f28f-314b-4c31-92c3-e1f6aa740dee", "value": "36603b42a93421cfa64e8207b9ee7696", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913285, "uuid": "132e6b4b-bb50-407f-bd02-bd15c8d170d7", "value": "24576:JzCmT/4aRrCLL5ixGwsbMRm4xuYNWQvNtuf:JzbT/frCRfZhCuwBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707913285, "uuid": "6c83cf9d-3803-44f9-9e23-13a64912b542", "value": 1114846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707913285, "uuid": "6595a222-78f9-4803-86b9-e146aec5bec5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913285, "uuid": "7149bc67-756e-41f5-8c36-4d6a473c633a", "value": "3_\u0420\u0430\u0445\u0443\u043d\u043e\u043a \u043d\u0430 \u043e\u043f\u043b\u0430\u0442\u0443 \u2013 \u0434\u043e\u0441\u0443\u0434\u043e\u0432\u0430 \u043f\u0440\u0435\u0442\u0435\u043d\u0437\u0456\u044f Medoc.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97484b47-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707915870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915870, "uuid": "49974460-676c-450f-af91-2e86c46cd33f", "comment": "Malware payload (Formbook)", "value": "836a5b1a75977ad0c38bf91b5f2b4830", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915870, "uuid": "e1954d5c-42e7-4268-aaa9-534a81f7040f", "comment": "Malware payload (Formbook)", "value": "bb6a4b5aab97593c346510868f58e2a8a84714d60ca7136580daf87ce2dddf18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915870, "uuid": "3baac0ad-15ca-4a5c-ac39-9e18c2048b5f", "comment": "Malware payload (Formbook)", "value": "5134a20a3bf528086dbce150ba67d80cd719b5c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915870, "uuid": "cd03690b-a3b8-4e24-8fca-9a4994220c03", "comment": "Malware payload (Formbook)", "value": "4f7ffa460dc132cf734d9b6ca407ee77da4d97828d972fa872a967da5d6894d1c55acc6a0f04505db4d179867e579ea1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915870, "uuid": "feec4ae5-be4b-4e39-b9ae-64c730c72739", "value": "T1A4E42374B59C9B42EEDC53FE347656E00BF9260DE552CF0A9EC220E35C95FA018B225B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915870, "uuid": "b9646e69-3b60-4ecf-aa1e-758b128aeb0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915870, "uuid": "e2915b40-ce0b-49f9-aa41-dd4c13d2a1c2", "value": "12288:qiD29aluVzxR/SNoa3v39zE85cuOmn8mS1avBoPt4wolr0:0uezDa3Fwbmn8mStt4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915870, "uuid": "31b30986-8054-489f-ba8e-6fb8dfbd1e20", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915870, "uuid": "afd06e90-ed7e-4348-84ad-1ea3f71f2831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915870, "uuid": "b5d639b0-6fa4-4b29-9dc3-bfeb6adf769d", "value": "Yeni Sat-nalma Sipari+i.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724996a4-cb50-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1707925687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707925687, "uuid": "d0701f23-13ae-443d-8413-93bd6e3ad237", "comment": "Malware payload (SnakeKeylogger)", "value": "bd1e1c32c0d45c1a6c0c70a8b83740e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707925687, "uuid": "3fbb076c-8365-4458-81a0-8a177a3f1b54", "comment": "Malware payload (SnakeKeylogger)", "value": "bb76efebcd4a82f8a51e25e2bb4bd63625db2e6f03d07452d1cfa060918c62f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707925687, "uuid": "72f2f03c-016e-4e07-8cd9-869565565991", "comment": "Malware payload (SnakeKeylogger)", "value": "9a33ffe797f9318289b10e41d4ed10d966cfd578", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707925687, "uuid": "3b9b9894-e83a-4091-9d09-824c8f23aa93", "comment": "Malware payload (SnakeKeylogger)", "value": "8607fdd287cba649b0b8f9f5e5e060de6f40a9f7dd9a9cc264667493c0aae0849e29a567d3941f27e5e07639b44bf82b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707925687, "uuid": "a5221837-a032-4088-949e-5764bd5b8452", "value": "T1E2E49D15E3FD0228F5FF0BB8B5B0601686BABD1BAD53DB4E1951569E0C22F80C961B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707925687, "uuid": "9a45cbb1-c144-44f8-b77e-0a5fda97a87b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707925687, "uuid": "2f881cef-d1b2-4497-a23a-fed3a917aaa7", "value": "12288:Ue69UNW+A0BroXA2u9pAxzJxj2hCGXbmBoznolq5Ic:Uer5rcu9gNxjMvrmBoznoMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707925687, "uuid": "10495dc2-d614-40ff-af8b-4a2f12b2ce86", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707925687, "uuid": "0aafb03a-f19a-418a-b6fb-62e8de8adde0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707925687, "uuid": "555f7eb7-8d10-4c31-9094-c01b64c4b090", "value": "Vessel particulars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae3a449-cb6a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707936922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707936922, "uuid": "0347b426-a082-4840-9e35-81867a38dddb", "comment": "Malware payload (RedLineStealer)", "value": "f509332b19bad7d5c5b4b47ad517f7e8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707936922, "uuid": "7ba7c265-3926-4219-819a-ad7deb8c94b3", "comment": "Malware payload (RedLineStealer)", "value": "bb977ca5e6b81309271d7e1bd70743622ba7b41b984b692b479a181ee96183c8", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707936922, "uuid": "6b140909-6ce5-4fb2-a842-b4e49ca01b44", "comment": "Malware payload (RedLineStealer)", "value": "4bb877cd03d14ff590ae02899ebe6a976972b64e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707936922, "uuid": "8bcb667a-ecf3-49e4-b62c-b89b8eae03e2", "comment": "Malware payload (RedLineStealer)", "value": "e3f0055fc5d3770dc5b59878bba4a833f143cdfd62398e3bb57203533366bb0974bc8d646d2e5bf86051c3f3ef46d156", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707936922, "uuid": "3930c68c-bcf3-46ab-b275-47a04de0b43e", "value": "T18E84047146AA69A1F607C844787C3CB4CDF63797CAD80B20A75C82D0EEF85F63E54A58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707936922, "uuid": "4cb07aed-2cc4-4c53-bf2c-665bc35bc2c2", "value": "6144:CLFlKpFcFoxgat1v68td0wnVvNf4UUQHxjMsDzc5WbwjUP8C14sXSy:u78cwdpMsPc5Wcjmgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707936922, "uuid": "4a8f3ac3-bc71-4b1b-94fb-824a5ad377ba", "value": 386463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707936922, "uuid": "50ceb6cb-f9ed-40b8-a91e-39d41ff852d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707936922, "uuid": "cf83db59-699e-467f-91e8-958dc74c39c2", "value": "hotelrezervasyonodeme.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e949fc13-cb42-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707919873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919873, "uuid": "75e80f32-073f-4c9d-936a-4466e057b709", "comment": "Malware payload (AgentTesla)", "value": "e8dd64853a7b67e6604396ad58a28103", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919873, "uuid": "0633b02a-b43f-49a0-bbad-24d9e90f6805", "comment": "Malware payload (AgentTesla)", "value": "bec40e9e4bc9018106ccb3da5ebc4714cac1f436e421714cc8d76470ffd6edd6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919873, "uuid": "36e2a67c-bdd4-4710-b5b5-e4cfbd763f27", "comment": "Malware payload (AgentTesla)", "value": "41b0019d97af6cf4d4fdba70fce99af97e72a18e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919873, "uuid": "c47d608b-5e66-482c-bc57-96b23d104a92", "comment": "Malware payload (AgentTesla)", "value": "498e18904259837c4316ac5ee2d1e9694a440f2a4719b6db44d9e85c2684998add3b90f3e22a233ee8a81e1f5bad7c67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919873, "uuid": "2a95ba6b-63cc-4222-b065-8497e5d2bac1", "value": "T1DCE4236878A84723D99E42F86131A48487F933EC6A12DE736DD271CB2C73B6055B0ED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919873, "uuid": "edf40ac0-b703-420e-a455-6b4b5f3be1bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919873, "uuid": "d55797fe-6e2d-43ae-85c3-b90f62025a5c", "value": "12288:iiD2IClu7j8GMJUaaOGQ9ezO7tk83rsnfB8OjrYFeYDGzeVcNP:ZmMj8GM3RkO7tk+OfBVjrYtDGzeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707919873, "uuid": "d4731edc-cd63-4204-b02f-63e8c75b51a1", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707919873, "uuid": "1b203d8c-5993-41b3-be8b-0f1fb988543f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919873, "uuid": "a97cf696-2c99-4080-b775-94a0e47b22fa", "value": "URGENT PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f0f298-cb12-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707898930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898930, "uuid": "db9cd2d1-f6f6-4141-85a5-afb92478b77a", "comment": "Malware payload (AgentTesla)", "value": "2d80ba25d567362815d7c3fe8217fb9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898930, "uuid": "ac919f70-830c-4584-b462-a931d294f3e3", "comment": "Malware payload (AgentTesla)", "value": "bf2a302fc39335729896cb7c2dd05e87f2e55993801e19e43afdc094ba735ed1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898930, "uuid": "2a2e2f4a-4d82-473b-99af-a37c0ab761e0", "comment": "Malware payload (AgentTesla)", "value": "8417e333ad189606ea7cf7b2820b30d379bfa9b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898930, "uuid": "87275f0b-cae4-45cc-bea0-b917292912e6", "comment": "Malware payload (AgentTesla)", "value": "63e454835b1db1ce68ea5dca6b996d09ff373510fc33f22c61b319247b7690e0432f9a4339d8135f6a7c5fc9f98e6863", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898930, "uuid": "34c57238-f5da-44a2-b6c4-9ab7685025da", "value": "T139C4F121B7F91A6EF5FB07B77E7694124EB7BDA23A07D61C1064448E1432F8486A1B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898930, "uuid": "d0396b49-b0ea-4a51-a929-46187e3d8e8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898930, "uuid": "82016321-de83-4d49-b552-f781a41ae899", "value": "12288:VyrrB1o4hZe7rFnWqobW61SqKvyQCENBMpmia56rBltU:VeB1o4275O5oXvyppmia5gBltU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707898930, "uuid": "e5ac0d39-f82e-4ef7-95c2-fe2ff04a3f45", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707898930, "uuid": "cfe7d6a2-7873-4392-b776-ef30b0e343bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898930, "uuid": "bf7ae050-313e-483c-8e5e-8a2e0aece115", "value": "2d80ba25d567362815d7c3fe8217fb9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151b8c4e-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1707947435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947435, "uuid": "95127abb-a984-4514-a4ad-e7feb8def2ec", "comment": "Malware payload (SnakeKeylogger)", "value": "f9ad40a4158da37cfb151007094f68eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947435, "uuid": "9c69ba29-eb34-4cbd-9028-795f8e64ed4f", "comment": "Malware payload (SnakeKeylogger)", "value": "bfbe6cbc0ce4a33243637bf6b03ac62bbf27228fa40208a7c8ff173f90e86c9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947435, "uuid": "e81cbf44-7d36-4584-ad84-8d10a94cd1c1", "comment": "Malware payload (SnakeKeylogger)", "value": "bf5b87ffc69210be631fdf79cf8aee82299afe0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947435, "uuid": "37bad9f1-4dcb-4ea5-9beb-2c0c7998166a", "comment": "Malware payload (SnakeKeylogger)", "value": "f393457584d411b634f98442712392ef668ccf031230d84bc6c187851c32efe1c7aef5a6722e2ff73bb78df7cfd860b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947435, "uuid": "19d3e625-d84a-4f62-b06f-9e593ed33732", "value": "T12095E0E03795467DC13DFA39EAE8E48667FA78DB1713F02A5FC2ED4842339091A51E18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947435, "uuid": "f5852e19-e962-44f2-b04f-ba051b6099d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947435, "uuid": "0166a0e8-3b0d-4466-bff7-0a44fe432c33", "value": "49152:JtsWv4CJuyJJUusbWeWPa9nhtobETUQVjN0L6SM:AZCJu++uqj9htobETUQVi6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947435, "uuid": "4f95caf0-b6ad-46a9-a522-656b08cea4f0", "value": 2014208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947435, "uuid": "8db398ac-cc4c-4841-844e-8dcaea792281", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947435, "uuid": "d57c4a85-8e9e-4a19-9dfb-dfd37ab5e6c2", "value": "Payment Copy_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a64084e-cb38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707915392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915392, "uuid": "21175528-866e-4e13-a1e5-8071c177dee8", "comment": "Malware payload (GuLoader)", "value": "d409bfce92b4c44a81e111f3fc02f8cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915392, "uuid": "dee1401b-4eef-4f9b-bd45-1a1e39ea33a1", "comment": "Malware payload (GuLoader)", "value": "c068c3812ae204f84ff3e0bc0359cadbe58144cfaa4728fba22d5d7cca91fcd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915392, "uuid": "7fba0a07-887e-4f65-999c-504f4e3d0356", "comment": "Malware payload (GuLoader)", "value": "4a415f22f7712461163227fdedf6d8ac47d71862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915392, "uuid": "67fd4edc-b4af-4569-9c14-01add66cb36e", "comment": "Malware payload (GuLoader)", "value": "9609ea2adbc95ae61b8e24761b9a1de9e51988baf684b439b5ea7206073bc7e24dd558c40746f304fe3229001e5a4334", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915392, "uuid": "957a56ec-7de8-4d15-a2da-1861eefb31ae", "value": "T1934501217780463BC7A3C73152FD578876B4DC4C361A9B932658B342ADB2F979B8B0D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915392, "uuid": "77e1507a-6cbc-42e1-8f2d-e5a57bf6af8c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915392, "uuid": "cf969959-a116-41b2-a5fb-4e90c7b00e56", "value": "24576:oT5kVnZnE2TJnfwnJSqywzMvEPmhAtAtF9x11P/:mellE2JRfwYEP9Shrd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915392, "uuid": "4939f4fa-6be6-4c46-84ae-dfd8d5be9fb9", "value": 1192432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915392, "uuid": "324aeadc-3fd2-4ce5-9e5d-9c4d6f610cc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915392, "uuid": "38d51fce-8577-47a0-a266-5ef84e7f1180", "value": "CONTRACTA-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d74ce35-cad3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1707872072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707872072, "uuid": "238bd258-ef40-4c96-8a34-d9ee7617e0e0", "comment": "Malware payload (AveMariaRAT)", "value": "801b85a09b1f0b27058d546ce871054c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707872072, "uuid": "080039c3-7b91-4bae-89ec-02c30cf3f219", "comment": "Malware payload (AveMariaRAT)", "value": "c3aa8cc8ada3fa6e79c32610b58ef3cbcd339faaf8e90036c285c965b0471eb6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707872072, "uuid": "248abbe9-8422-40f7-9777-229408fe51d7", "comment": "Malware payload (AveMariaRAT)", "value": "05ab1832c07425f87867b384d90500863d066637", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707872072, "uuid": "787762e1-5e92-4197-a592-39ea4c802aba", "comment": "Malware payload (AveMariaRAT)", "value": "31f28b7a2aa3d9e94b93933caa7a4335a7ffd6dff1341007510238486f6ded9383a36dd3276e00a3a35938f289403bbd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707872072, "uuid": "95455b59-709e-400b-8782-5f464c16341f", "value": "T18C6533CDA4F369CED0A727AB287C4FE0239900039F481FEBBB17965C04565A6CB8DD64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707872072, "uuid": "ca24e5d0-54b2-438a-bda5-d768a39f627d", "value": "24576:sD8/MpAYP9CRv/Tu9Tr+opn31Df5j+KlyGv1nNoavAlZ1lU+GpD4WqkQ9nxnGYe:sD8aAYsRju92oDhf11NRYlZ7U+l9n4Ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707872072, "uuid": "e474dae5-0551-4394-9552-77a108e78254", "value": 1541886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707872072, "uuid": "d420f8c1-a1e5-4f5f-b1b6-5470ba957910", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707872072, "uuid": "670ac347-1880-4682-bb77-e8c6ef76116b", "value": "RFQ Letter and Instructions.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62c7fa4f-cb36-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707914494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914494, "uuid": "75dec211-423a-42b9-8857-6277beb66975", "comment": "Malware payload (GuLoader)", "value": "0bf41801dff8bd298928e27c3a4779c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914494, "uuid": "f391d51f-f7a8-4d52-91b6-fbe1873279d4", "comment": "Malware payload (GuLoader)", "value": "c3d79c80a150afdf2c2626c05e646b2e219a84c2d8cb7562b820a928beebc63a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914494, "uuid": "c9c64fe5-0606-4374-a271-198d64b31df9", "comment": "Malware payload (GuLoader)", "value": "c609d08ca860e73e8fea2d9d055ad4b046dc828e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707914494, "uuid": "61f14a73-e96d-42f5-8d6b-393739b3e6db", "comment": "Malware payload (GuLoader)", "value": "de6f4a8de4c0aea2bcb975dcd4e326a679e06f53c2be5a7ed9f5d1f0dd673b23e1e7a25143af7313a40ade1e3633d32e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914494, "uuid": "4b758aeb-bfdc-4a65-b408-3c8d758889fc", "value": "T1A4352251F2189145DE912F766E32DC785B939D1255F0220F62E27E2F7ABF0938B3B220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914494, "uuid": "fb3195e6-54d8-4cc4-bcff-bbc563e7f560", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914494, "uuid": "81e730f2-cfd8-4e88-858c-06f8bd1b6888", "value": "24576:nfLKd6flVd10GfPblLXhVc69GJ3ltph/VUei+pbM9tr2qV:fI6dVYOjxXhqa2vph/LhMf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707914494, "uuid": "5afb0d74-ed77-4b1f-9ead-dbde8a6a9fe4", "value": 1066136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707914494, "uuid": "b4b90bbd-9683-4561-9003-01d92bde9fce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707914494, "uuid": "db404775-68e7-4a85-ae07-36d01bea74c2", "value": "NEW ORDER INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c451d1-cb1d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707903817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903817, "uuid": "b47299f6-f96d-43b2-8800-5d385320c95c", "comment": "Malware payload (Formbook)", "value": "f2952fcf96d46b891b6dda457f894936", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903817, "uuid": "9ab6308b-0c45-4fa0-9791-8f2907b13a8a", "comment": "Malware payload (Formbook)", "value": "c58f153aeb6597d18899c08977d121ae63235244dd77fef1a0241d9012715e96", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903817, "uuid": "f68612e4-45b0-42b5-ae29-213d5e6de264", "comment": "Malware payload (Formbook)", "value": "2f8e5742cc7df3e0a0c100ca4a6b0294435bfe9f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903817, "uuid": "0f3ee303-4196-4860-88d0-13d6fbd13761", "comment": "Malware payload (Formbook)", "value": "a916202798c2d3961d7d90223b5f20f2935ef617b61d8f7df390c8021870da86ac8c14bae59ca6496255ac3ceec41085", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903817, "uuid": "15f2a7af-86c4-45f6-bfa6-c4f73b074d2f", "value": "T1C183A06DC34B02598F620377AB171E5442BDBA6EF38552B1346C437933EAC3DA1252BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903817, "uuid": "be441cb0-8a38-4368-bfeb-ba182f52b522", "value": "768:TwAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjWk1THlY7IgBpEnatieW:TwAlRkwAlRkwAlRvQTHlY7IcPieW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707903817, "uuid": "d4d7aa22-2ce8-4dd3-bc83-8c2c1e63ec35", "value": 87202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707903817, "uuid": "3cb32f3d-a803-458b-b518-93478f37ced0", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903817, "uuid": "77766553-d51b-4ce4-810a-556d99209458", "value": "OutstandingXInvoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613b5bbf-cadb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707875407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875407, "uuid": "32a00568-5074-417d-b965-da134cc77a37", "comment": "Malware payload (Mirai)", "value": "22d550ea40787e033826062b50c62abb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875407, "uuid": "617384af-7246-4022-8f4a-871584e81e5f", "comment": "Malware payload (Mirai)", "value": "c5a268dff09a4e70565fc7ceabfaba0d4b3441c2bd62b22268013a7be6d72d6f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875407, "uuid": "8ee8052f-969c-45c2-ab59-0f9db105d103", "comment": "Malware payload (Mirai)", "value": "4c2b431a562ebb8ac23d5f9f965ac8f8f4eeb198", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875407, "uuid": "856e9c0a-51b4-444b-a396-9111fee4d86f", "comment": "Malware payload (Mirai)", "value": "7983a582e3886b7fc186ccb0b5fb06e586a60602dff27d15cccfec7339193b747ba3243fb813e965d7fc5f355f25a207", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875407, "uuid": "ecc3ba43-f96d-4542-a725-f7cec96e1cfc", "value": "T115C2E13092FD2CB6C6600972E3B85ACA7E530F7DE6FE2880114157BB3941D0969EA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875407, "uuid": "fe3c02ec-b7c8-4373-af88-9330516a6e6c", "value": "384:AOt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEY6gbhymdGUop5hj:AWsoTAZ3alkXLvFh8nNEY6gbs3Uozp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707875407, "uuid": "2bf3dc4d-1149-4bb3-86ab-bd339a8a54f6", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707875407, "uuid": "96155e10-e47c-4d81-bb11-6f6bf9446e52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875407, "uuid": "bff39697-c3e9-433d-a2ea-0a430b691f34", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcfad83e-cb0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707895854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895854, "uuid": "40f0667d-4e21-4cfd-bb69-e006dff45328", "comment": "Malware payload (Mirai)", "value": "7f731a49e1fb0ae11a90a457ed684f91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895854, "uuid": "1ba6361d-8da6-4325-b725-cee7041f63fb", "comment": "Malware payload (Mirai)", "value": "c72a01dae4bbd09f209cf60b07dd6f603a8a47bb8ace0aa64e5fe45d7c24c039", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895854, "uuid": "07fd4bd2-933e-49c2-bcca-43de3b6852b5", "comment": "Malware payload (Mirai)", "value": "0c3ef82ec78ea3469b83546057380ea47add9a9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895854, "uuid": "016c3b4a-6201-44b5-ad36-30e1e4f3af99", "comment": "Malware payload (Mirai)", "value": "91f87a5d240581dc5fe3e08dafe48553291ac603ee6cdfe3e8b3418387b0479ad90067a3aa25ecab0e6353accec839db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895854, "uuid": "ed17985b-232d-4072-8684-6ff16dd956db", "value": "T1F3C2D026E8145ED0FBDE29F21DE0D2903FFA2B4E70E2CCD3B196DE25562658745D4B08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895854, "uuid": "8df5f214-0518-48f2-a2d4-6bb059402923", "value": "768:4KnqLiChP7gI5ut4GKNJ0IQh1rG4uVcqgw09N:4KqL1haOGKfjQh1rG4u+qgw09N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707895854, "uuid": "f15db84a-b0f9-4b65-9515-89185bb5fafd", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707895854, "uuid": "1ed3edcb-b6f0-4bd1-b536-fcafdd7bd82a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895854, "uuid": "c93b705b-8a89-4ad6-8445-86cca3845ffb", "value": "7f731a49e1fb0ae11a90a457ed684f91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52fa8269-cb0f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707897717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707897717, "uuid": "25a3a8b8-d755-46c5-9f95-7f97e4ae43b3", "comment": "Malware payload (Formbook)", "value": "95607bca56e2a2aec83995587646c7f2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707897717, "uuid": "b4cbdd07-f9a4-4bc3-93a1-3f613a716c9e", "comment": "Malware payload (Formbook)", "value": "c735fd06a736eec460d0d261b0db855c31153ed183e74a734c5fa445560372c1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707897717, "uuid": "3771fba7-ec23-494d-b074-cd1819facaa1", "comment": "Malware payload (Formbook)", "value": "f4777d549865fec105e6b9f158ec4ae40433851c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707897717, "uuid": "d319f764-9ac1-4c93-803c-9dc8eedac815", "comment": "Malware payload (Formbook)", "value": "10d1b43d5cc7aa206b829ed86420748f4af84a94532018513bce9371e3d5cda9bbd850f974e966fee06d84aa9f074256", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707897717, "uuid": "2014102e-2b75-47fe-88ea-c30bfad23fdf", "value": "T10C92D0B3E5EC847A9B20ECD3BFF87A9D4B672E8D78850ED09455301A1878F05283D258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707897717, "uuid": "2c805baa-0531-45fd-888b-d3d7215b2a23", "value": "384:7/w5xCA73tA0b73Zm8d1Apwb/dLh1xnpOIXPEhSgqfo6PJ1U:UZA0b7cSOp8Lh1lpOIfwSPf5h1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707897717, "uuid": "2a5660ce-9463-442b-a294-b62fd24966a4", "value": 20154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707897717, "uuid": "5de97833-44b6-400b-b24d-3f30afd1bee0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707897717, "uuid": "c49dce2e-0ff9-4125-84c0-5cb9106ae2ae", "value": "Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a346ba-cadc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707875758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875758, "uuid": "7baaf48c-2e5b-4549-a1e5-5382df2fa950", "comment": "Malware payload (Mirai)", "value": "ef16f81f7cd88c64c8f5e4a62d2a6124", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875758, "uuid": "b8f049b6-c270-4e01-bd62-c3cccba0f37f", "comment": "Malware payload (Mirai)", "value": "c778c682ae0c4a98814adb4c86446734fc57000e61e55c48641f9b2e2cccbb30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875758, "uuid": "901005a7-0c46-4915-bb39-cdf9846f3834", "comment": "Malware payload (Mirai)", "value": "256b94fab1beb76d15ea3b91f65bf5627de30b54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875758, "uuid": "58991fee-0267-467e-91ac-eb74296678a5", "comment": "Malware payload (Mirai)", "value": "ab49fd9718ba583a8f24d5fbe712507b12f91f6cb269f0c957123e2da139029ee3beb61f3f58d1df8a8143a0e062a54a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875758, "uuid": "052b69ad-a4a0-4857-a4e2-f3f51766be37", "value": "T14DC2D084F044DA01EEEB3DF02D44DADABBE12F5E6A618E8066A153915B5D3B38306DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875758, "uuid": "5d980297-6bc1-4788-9ad1-ec1ca9887e77", "value": "768:CVdafO76jpmNJJKehmA7trpfIX9KeA7PX4uVcqgw09y:mam+AnKehPRa9av4u+qgw09y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707875758, "uuid": "ebdbde24-c439-4e53-b471-d75e13e724f8", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707875758, "uuid": "cdb08f6c-a118-4f7e-94f0-12dd7189e3fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875758, "uuid": "10353e67-9320-4392-afd5-f0d467f1835f", "value": "ef16f81f7cd88c64c8f5e4a62d2a6124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45e3a08-cb04-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707893182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893182, "uuid": "213a39c9-c1df-4b5b-8501-5a6e3b857536", "comment": "Malware payload (Mirai)", "value": "32eb7ca57ab85684f95e38929fa56e78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893182, "uuid": "e858e10a-2564-43ba-9ba1-f0c320135e4e", "comment": "Malware payload (Mirai)", "value": "c891aec08a56bd9a06fe20141cd0442bdade9c0fec6391eeece2886463d6f817", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893182, "uuid": "dbd0f222-d0c8-470a-9d99-c53489e005b5", "comment": "Malware payload (Mirai)", "value": "09c0580d3a48311680bd7b316337487f3e364fe6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893182, "uuid": "977d7c1c-77ce-4176-8458-712e2007c71d", "comment": "Malware payload (Mirai)", "value": "c1957e654aba0f230e6d89bf38a8a12ef52784fdbcd47e87a64b16240d1e1e75e28498a99dfa617f68fd67ac6b03dee7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893182, "uuid": "32b6b08e-4bed-40e9-9b28-fcd9b2f00a70", "value": "T1EA331841B8814A27C6D0137BB66E46CD3B2563E8E2DFB2179E225F50379682F0C77E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893182, "uuid": "cefd8761-2a37-4eea-87ca-bc32de336338", "value": "768:mJkZrt4jAmAND9jkLEZtnEQT4lw7xCJPK4skyQEtwGl/HYmfz3ANJkw:mYrtz5D9qEP5f7x8Ch2EGs4Q7S/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707893182, "uuid": "44a64d30-2e9a-4f82-85bf-ea54cd5afbb4", "value": 50272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707893182, "uuid": "5208bc9d-5abe-4f04-803d-b9405e78b05f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893182, "uuid": "f2ba2eaa-018d-4a2b-b584-0d75ef350b7d", "value": "32eb7ca57ab85684f95e38929fa56e78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24dcdbb3-cadc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707875735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875735, "uuid": "4ec97a7e-c7a5-4fbe-ae38-6808682015c7", "comment": "Malware payload (Mirai)", "value": "aa378239869d7772c6f82a82c72c787e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875735, "uuid": "f579db4b-1fc5-432b-b851-133c1109d5a5", "comment": "Malware payload (Mirai)", "value": "c8e68a8e2b1ef8c95a7eb6b05bf2682b7e56eec642c54e7dba7e2630b27f134a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875735, "uuid": "a81daa79-8c0f-4cde-bccc-54a261277720", "comment": "Malware payload (Mirai)", "value": "02d2a251c094cdde3494646f93a62d87bb2d6326", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875735, "uuid": "efb80d06-5f2d-4da1-ae14-7fa31b725ff3", "comment": "Malware payload (Mirai)", "value": "7063cfdfb8b87b678d964929827fe43880b3dcac92be2b064b2b3b172439e51ca08fae6d72982a627c30bb93809c478d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875735, "uuid": "8f5e2a29-d70a-42aa-bf76-6c19cebff297", "value": "T1DBD2D0A981E7F5B8D0EA66B5003D06D5FD76B217C1291BB708F86076EE071C81E30EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875735, "uuid": "ef783c6b-bdda-47dc-9599-e736e6237186", "value": "768:bYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBHF0Sx0sM:bYJdJZiy1aBnQfTqBFtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707875735, "uuid": "b733d90f-18b1-42c5-ad76-b2379c24657e", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707875735, "uuid": "b696a9ed-0097-4e71-bd9a-91026664595d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875735, "uuid": "fb02f2e1-b987-4e8f-b153-a34f8d41e084", "value": "aa378239869d7772c6f82a82c72c787e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ecb40a7-cb18-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DanaBot)", "timestamp": 1707901683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901683, "uuid": "818a0734-59a3-4b95-b2bc-95be37631a7e", "comment": "Malware payload (DanaBot)", "value": "9b3eb067f37073a0423d39e115dd3888", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901683, "uuid": "992eb99d-389a-40d1-96fc-20dce3a17278", "comment": "Malware payload (DanaBot)", "value": "c937e93e8352b27b126c1593cc456e5d82b9371b87a45636e29ed34a43dddadb", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901683, "uuid": "0aa9f999-8cd0-4f85-9dc6-6e2b413c1229", "comment": "Malware payload (DanaBot)", "value": "13ad20de17d9260eb6131c09479c02855d75cdb7", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901683, "uuid": "228d4d88-2147-47c6-ae50-27abc9ee2880", "comment": "Malware payload (DanaBot)", "value": "3e52edf38115860ce851f4d5772cde058b5107a743e6e454e44de35ad0bf13d7a2ef8afce58e3564fe9a1395b6baa590", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901683, "uuid": "82eca4de-9861-4e03-8ce9-feb54b09445e", "value": "T1EFC1932A278028890B9F53E77F3664C5D0091C5A2986E43BF944FCEA299653AF9D1E30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901683, "uuid": "457d33ce-3723-4231-bbac-78588dbfe637", "value": "96:OqzImAJEiRFzKisqeJX/pto4G0qBFKARju1u2i9qhiiATJ22ABhxJj:Oqza3RFzKis5to4G0i9RK1viUh9ATwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707901683, "uuid": "320a42ed-a3cf-4960-9f25-53935a2ff987", "value": 5643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707901683, "uuid": "95e29a62-e974-4cfb-bd20-28a5612a0e45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901683, "uuid": "f55bbe4c-f117-41da-ad7d-3960cd8e68ad", "value": "allegato_362.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8058b30-cadf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707877378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707877378, "uuid": "ef998484-3c8e-4bb6-87d6-3ed35ae5c697", "comment": "Malware payload", "value": "3249d2d5459082e46b23f401c7e9a48b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707877378, "uuid": "92a45c13-7e7f-466d-8809-ccdd4d1fe497", "comment": "Malware payload", "value": "cb23b5f74928415779c7be5bd60bc7528de3ec1bf7589f613b3ac4ebfb251a6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707877378, "uuid": "06894e53-e4f7-4653-a415-54efb3bccfb6", "comment": "Malware payload", "value": "2a2ed057f3b8572def7d56810705f11874512305", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707877378, "uuid": "c7073ecc-237f-4ac0-bc3a-a69eaba1022c", "comment": "Malware payload", "value": "8680f9ab77b2a5491b0bbabf9879a5728153403aff932b477c2fd8afb12ae56ae07718b01bcdb0e9651f285ff39b4204", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707877378, "uuid": "4f2ceb03-f87a-45aa-a278-9a68c8010149", "value": "T19727332353404D5DD1D503309FABDB6181669F2A3A4BBAC9B6ECBB123BB72813D15B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707877378, "uuid": "5dc1812c-f673-4736-9ae9-b107d47e36fa", "value": "101dd9efb78b34b6f863daad2270df12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707877378, "uuid": "ee860c92-6ab5-4ed1-a851-4e8489641be8", "value": "393216:SbSqistpmhEmzIf/f4EO9snDyHNvd0dg8opK+okvExHxP1c:SbdismhNIf/A8GHz06xYkaRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707877378, "uuid": "b07f47f4-db4b-4c91-b19d-93b57cb6844f", "value": 22210043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707877378, "uuid": "af7f0cb3-5522-4570-8e4c-c759a794159b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707877378, "uuid": "bcc39a9c-9a0b-4ce5-aaed-a22e8a9d9a29", "value": "SecuriteInfo.com.BScope.Trojan.Sdum.12015.31362", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e39d3af-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707915694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915694, "uuid": "ec56c168-a5c0-40db-8483-295c0c136c04", "comment": "Malware payload (AgentTesla)", "value": "8f591dd43cbcb9cde0b06346df30ce8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915694, "uuid": "6e2951b2-4e86-4f0f-b6be-0e621587ebf9", "comment": "Malware payload (AgentTesla)", "value": "ccaebc2170d05f15694740b7e2bacfb2aae5702d57d97920826b8c0db4f29535", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915694, "uuid": "06f61476-ecad-47ae-a4a9-400ff5957e05", "comment": "Malware payload (AgentTesla)", "value": "525f143b94bb0aba8e670d50e554e97c4b62f6a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915694, "uuid": "5e340c44-855c-4ff0-a10e-8f906ee8e9a1", "comment": "Malware payload (AgentTesla)", "value": "6133912716c9bd58d075640fe3a09296f4024db7c6160324eec216354bf50080bc78a057b386fae02178e5d54ca00d5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915694, "uuid": "a3fc883a-70df-489f-818b-8a108d567e9e", "value": "T1BBE4232067F82F14D67B4BFE26205900A3F9F31968D7F7618DD873DE0612B864960EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915694, "uuid": "61c1c0d9-afb3-4595-9a11-8c16f9cd445d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915694, "uuid": "6031be5d-cd58-45cb-9b0f-da1984eb0ba2", "value": "12288:cnBELZE9ED/wNKy8FFcb5QoeBu+uvJQWBcOOd3zSFuO5qSAhgNpx8iHAMAt2ke6N:cBELeELFab5QqXdAdDI3h/xFArgTb1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915694, "uuid": "c864ce6f-2822-4d41-b5e7-fd32d48598c5", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915694, "uuid": "a4dd0cae-08e2-454b-9185-5458872fb431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915694, "uuid": "ab1aec1e-167a-43ca-933e-c50bc0b6982e", "value": "DHL-COMMERCIAL INVOICE, BILL OF LADING, PACKING LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31eb46c9-cb05-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707893366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893366, "uuid": "a09e858e-7f47-4ba9-8f2f-e02af38f09a4", "comment": "Malware payload (AgentTesla)", "value": "9fcb75b777556a9db95c789f9353843c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893366, "uuid": "04842b04-f50c-430c-9a91-e617720859be", "comment": "Malware payload (AgentTesla)", "value": "ccee5545c4179590e208b5dc0d9239b83921e06e40d2d741a861541bb42ac066", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893366, "uuid": "39aa2011-590b-48a2-8f28-f6e3445226f4", "comment": "Malware payload (AgentTesla)", "value": "07adbd68aaa678ef96699cd9f554ab14ba6b70ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893366, "uuid": "bc1b600e-b64d-43e8-a6bd-f270873edc3a", "comment": "Malware payload (AgentTesla)", "value": "404c3665a57bc80ed73e48acfd664b377fc0e82f86cd8e309371f4ef2ecef1fd77739ecc74877c906f8191e7717f7288", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893366, "uuid": "d556e5d7-faa4-46a1-b886-ffbc84fccbc5", "value": "T160234A01B3EC5332F9EF1F7768B641044331F6A67813D60E22D862958DB37508AE27AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893366, "uuid": "72188919-f98f-4c46-8863-0ee0cc492e2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893366, "uuid": "b8f90b2c-165e-40d9-84dc-bf660fd9d0f7", "value": "768:xu4/W6ua+dwbBBm/gyzv3LNb8ukYbZPLv7anZsLbVHkid+:xu4ka+d/gC3L5d1jjsAVHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707893366, "uuid": "24a3fe05-d773-4153-aad0-c102b88d0241", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707893366, "uuid": "95bc979e-4d91-4396-bdc1-b81644410ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893366, "uuid": "78a5312e-096b-467d-a689-6aa6a0d4610d", "value": "RFQ.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e643fd-caf3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707885619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707885619, "uuid": "91ba5eed-0581-4a1b-a234-8b142f393481", "comment": "Malware payload", "value": "11c9d3b36ffe20ecf66831d9939a6569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707885619, "uuid": "2ed25514-abcf-47c9-9a13-c5878b2e6925", "comment": "Malware payload", "value": "cd04a3c0863345df4cba89dd6dec6bc8e3328f77cf47965f8e7771b2b803ae54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707885619, "uuid": "d86605e4-aace-44d6-8b7e-107a03b174e1", "comment": "Malware payload", "value": "5b9b7f4db8fcc9dc8fd134f6d6de08ecc0bea728", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707885619, "uuid": "d03942b0-5530-4830-9791-7c97208b502c", "comment": "Malware payload", "value": "b8948f15e68e85904376019cae2589f940599088db5bf640825846091d5f8b8c10425c5b6d94734e9059bb2e1b150134", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707885619, "uuid": "62f0133e-7d1f-465e-8c69-420fd5effef4", "value": "T18CC42333924489F7C88A49748A261434AE7FFC2479C1265FF2DAF53FDE37B102A84196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707885619, "uuid": "d54b5788-3027-43b2-8ca1-e005ad668f4c", "value": "ba1e4acaec55cde35f1ac06de1bc3a54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707885619, "uuid": "52cd7ca6-f755-4b66-b343-7db7f82fb576", "value": "12288:znVOh9tuO1NOSVSXTAiNR9P8Kvyl9dO42/irwwewYzoSy+uqxXN:zVO/tumUSVSXTbZPbvyl9rcBIaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707885619, "uuid": "f1c24c43-ce1c-431f-91a0-7c06513c648f", "value": 566983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707885619, "uuid": "3910f207-0003-40c0-9bff-a4d83f6692a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707885619, "uuid": "dfa4b81d-1821-499e-bf55-2a8a45b22d57", "value": "11c9d3b36ffe20ecf66831d9939a6569.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25a5678-cadf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.InstallCore)", "timestamp": 1707877368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707877368, "uuid": "1296e3fe-16d3-498f-8b87-0a4e71ae011c", "comment": "Malware payload (Adware.InstallCore)", "value": "07b4aaffadea11f0a0d4cc566bbca789", "object_relation": "md5", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707877368, "uuid": "86567b2c-24a4-4d1f-a99b-243c5c572e77", "comment": "Malware payload (Adware.InstallCore)", "value": "cd4a5148e42d506fdb2ceeedc8bd184dcbf2f991c6861c152d06b32018a8760c", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707877368, "uuid": "c7f426c2-f873-4971-8597-4013a45cf702", "comment": "Malware payload (Adware.InstallCore)", "value": "166a61a963a3fe58ed09ec7720a6b6056d994a16", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707877368, "uuid": "690f52a3-927d-47e6-99da-8f4391ed4068", "comment": "Malware payload (Adware.InstallCore)", "value": "8882450b764ae9b446d4beef8266b895bffe71c3143e2614ebef0df6ad681d8a9ddbfae22e8fa104926fc3cdcaaeb595", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707877368, "uuid": "97bcc8ca-052a-4cad-8a4e-735f6b6208bf", "value": "T11C86338098A3A679D17036F67C4AD606769B3F108032312A74BE3D9D16B527BCF9712F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707877368, "uuid": "62c39c35-0cb5-48fa-94a8-80f207381526", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707877368, "uuid": "1ea41e8b-e19c-4776-bc4e-b43a0fd6bb96", "value": "196608:s1sMwfQFjFNH/TO+Pmblet4j82q9IdCp4XkhoHRVl/tL:s17qWj/Tn0qCdd0hWt/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707877368, "uuid": "08b5f833-9dc9-4050-aeb6-f89dd5848ea4", "value": 8219576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707877368, "uuid": "bca6d7d3-1290-42cf-bf99-3c1b7c1536ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707877368, "uuid": "29e8ea86-65c2-467d-a76c-6810199ca1d1", "value": "SecuriteInfo.com.FileRepPup.27097.9082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9936c4aa-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707915873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915873, "uuid": "dff15764-d133-4547-96cf-d602f8843df4", "comment": "Malware payload (GuLoader)", "value": "91830f74387097cf4ba43af2fb17ba9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915873, "uuid": "0e1e38f0-6b58-41ad-82c0-11b3aca7a706", "comment": "Malware payload (GuLoader)", "value": "cd5c29ef403dcf34334c5a28d0176b082dcb558a38c485d2770f8e548663e7da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915873, "uuid": "96c0145d-6310-460b-aaa7-15bdb678e83f", "comment": "Malware payload (GuLoader)", "value": "cb4cc6aeaab8a4cf3e6fbba9652c63d18069d516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915873, "uuid": "b1eea1a3-f4a8-493c-ae7d-a77ff76eb450", "comment": "Malware payload (GuLoader)", "value": "455e53b075b38b3733915bff5107518eafa2df4faca0ce81d7f96fe9bea62e6d2a255fbaff8bcc2a0f3355266e76faf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915873, "uuid": "487ed2f1-5b18-40d6-b9a9-1c4910196cc6", "value": "T1B2F412057B64C813EB42427894A5F3BD5B35EEBC692B8B53ABE53C9F7722B891C34101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915873, "uuid": "7b76c53b-7959-46a7-84b5-0fa82cae8b93", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915873, "uuid": "88509ca4-cf85-426a-a338-78a43645cfbf", "value": "12288:AcgyD7RR/qwft1B/UIb0J0yN4VXVxifyvYMaQyLi6R/LohEdIxL33vfOO:ASDNR/qi1Bvb094B/iqvYML3eU33HF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915873, "uuid": "ff92f7d4-45fb-4579-a250-d632c9af660b", "value": 737584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915873, "uuid": "163dfa1b-13e7-4e35-9e99-64e7f2191404", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915873, "uuid": "42e2e2d6-8486-49ca-8ae9-80d87ee8a76c", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251de2d4-cb15-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707900217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900217, "uuid": "589e4cea-08c8-4ec5-8618-357004eda025", "comment": "Malware payload (RiseProStealer)", "value": "43950afa604f4225aa85b055b93d7e50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900217, "uuid": "dd8d7917-d0f8-489c-9748-0b0ff3239aee", "comment": "Malware payload (RiseProStealer)", "value": "cdf6d6b33ea0072dd423d4cf334a1a90370646d259e154363ea22f588d827ff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900217, "uuid": "d6b6e193-e783-4ff7-9071-aafbd4bdd992", "comment": "Malware payload (RiseProStealer)", "value": "0ed2db45933f4b864ee003ddfe43fbaac5144712", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900217, "uuid": "ad4d29f0-e3f2-442f-b2de-ab1ee0bde42c", "comment": "Malware payload (RiseProStealer)", "value": "7a6379f46fd58548374090b9fe2208cd2eaeccbd6f9d96ebf9b3239193f143e7199855de5b7d521682857ecaad1d1029", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900217, "uuid": "1e191309-5424-4646-be72-652d85174df0", "value": "T195763313988519E8C5C87130558BAD7DFAF79EF709814F0AB569BB99A9F3F20C433842", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900217, "uuid": "2963d878-9a9e-4aa2-b741-052b48bc9cf0", "value": "b8a1a21d6eadad214c544e8876c5812a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900217, "uuid": "7ec24f8b-5f7a-49b7-a3a0-88a49d047940", "value": "196608:joLBXlVw4lY2UKeqUOMRHdN25mAfwxDEU+pyf:kh3w4ugeFRHdo51CDES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707900217, "uuid": "714426e7-fcfe-44f3-b9ee-7a47938c2962", "value": 7125080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707900217, "uuid": "63bc453b-eefd-4ada-b386-db387b0afc5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900217, "uuid": "14b303a1-2c3c-43aa-b402-d82724f232fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b42c1b-cb32-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707912989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707912989, "uuid": "49e9b01a-8568-41b7-9afd-b8ee02d308c1", "comment": "Malware payload (Formbook)", "value": "28527ceca95ca154ef0830e7e1d12cca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707912989, "uuid": "09b9a2b5-84a7-4294-b8cb-db03cc0aa625", "comment": "Malware payload (Formbook)", "value": "ce844a8fbd6db8142fff6b159a970d1f6156dda1dd758828e5e8755ab7a922cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707912989, "uuid": "70c29f81-bc03-4a27-9ff3-ec04fd844207", "comment": "Malware payload (Formbook)", "value": "9a17615211b658fffe30d1edf9a12c946b991830", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707912989, "uuid": "7883bd46-f05d-4483-abb6-0c131a2511f7", "comment": "Malware payload (Formbook)", "value": "ede14c355146561434723fb7412ccc698c82fcd6b75215c28c6333ead8ac1298c733c8de21a09955e331b95c0e6469aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707912989, "uuid": "723f5d71-cc03-485e-87a5-d62a317d85d6", "value": "T1C805AD14B7F91609F2FF0B7BB5B1102686BAFE167D42C71E19515A9E0C22B80CDA1B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707912989, "uuid": "2cb3a9ac-daef-45b7-8a5c-296ad61cf2be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707912989, "uuid": "cd58aff3-3591-4314-afd5-a24152d6089f", "value": "24576:zer5d/+wFA88xSTXO/z6vh4VauT4ooMu:A//vA88xSrO+vXuUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707912989, "uuid": "87b56cd8-219a-43be-9f96-bc011c8b886d", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707912989, "uuid": "a758ebc5-01d9-434b-af9e-9c1d181c59c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707912989, "uuid": "9df10a50-b351-4397-8213-c771bee3c9b0", "value": "28527ceca95ca154ef0830e7e1d12cca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24010be-cb43-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707920237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920237, "uuid": "e97b030b-d01c-4bcd-ac96-c526e1200271", "comment": "Malware payload", "value": "86f49b35cab2b9ccf7fa306a3067dbde", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920237, "uuid": "1d575b51-7e2d-4c6e-8f0e-4967574b040a", "comment": "Malware payload", "value": "cfc0ef98f7ede78059a2f794668cdb626c668511b25a75edef2d7ac72e5a3809", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920237, "uuid": "f799ff38-5357-4258-b6ea-7474ace9e938", "comment": "Malware payload", "value": "d9fab70cb02ea5437eb1287eedeb6e7ebbdeb0f0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920237, "uuid": "afadd622-44d6-4858-a102-c2e34cdd541f", "comment": "Malware payload", "value": "dd143e3826d025ba1a9bdac504a0ce13d8147a5d1e4238885b84e9e7765e36640244fd49f8630896cbd4665444da58ce", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920237, "uuid": "8f4b422d-5d82-4a8e-afc8-f87e0816718c", "value": "T14A83024DFE2824D0CD2187F42E88BB920A444FC53B9F3E7A512B3CC5D9B4C96AD996D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920237, "uuid": "26b6419c-71e2-47cd-99d4-86822229c0a3", "value": "768:CjTsxJrkrc6gqpl5rFOOhDS9iEOGuk0sS7:CjPrcxqBr9hDWiXGuuS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707920237, "uuid": "afba6a7a-12bd-4ca1-8c5c-6109c3e181d5", "value": 81819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707920237, "uuid": "8b8bf013-ff3b-4730-af45-1a72f40d0cb7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920237, "uuid": "4ac16687-2df7-45c5-994d-207c3ab748a2", "value": "document.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8896878-cb41-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707919469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919469, "uuid": "bb8d90a0-97e2-4042-8475-517239fd896b", "comment": "Malware payload (RemcosRAT)", "value": "751aabd83fe0f641e05c18f60e870f75", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919469, "uuid": "cfe2b3a3-5af4-42b0-98b0-81ff97d034dc", "comment": "Malware payload (RemcosRAT)", "value": "d017d075c61c4f1a09012c131ab524ea834426c8698b00372b38cf5daaee6640", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919469, "uuid": "b3bf9c36-9889-48ef-9a6d-93330840f39a", "comment": "Malware payload (RemcosRAT)", "value": "fd0dacbc1249a26b60261ceb6d6a07cfdcc62ddf", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707919469, "uuid": "fcdbf2d8-feff-4a8f-8a25-4dc27397ee3f", "comment": "Malware payload (RemcosRAT)", "value": "3216d293a629f80625893ca92072637c1f228f62ee46396bd1932b71a6deed46014d6fb39a78c548d7e7d3b04c4b6afa", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919469, "uuid": "8c34f145-5e56-4395-8cf7-76b48be4d64a", "value": "T1EE15331D0A2540912E6777BE6D03DAF34902CDA2A7F9CCD8CD858A1FA4873F97046E6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919469, "uuid": "34bdd053-e7a2-4a7e-a7b7-20af9e3baedb", "value": "24576:pS1ETs8lzFV4zsqk9TzjIJ6NJmEq21Vzcgt6mrRHZ:6EThRVqaTU66+zDt6mrR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707919469, "uuid": "0f772b83-1c14-4217-9ca5-e67ad0ccc375", "value": 882679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707919469, "uuid": "9160c895-230f-4dc1-9881-c811bcdaa091", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707919469, "uuid": "fe9d8d07-915a-4e85-af30-3a95a2340eaf", "value": "nTFDG098700080000800.UUE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befece0d-cb38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707915507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915507, "uuid": "03880e8e-612a-43c1-af42-20af017c367d", "comment": "Malware payload (GuLoader)", "value": "79094e9847a7bf1ffd13972fd7f4fe9f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915507, "uuid": "c1e714d6-90b2-44fc-af1d-3e73cf066da6", "comment": "Malware payload (GuLoader)", "value": "d0fceb6bb0ed4dc5b8601e9560a291fe726958c774b0dc8647d1b7aec3f0c84c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915507, "uuid": "84f4cd49-13f2-43e2-b51d-a58f5daeb508", "comment": "Malware payload (GuLoader)", "value": "98d0d34a146712d3399fcacf2369e11c4cd9c4ea", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915507, "uuid": "ce9832de-072d-4dfe-95e2-01f76d590728", "comment": "Malware payload (GuLoader)", "value": "fae804e505fa6191fa65aca42a4134aff1cb01ce79e33ef0ae80ad6371536c1c389958818c0001b4ac6b0cf9c04ebfdb", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915507, "uuid": "c703a127-2115-4ff5-9635-6a526355b39a", "value": "T140934B74EA540BA90D4B27A9FC914AC1C5BDC12905370961FEEE034DB44B8ACEBFE749", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915507, "uuid": "c4b9cc31-578f-4537-87e1-09c3260a67f6", "value": "1536:HJglU0P4wDaWxyADV76w2bnQReOlDaP5QrIWG2CSAe0i4rEOz+d:pglnvD1xyAp761kRe8DaP54G3eL4rvyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915507, "uuid": "53a7e319-06aa-4b13-8ec4-ac005db493df", "value": 95901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915507, "uuid": "f6076d50-057e-4413-8da4-6af049fb6bb1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915507, "uuid": "25ef85f1-60fc-4f76-bf2d-0028237bd633", "value": "TNT-FEDEX-SHIPMENT-DELIVERY-FORM-3073736358-Incomplete Address.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f742664a-cb37-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707915172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915172, "uuid": "a8403572-7e8d-4308-b86a-267e899a5a1e", "comment": "Malware payload", "value": "6f43eea84c2b20b0f568ecb9312665c6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915172, "uuid": "15793e90-301a-45af-ba9d-c794a983c24c", "comment": "Malware payload", "value": "d1d64524718bba32ee9266da0e6de724a9bd5f301c289fea9d5dd7089c19bb6d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915172, "uuid": "b1166925-1786-4980-8060-2275be309d54", "comment": "Malware payload", "value": "8e4cb90430765ac83a90d4c2a7f31b2419408027", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915172, "uuid": "025be284-3656-4aab-b294-00a6d5d8f1eb", "comment": "Malware payload", "value": "61f4d404134631094d83396dd86a112a19944e6f3a0916856a40baa920e6c8abdd457f522247fea04cddc7a8cd0550e1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915172, "uuid": "350e1029-df33-4220-89f8-621b048572fb", "value": "T156842312B4E64F7B556E9A476CEF4AC2FB8DE4342B4CA0C48A36B05603DF9CF0497991", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915172, "uuid": "e227c4c2-a097-4529-a65a-3545f0d0381c", "value": "6144:tyqIqgJ3sThsM7OBjJv/WTU15TfDq32TRH93/E5yt9O4LCtLK4rPS/bD:gNDMejJWUnfW32j3cEtGLK4ra/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915172, "uuid": "722d8d5e-2731-4c44-b99c-75f28589741c", "value": 395425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915172, "uuid": "fd8d031f-beb5-4a3f-9723-10475cdf477f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915172, "uuid": "45b80008-8dae-49c6-a755-4483f049fe50", "value": "AMETKV.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c46ab391-cad0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1707870849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707870849, "uuid": "1e494623-1d99-4f7e-91c1-27f311f08186", "comment": "Malware payload (Adware.Generic)", "value": "777f647af50226fe3581db91512b33fa", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707870849, "uuid": "42ad4ba2-caa7-4d6a-81c8-cf7671c1c93c", "comment": "Malware payload (Adware.Generic)", "value": "d29090c9eef7974f972008385b5cdcf328b149c256890162635e2b5c4c54d577", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707870849, "uuid": "3bfcaecd-e984-43d5-9d3a-c7ab8a6554c5", "comment": "Malware payload (Adware.Generic)", "value": "1164cec1fe80789395c7eaa929783fc03b7454ea", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707870849, "uuid": "3403f14f-cc25-49fd-a4e0-be6ae87427a8", "comment": "Malware payload (Adware.Generic)", "value": "7d81cf4af2cee22a1416866a0e5e58290cf20544ea6c100192298a6915d2d6f7fde1134666c8db5f440335476bc5dd58", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707870849, "uuid": "8b731720-b2c1-4e93-be70-f1d6e90f9bf1", "value": "T117C5AD2A62686D2EC46A3A3D4472F230D6776E75F4DA8C1A43E03D0FFF364601E2B655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707870849, "uuid": "5e50375a-9864-4dac-a4b6-251c9ec417f4", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707870849, "uuid": "8027a0d6-aa5e-4f77-9a9b-9de43bc83d85", "value": "24576:R7FUDowAyrTVE3U5FRRw7epXcDMXKSerSV66EJsfpsr/qABpuKwaR29+/MCP2jCM:RBuZrEULlcY6S35ECpsDSaRo+/jej3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707870849, "uuid": "b4398fc0-e46a-4601-bf33-2eb09dfb48ba", "value": 2516608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707870849, "uuid": "3e9ba968-83b6-42ca-9a6e-fbe89b525eec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707870849, "uuid": "c15559c4-7cdb-440e-b61e-086ce5b2406f", "value": "SecuriteInfo.com.W32.Agent.CZJ.gen.Eldorado.15689.30619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c234e4f-cb46-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1707921381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921381, "uuid": "d747da1d-1ef9-45c5-9f57-7dd0a7eca149", "comment": "Malware payload (Vidar)", "value": "9d3cfcf72253b3d11b1b269052a32e98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921381, "uuid": "04e6d828-8669-4df7-bb2f-e670c137b9a2", "comment": "Malware payload (Vidar)", "value": "d2946c09d18e13ea08180292614564ffc419457e006f2872a958b714325e2b8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921381, "uuid": "c93f7598-8739-45a8-a8dd-ae4b1eee070a", "comment": "Malware payload (Vidar)", "value": "8388da555b646579280a6cb969a69e4193b68428", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707921381, "uuid": "2e1384fd-feed-4c09-b92e-3a18ff995009", "comment": "Malware payload (Vidar)", "value": "666787d1e568964c2ea84511cb9e321390526459bdc180d6e32574fc7f029347f2f3136ddd1e7d3726d5cdcade723193", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921381, "uuid": "8214276b-098e-4eff-850d-0235492630f7", "value": "T10A9633217DD2989DF01A01BA0DABFE1CF2B69DDD05124E06A9A07BCEFEB2B44553250D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921381, "uuid": "9a3b1814-23de-4540-918e-e9cce6a27223", "value": "b51da05fdbfe3b52d2e0cdae0b451d4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921381, "uuid": "b6d89879-ca8e-4003-b103-daf9769f8eff", "value": "196608:AqCqbKZd582NBaZNqFn4X+vsw6GLGuP/ZnSkr8u6yVcfdi5O:AqCXd5hNBaOFnhsGXZS5NyVL5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707921381, "uuid": "268f969b-f460-4b44-a352-11c836e9de4b", "value": 8799320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707921381, "uuid": "857d5b21-210b-475e-8114-a27a4c88e7f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707921381, "uuid": "ace7022f-f465-4fef-954a-95d0f2962851", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20eab918-cb2a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707909229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707909229, "uuid": "ef306ced-7244-4578-b56b-2441fada73e0", "comment": "Malware payload (RiseProStealer)", "value": "e82e9638bfc88bdea603d47f73b35142", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707909229, "uuid": "5252e9f2-7339-49db-9326-9887166b8220", "comment": "Malware payload (RiseProStealer)", "value": "d2d42d76b1d7eea726e34a3b014165ca5b6f522d1f4b43a3c3607776414fa9a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707909229, "uuid": "ed2a2d59-244b-4359-b611-c30a85db9e12", "comment": "Malware payload (RiseProStealer)", "value": "4b73899ea27b67364be2edaea546d59893068476", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707909229, "uuid": "19a25aae-e6bd-4de8-aa60-3fcf28e4f541", "comment": "Malware payload (RiseProStealer)", "value": "8e4e5331bfe2738f53922d58d2d0a56f46c25a94efc7c5915125c8b242a546a58c3c4c3775793b378e53324463fb950d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707909229, "uuid": "e17e56db-3001-4b3b-accf-4692795a8484", "value": "T1FD7633432FC3168CC444A1388D46FDEC39B98D669A118E1EE17837CAFFB21E85576987", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707909229, "uuid": "816c003a-b3a9-478e-9e55-7b78b7dd65e4", "value": "b8a1a21d6eadad214c544e8876c5812a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707909229, "uuid": "04eb664e-2df9-4924-8d2d-068ae3ccd52a", "value": "196608:aQsSsAywqHkCTosIalQ40NuyGbaiwW69R9QtDY3QZ:a68rkC7VyGWjb9H8Dr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707909229, "uuid": "306091ab-5690-4387-9732-084d5b8bd848", "value": 7131224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707909229, "uuid": "c4405782-a524-4127-bfb8-2ae77a61a4a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707909229, "uuid": "ee718951-cbdc-44d5-9029-fcb7f4c4f5be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb77c96-cb67-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707935507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707935507, "uuid": "8ca3ceb4-72c1-4137-92f7-26d6f5dfcdf8", "comment": "Malware payload", "value": "8d9d37e920a6926c330a59e98036aa02", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707935507, "uuid": "74b594db-b94d-401d-b807-aa8a22db1c46", "comment": "Malware payload", "value": "d391d938c4fe11b3e2f65ada257e9331f85e44766ae3c29427ea082473d063c2", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707935507, "uuid": "748e6746-1242-4e34-b0fa-5d440c54fc63", "comment": "Malware payload", "value": "64e2c0d067310b539b128b8d6ab1a5a0f94926b6", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707935507, "uuid": "535fadca-7067-4be5-8fa1-8d40a565807b", "comment": "Malware payload", "value": "e1638eee1826d85495977dd62df84e424e8f1db5d4b68260fed51dc5a29b09a334d962a886499ea6f57c271bbb792f3d", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707935507, "uuid": "b056f19d-6e90-4f12-b26b-db434f7d3c2b", "value": "T1E71733054D5F529BCE3AE6C2FC86A69977CE2F5C277B56E2011611218927F8C6C8E03F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707935507, "uuid": "6561e950-c0d4-4779-a579-357a693e1c20", "value": "393216:7Q2tcUzPr/iq0brHO69lVQkbTMTYXTwPRrn7qI4nuTcrNO2f+imy:7HtcUzPuq0vH5VQkbYTYXTSRr7qI4gcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707935507, "uuid": "4bc24e2c-0489-4430-9fe2-67adc594bdf1", "value": 19760400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707935507, "uuid": "da73c07a-d895-466f-a05c-ad343e97095d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707935507, "uuid": "ad9b13c0-88c8-4b78-bec1-2cfac92fe1a6", "value": "Fr\u00d0\u00b5\u00d0\u00b5_\u00d0pp_M\u00d0nu\u00d0l-Inst\u00d0ll-v14.333_4670.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9492f9fa-cb2e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707911141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707911141, "uuid": "c27301f8-b85f-4d85-9f0b-bf74b3be21c0", "comment": "Malware payload", "value": "9e51570d176fc04b0704f616062ade21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707911141, "uuid": "00ef0999-1ec7-41d1-bd07-ed5e64f22c71", "comment": "Malware payload", "value": "d3cd4b536efc2e4fff22e55da1f9bb3e09d49a906ac0a21e1a880b7455fbc0cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707911141, "uuid": "88e78136-67b4-457a-b066-eaeea7aa8e31", "comment": "Malware payload", "value": "41360ee96d692a6ed1e21e830d77931a08be6c3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707911141, "uuid": "06df05bc-a225-4675-a72f-7ecf2e69beab", "comment": "Malware payload", "value": "277f167381a098880073dcf912c9b53d2dd3f641d703fc1292365ac6c3f3c50f9344fd3baf048963040b64ee6cfb485e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707911141, "uuid": "16695b20-eda0-45ef-84f5-c4386d9339c6", "value": "T18AB63391670218F5D5BB62BE58519DB94732BC231328FBD303FCD99B5F035A0293ABA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707911141, "uuid": "5d4f9b22-9705-4225-8951-087a867dda94", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707911141, "uuid": "3666163c-5fe5-447c-bccb-044cca6ed3ee", "value": "196608:/WaL0sKYu/PaQL2rg+9eqH2AbUEOgvDDJf6Wv/VrxiWmo3sNushugW6rBo0sRmVE:/QLKg+4qH2AoEOgv3Jx/VMW1sAgzrBYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707911141, "uuid": "35579eaa-459b-4b4f-9f76-ec14aafca7bb", "value": 11442737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707911141, "uuid": "85186fb2-39c7-475f-b24b-a6321394cd0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707911141, "uuid": "0bf3f518-7efa-484c-b264-98998992f5c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef21289e-cb60-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1707932768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707932768, "uuid": "e4308539-e66f-48c3-8f54-c3818410915e", "comment": "Malware payload (Amadey)", "value": "a6edae34668f9c340f9d6bbcc5ea0974", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707932768, "uuid": "8f1b66f0-0a83-456f-928d-20c49bde579e", "comment": "Malware payload (Amadey)", "value": "d53fb8bec2cc733bce403eea8d1867df4dbe60f4264eefca003d758ab745a4c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707932768, "uuid": "e9d1467a-0655-4d9a-bf0e-c0c287462acf", "comment": "Malware payload (Amadey)", "value": "0a17fb70b32dbb6babae914f9fb32f166a893009", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707932768, "uuid": "3c61aeee-a253-4552-8b2d-649a5f115eaa", "comment": "Malware payload (Amadey)", "value": "02e307dee47d0084b265379b53711b5a53338ba47ab6bc9697c13322c1eb575f87a4e108dfe2afecbb245fd4d0f7a31b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707932768, "uuid": "6d551244-7bc7-4eb9-8708-2869672b1b51", "value": "T1FB9533297EF20520C4065B3D99878E6DA6F1CD1290A52EBC6F06935B2DBF7484F478AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707932768, "uuid": "40a7e8c4-e2d9-480b-9ea8-5bd60f7fb924", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707932768, "uuid": "d93db963-8168-49ab-8d6c-c7944cc7d0b8", "value": "49152:Y3DHpZlnLXex7KAUsoMm7AnmJhtvRGJcn8HEBXr:2ZlnbeAAUdnEmJxGJ0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707932768, "uuid": "350da829-164a-4f9f-8a51-4448a8ed470c", "value": 1940480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707932768, "uuid": "d494fd1e-f695-4171-8edc-64323db6e2f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707932768, "uuid": "305b2174-183c-4ecf-91d5-ec04cef15ebc", "value": "a6edae34668f9c340f9d6bbcc5ea0974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13570719-cb12-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707898898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898898, "uuid": "e8aed48a-93b4-4d6d-8d30-ea8ee8ba6bb4", "comment": "Malware payload (Mirai)", "value": "61bdcda0fe93493e40f42f6f7b295760", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898898, "uuid": "62b0054a-31dc-413a-b57f-ca1151413011", "comment": "Malware payload (Mirai)", "value": "d990cd5fe003df77b09d271dc950d1b8bdd32df03bba06a1405abf98442a4861", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898898, "uuid": "2d566295-bc53-4804-ae16-8845acb9bbc3", "comment": "Malware payload (Mirai)", "value": "ce937ddeec32a9f87d2963c2b9d435495b96e6a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707898898, "uuid": "b4447030-5a05-4ae2-93bf-d4b7e65e4099", "comment": "Malware payload (Mirai)", "value": "e9179c3493ebd65dba82ceb3710917b4252daac18183050597437b2675e69b24ae6f3918d444e875a79fdcd9149f29bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898898, "uuid": "5ea3964e-0ba2-4089-9819-92d473beacec", "value": "T11983F79278C29A16C6E423BBFA7E018D332567A8D2DF32179C212F1577C981F0DB7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898898, "uuid": "4a1c899b-6360-43d7-a7ed-57f0681337ac", "value": "1536:8sCvlPf6NDyL9Jb0+pHXlzPhha0xT45wn6ahWNr/xKW5XnHM35PrC:8sCvlPCuTxCwn1higWm3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707898898, "uuid": "4c04ee77-eb4c-4745-9e8c-5a4349ce3699", "value": 82940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707898898, "uuid": "474e4f7d-49dd-4ce9-b149-b87e0daeb30a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707898898, "uuid": "f3755489-b8d0-4142-8d62-973790a83a92", "value": "61bdcda0fe93493e40f42f6f7b295760", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc264fea-cafd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707890216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890216, "uuid": "8ccd9667-b852-44a9-8bfd-1171faf67a9b", "comment": "Malware payload (RiseProStealer)", "value": "491269ddd29259be9d305f206942e4c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890216, "uuid": "8a8107b7-8d44-4c3f-997d-1a4f179ec32a", "comment": "Malware payload (RiseProStealer)", "value": "d9bd09c0cd6d38d20bc8a56d920b9c8cde800fe079837b11e953b5c6a3823208", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890216, "uuid": "44cccda9-b0f4-46d1-84a5-f0b6ad6df780", "comment": "Malware payload (RiseProStealer)", "value": "1030a0f76cd8026218a495f022032f11564b8291", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890216, "uuid": "3c92bc14-9e3c-4141-a8df-ea2fc143ef5e", "comment": "Malware payload (RiseProStealer)", "value": "c87a7564f5bd991b3e5afb5827ddf9c37ccb3d849322d22df51d5147ffae7ac2d33255f762898ce91b66cc5bcd203b43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890216, "uuid": "4a3f1616-bbf9-443f-b64f-e4bafcae5553", "value": "T139E533CE7C810997F28869B508E1767D011AEC026BD6A4CF3CD4BE9778B552F4D32A1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890216, "uuid": "1a7ba603-d9bb-4d63-83aa-6b3850dea4c3", "value": "59aeb10eab81e92b5597d86d6e338bce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890216, "uuid": "34a7d422-d4de-48cb-b6c5-a921def6661f", "value": "49152:iBLwJqbhzxcMU6OcklEcaVR2lhXn9PxKf/l:ieJqVx384VR2VPxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707890216, "uuid": "5b1f2ab9-0834-4075-90a7-ec2fe69923de", "value": 3125760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707890216, "uuid": "250116b9-fc36-4fb8-a9bd-bd59bf189c58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890216, "uuid": "a3241e91-b208-4a23-bf71-b19f4ef3d00b", "value": "491269ddd29259be9d305f206942e4c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b74bb28-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707915770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915770, "uuid": "ed0d0305-0414-41ab-a080-6d114af3383e", "comment": "Malware payload", "value": "9f6b8f40e0f1a3bf169d16cb8af944ed", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915770, "uuid": "4c0bfbb3-17eb-461b-bb36-2af5ed9c6550", "comment": "Malware payload", "value": "da98340a7ecb30e11857970715d5350662631f3d9b2df5d27a9630e17334fd8e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915770, "uuid": "38d3860f-85f3-41b7-8072-9aa5bf89e18a", "comment": "Malware payload", "value": "a6af6637596d7d53f8757fb5aa9f2a54a0bbc933", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915770, "uuid": "3d361781-3a07-43bd-a7aa-8cc097b50093", "comment": "Malware payload", "value": "a080c2db21fb749ef4e3facf40bbb1858328a9e185495e4c8ff82e91f6b578d0260dbe9de586a329784d61d63f512d01", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915770, "uuid": "561d6e07-b4d1-4802-858a-d13508570ff0", "value": "T104D433685D62654EC18F9773FF2BFE899B2402418BB7635178D264AF423D22BC31D44B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915770, "uuid": "efb1c3d6-0542-4fef-b098-4fd780d83b5b", "value": "12288:oRmkX5tr0P4JSmB6QMheLIpgN7d2urX4Y/8JnwWk6qAv:oRmGGPaDagN7d2IX4Y/89wlu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915770, "uuid": "b4bbdcb3-4e72-49b6-b42d-1efa53c2f1e2", "value": 632674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915770, "uuid": "adef7efd-fb06-4609-a641-b2a1a768b549", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915770, "uuid": "ef85dfdd-cc7a-491a-9c9d-1e87be5108fd", "value": "Purchase Order_NO3682720.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73019603-cb45-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1707920963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920963, "uuid": "f7e7cc44-cf53-47e0-863f-8cabbdfbfc2e", "comment": "Malware payload (Pikabot)", "value": "8c807322fc55fb541a6c27ff6372de48", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-HJ", "colour": "#3D15E7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920963, "uuid": "7b8c6bf2-d371-4763-9b00-2f5b9b0923e5", "comment": "Malware payload (Pikabot)", "value": "daeaf0df42fdb32ec39d59a159a4e2d7432d179d330e8f3ee48a9ec04ebac087", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-HJ", "colour": "#3D15E7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920963, "uuid": "5820438d-87f6-498a-b47a-41adcece793a", "comment": "Malware payload (Pikabot)", "value": "a9b72b384f4927fadaa41dea2b6759de774f70dd", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-HJ", "colour": "#3D15E7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707920963, "uuid": "bd2bd7c6-1af2-4590-aaf9-3ef6074e4557", "comment": "Malware payload (Pikabot)", "value": "2a70ad0622173e0c3afaa2ea6a2a7ec803199832b3d8555cfbc433a85c686d37155de743e6a35c7659f9a1a332591fad", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-HJ", "colour": "#3D15E7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920963, "uuid": "adeebd51-c689-4de0-9362-bc95d85818f8", "value": "T1E59423440C55A2F6717FFC2E399FAD6C52A0D588188F8CF16BE5704CDD9091E36A28EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920963, "uuid": "7a9eb9e4-fb61-40fc-8f0e-971617d99483", "value": "12288:2IrOS3FJriXqr4V2vNNwrG2q6ulITZDt0f:V3FaqUVsNwrG2q6ulcef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707920963, "uuid": "9f0c5b9e-5839-4a9b-b091-c62b630cbf25", "value": 411741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707920963, "uuid": "4ea3ba04-d938-4f0a-825b-c28734f80904", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707920963, "uuid": "6f344cbc-7b5d-4da2-ae9d-1017d4d62a37", "value": "DOLORUMR.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b679e52-cadc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707875719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875719, "uuid": "c10f11fe-b38e-4011-b97c-98978fb22b99", "comment": "Malware payload (Mirai)", "value": "646c6c500231b5e458fcd74214aaecc0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875719, "uuid": "155a72fc-b53a-4476-8619-fde090fc0332", "comment": "Malware payload (Mirai)", "value": "db2956d2d4eb547ce7e1b22e4290737e34f680b0e1d52e5d096a3db8440208a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875719, "uuid": "51f10437-0268-4b12-8a44-19cd4b4f1f23", "comment": "Malware payload (Mirai)", "value": "ef9e2fa706539d92456ab5fb12978346b949da41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875719, "uuid": "6363036f-6dd5-42bc-9801-cf624fc275aa", "comment": "Malware payload (Mirai)", "value": "8f41123d9e64f477e53ee70427ebeaa0e7866dc43d82b73a073479bf8343200c2231e9432f5e1791eaea8c59321b692c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875719, "uuid": "2ab0d8f9-0877-479f-adde-6fcfa505bee5", "value": "T1ECE2F153D372A052DE783AF1F95D85CA6ABD4BACC67B30A316115228395A0435F3C883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875719, "uuid": "19a15e81-c7bc-43ee-8427-ec0a1093c966", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9XOyi9q3UEL5Io:Porm1vpALgUJOyXLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707875719, "uuid": "59ce09b9-9aa4-4dba-8a01-8a5795f123dd", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707875719, "uuid": "90a17a0c-7b4f-40a2-8873-fd5f3f613dac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875719, "uuid": "7ea69e6d-7b97-4c16-b443-820f61751c2d", "value": "646c6c500231b5e458fcd74214aaecc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d448d6-cb1d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707903791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903791, "uuid": "83727a8f-b7ab-49fb-8830-7d23e91af7d1", "comment": "Malware payload (GuLoader)", "value": "0e7221a4e62b5b5a4f97bd4d9436ad3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903791, "uuid": "19dfa5f5-3f8f-4307-8207-d86b8baa37f6", "comment": "Malware payload (GuLoader)", "value": "db9ba9c7a3ab8266c1bfdbad55e1d711187d5f479acf82375759913283e92acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903791, "uuid": "f164151a-d9f1-4a30-a2d6-41ccf6a41417", "comment": "Malware payload (GuLoader)", "value": "81c7a9733cdaa07684db73673d762ec52e14cd66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903791, "uuid": "c39522fd-48ea-4d11-b60d-efddde17ce06", "comment": "Malware payload (GuLoader)", "value": "ae7b69fdc797cb1c798b8754e0d6b4b91e7871a47d59017ca3d36d21617ccb0d4926892c92b96707852b24ff174ee03b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903791, "uuid": "334bb2cd-7417-4e02-b26a-3a1780de4e0f", "value": "T144351281F3049159CF911AB65E36E9359B435E2A58F0160F22D67E3FBDBE4A38B3B110", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903791, "uuid": "794f5840-8e38-41d4-ba02-e5437975f0b1", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903791, "uuid": "9d268fd8-a647-4a44-aff3-443309d10ead", "value": "24576:IfLKd6f/PuyA0R2R9x4bxhvEtph/VUei+pbM9tr2qH:CI6fuys9xixhveph/LhMfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707903791, "uuid": "4cd81318-0391-43ed-827d-93ab42a6992c", "value": 1075784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707903791, "uuid": "2c03e4aa-a3df-4611-9e24-a8a832ee14af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903791, "uuid": "5baa28c4-04bf-4165-b281-ee1674c0e557", "value": "78653A07.237250.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d468a3-cb04-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707893177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893177, "uuid": "994f8fe4-9f8f-4286-a64b-b7f18b91b203", "comment": "Malware payload (Mirai)", "value": "f749f93589272713f395fa494c60264d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893177, "uuid": "62a1b3ed-b65a-4db6-9255-4155546e2b6d", "comment": "Malware payload (Mirai)", "value": "dbfacb40dea675f17636789391c6ad91e0b0d2abea1f08ab6a35df47f4523725", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893177, "uuid": "5c01f538-72b7-45c2-99e7-f2020bc41a2d", "comment": "Malware payload (Mirai)", "value": "38c09d266bc837d261525a7bda957882db1fb637", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893177, "uuid": "b6e91338-599d-4d85-8123-7a126dc57c9d", "comment": "Malware payload (Mirai)", "value": "862e4b9b79ba4f31507ee56466b918b0df8470c99eb9ea7ad96e6992c25c9de469df100a21ab67ae1517278ba82c79af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893177, "uuid": "29aa2513-06e4-4b8c-bafc-baf515cd0fb9", "value": "T176233B02B21C0B1BC4A31674253F5BD187FEBAD122E4F289765E9B9A8935E331481FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893177, "uuid": "c6ed8ab1-60e2-4dd6-9230-d5623b24b67e", "value": "768:+3p/RXYR0lNy+WHRjRqBDcxGHS5FpZXWI74fbwk:Qp/usWVRqpNEp5WI88k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707893177, "uuid": "b546f012-761f-4190-910b-d26feb5e4794", "value": 46528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707893177, "uuid": "e0c7f868-6344-4609-8974-14efedfa63c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893177, "uuid": "314b9eb3-099a-4385-babf-0c90dfe18611", "value": "f749f93589272713f395fa494c60264d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f3961cb-cb68-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707935828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707935828, "uuid": "ce30d5b7-c79e-4ef7-a445-7bf931ac1c08", "comment": "Malware payload", "value": "991461b86aebecfd096dc11ff2a04b4b", "object_relation": "md5", "Tag": [ { "name": "Coathanger", "colour": "#AE3234", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707935828, "uuid": "3848c2a2-be0c-491f-a48a-b7676fd59ad8", "comment": "Malware payload", "value": "dcd9a5af1c6297ed1a66c851efa305000335d8ade068ba515125a6612f1d5300", "object_relation": "sha256", "Tag": [ { "name": "Coathanger", "colour": "#AE3234", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707935828, "uuid": "b1e32777-42a6-4fa9-86d8-16ba1b830db1", "comment": "Malware payload", "value": "dc5074340d4631bbf89adc122e8f1a3ca8d87564", "object_relation": "sha1", "Tag": [ { "name": "Coathanger", "colour": "#AE3234", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707935828, "uuid": "09bc9e4d-1adc-4709-93b5-fecd7dccbe09", "comment": "Malware payload", "value": "00c416682a548d8636fe5665aac9fd3b784cd601defb5016c34d5cc0bfe5ae40863c25d17571c4943abe0b632539c902", "object_relation": "sha3-384", "Tag": [ { "name": "Coathanger", "colour": "#AE3234", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707935828, "uuid": "b9dac746-b2fa-492a-bd76-6627ef62d5ca", "value": "T1AE359D03BAC150FEC8D6D170CB6FA213AB72F09A6235B65E36951E503F1AE319B1E741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707935828, "uuid": "38cbd69c-259c-40f0-8393-a528b758a254", "value": "24576:qpLODejvoXyo2dIfScaxJZ7+0T8eaj+I++lZq49k77i:kLODe0XgdI83ak4/9k7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707935828, "uuid": "591ea8d0-e261-4b8c-aeff-49117c16b0a7", "value": 1153296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707935828, "uuid": "e63ea52e-938c-4fb6-8ef5-2e0852aa98cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707935828, "uuid": "6b0b3680-37b4-4d06-b57f-ba08d468829b", "value": "991461b86aebecfd096dc11ff2a04b4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d9675a-cb1d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707903652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903652, "uuid": "1b619d3e-584a-45fa-a083-c874697a12e5", "comment": "Malware payload (RemcosRAT)", "value": "2bf4f7c342a2d3e07f3685b2334f4749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903652, "uuid": "1d51a2f6-994d-48b0-adcd-478ca2a4a581", "comment": "Malware payload (RemcosRAT)", "value": "dcf86088586837cd7d690592bcd0a38c7bfd807b22b0a975da1a8773e551983a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903652, "uuid": "3bc3ec3a-b411-43c4-9bba-f49b0939a46f", "comment": "Malware payload (RemcosRAT)", "value": "ce2fc2a2899b4302ce2d55f732039240cc70529b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903652, "uuid": "8d345bcf-13b4-43ea-8a91-41be0a8d57d8", "comment": "Malware payload (RemcosRAT)", "value": "5fc55764791e7bd505a03d5559cf22b2ce0df95402a2d849820c190836249e1090f89a22aa19c40550b51932d3edf638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903652, "uuid": "ba989bb1-d0c8-47e4-b1da-dfa19dce4810", "value": "T153E422457091F033DCC52BB21A36EA3286BB7C10B936D76F3305379EBE7A1814A67685", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903652, "uuid": "4e31ba84-222f-4ee2-8fa2-9c8e319990e8", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903652, "uuid": "22652b84-05ad-4c06-844e-4d421bf3af18", "value": "12288:PK5yuMYw7lskuR1fi+6wFF0JC2RTfuBZL+HlLwxOiMCyINCj:C5XMYwZluR10bJ4uHlLhlIkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707903652, "uuid": "88cded96-8974-4af1-8ce4-aa818b2dfc56", "value": 721334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707903652, "uuid": "5d1a6e0c-932c-46aa-95dd-7c82d4518700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903652, "uuid": "1b371933-0fe4-4153-bc3d-689aa3a303be", "value": "AWB-RO-202644066004734534543534534563456784576373.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce5bccf-cb15-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PythonStealer)", "timestamp": 1707900283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900283, "uuid": "a5f5d8fa-93a3-48c2-b2c2-78da044ccf44", "comment": "Malware payload (PythonStealer)", "value": "674f0e284bdd2795be4948c911c14fc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900283, "uuid": "225c2ef1-0140-4007-a22b-1f2012bb9e5e", "comment": "Malware payload (PythonStealer)", "value": "dd4316b94787416397a1cc5d3be35cc85ca9e78ec05569b7539e4e5f18074fba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900283, "uuid": "024e3d59-5297-4dbc-887a-3dc16bbe89f3", "comment": "Malware payload (PythonStealer)", "value": "affeb709c5e4c9bd7a332c433338e60fab1bb938", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900283, "uuid": "d214bb60-0dfd-4324-ac86-4cc2f4e03e2e", "comment": "Malware payload (PythonStealer)", "value": "6b4c0b5c1d14a5a4d58686363c1c20d75c7151394942cc51e5d8fdbf6b49836244eff39200c107a198cc67ecde257a97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900283, "uuid": "7d370229-597e-427e-8079-1b74ef481480", "value": "T1C7B6331ED5120CA6CD63E6F5E38214F3BB1D7875360084BE428DA7B42637FD02A696D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900283, "uuid": "20351d8f-22cb-494d-8fb8-26115a78ae9b", "value": "a7b0793ae6dd3f16ef244d19e4de0c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900283, "uuid": "01003f3d-fa21-4e43-bfd8-2a2e2203bdff", "value": "196608:Y6qcMiS1kjE70vesXJYCYYyEf4LkBtdu4zxIqX/azz:FBMiS1kg7m5XJhYYytLkBTdzyqva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707900283, "uuid": "737d0b60-66b9-46b9-b7f6-030089d0baba", "value": 11202048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707900283, "uuid": "3324415c-fe56-4b66-a4fd-6827d4eed40a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900283, "uuid": "91cd6b14-daf0-4c13-938d-447b9d6afb39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84b6884-cb3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707917670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917670, "uuid": "240742fe-acda-4128-a7de-7405c3c31d9a", "comment": "Malware payload (Formbook)", "value": "42e2835efd3b49bdaa0551982d26398b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917670, "uuid": "69f3681e-f51e-454d-920d-efa5327f1a50", "comment": "Malware payload (Formbook)", "value": "dd5b6695f32cfb42edcf6dd90802e685d50af7c243443dc0f14c3450864ce3df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917670, "uuid": "2a7abaf9-4a67-4255-a4dd-85f90b822536", "comment": "Malware payload (Formbook)", "value": "381c64a1053ab7a3673a1ad85c2833f3173baa1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917670, "uuid": "6f545a49-807e-4eb8-aefa-aae36993b5fd", "comment": "Malware payload (Formbook)", "value": "2fc273d13acc2e67bc23e2b78055ba8501768c8a9585b3086f1319cf0e1fb0fb41eb7bb0dc796d8494e7da2dc4128c95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917670, "uuid": "8b8f65d0-7667-4ca4-8bdb-a4ab61a311fd", "value": "T16BD4236072D6972FD93D03BD21A245C44B3E8B969324F7061EC2A4E907B73D68B01EDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917670, "uuid": "a4693e25-c768-4535-8935-d2d2e8bf7fed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917670, "uuid": "d7d3a3cd-72c1-4a9b-ab85-73e0fd770f4b", "value": "12288:oPiZeQ5vzi2JxoW/07SsGwlipoI2hyPpSbiA6E87/VI0Da:hri2Jx9vs9CB21b9xES0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707917670, "uuid": "0e231ee4-fc79-4fec-8259-fc5debc5cdd1", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707917670, "uuid": "53351418-a7f4-4a4b-9a55-f84d4c0627e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917670, "uuid": "7a683791-3eb6-4315-a94b-814dfa5b2316", "value": "nTransfer_EAncia_.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993b2bf1-cb1d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707903848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903848, "uuid": "67271c65-3223-4be9-8735-d7b399a307a2", "comment": "Malware payload", "value": "9613a7c11bcb117b2e32fb9fe7727713", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903848, "uuid": "bc7a517c-8695-4858-9bcf-f0dea97edd59", "comment": "Malware payload", "value": "de4c137771686387c0079bb6fff9b91f7c2a4bfe91c1e2820f6daf4ecd8a44d3", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903848, "uuid": "0f5000a5-2849-4282-ab30-7bb18b4787b9", "comment": "Malware payload", "value": "beb6ead66e756c450b0132e1d4dc51f8985c6efa", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903848, "uuid": "d7269a9f-2187-4a2d-a91a-274e587d1b37", "comment": "Malware payload", "value": "04b7df65ffd1dcd9709c04f0add4db90bb4c74508f36ad7a0f203230abc73b6dd223a8e5e3893639c591e56ff4b932db", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903848, "uuid": "ef7430b7-0d34-4f8e-8340-ba29432fa1e3", "value": "T17DC601A03CDA0026F0AF11716AA9FF79E12F6F722F3525535150BA19FD322436E14F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903848, "uuid": "c3f1e91b-4a5a-4da5-adca-98e1adca516a", "value": "607d0c9fedb370b1ce70573304bcd084", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903848, "uuid": "ad20aab8-f4c3-4305-be29-066ef91ff94c", "value": "196608:zWx2zpdra2YbT8yN+8Mne5nd7g25FjZC8OH7RbFd/Or+GvJbU9RDf/kuFLOyomFI:zYCrdiNTF5nZ9C8Ud29JuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707903848, "uuid": "200378a4-c8f8-4ab5-b2d1-c6fcc20e59a7", "value": 11922432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707903848, "uuid": "ec40e257-05a7-46b1-a0a9-227393d92233", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903848, "uuid": "338c08fa-1a09-4f80-9161-35af66b1b968", "value": "resources(1).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc2f3a6-cb8c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707951553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707951553, "uuid": "b57f140b-55c7-42e5-8888-4449a5cbc983", "comment": "Malware payload", "value": "75f17bded3eb751200a204ff3e9d4d4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707951553, "uuid": "2dad81f3-f080-4862-b9db-0aa7603766f0", "comment": "Malware payload", "value": "de5dad99d072f740e2ccef4d7f2ea2b4b909dd378b954d189e8fbfdb6222ee8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707951553, "uuid": "985122da-6cba-4504-b12f-ba431c637bf6", "comment": "Malware payload", "value": "637b743bcf2170c37a4911b7d9dbda834c7f035e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707951553, "uuid": "037860dd-3cf9-42cf-ae95-3cc33e942cc2", "comment": "Malware payload", "value": "06d0665a40c94ef7fce46dc451ea6d9b0c15c9231ec73c5302a3433d6b2092e675c217a6db70081bca332b78e393da4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707951553, "uuid": "9d6e9b53-73ce-4be2-b4b7-1a4e040f1468", "value": "T16BB533F1FA3C9985C2C3A3BC188D0A59C6377D2785C155341243F97A0B7EEB25A81E6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707951553, "uuid": "d03c7f94-0691-437c-b6f9-38243d7f31c0", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707951553, "uuid": "146c4ea5-1244-4045-a7a5-03e5a9a37a4a", "value": "49152:nh9UNEpQR13Y4GZz2MCj389o28XHo/LrRWfRZSb:fUGQRe46z2MK34ovXUHRW5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707951553, "uuid": "17c4b539-89a0-4f40-b203-f334d9668f0a", "value": 2402304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707951553, "uuid": "fd0ccd5f-e67d-4725-9ed1-ec2ce4a8c903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707951553, "uuid": "a5c30179-1b28-4b87-908e-fd449c6a1495", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa7e8bf-cb4b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707923419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707923419, "uuid": "9462d4f0-dcdb-4bb2-ba17-82c412dd94a6", "comment": "Malware payload (RemcosRAT)", "value": "595852c92f5da87ceb5cc7167f015a72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707923419, "uuid": "2b1ddfd5-fb1a-4257-9756-466596da88b6", "comment": "Malware payload (RemcosRAT)", "value": "df00f112e25af6405916498f807929598b7fc4840885f5ae55814fb7081518a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707923419, "uuid": "e7222002-8e38-4b90-ad9f-92fd11034267", "comment": "Malware payload (RemcosRAT)", "value": "030c0135d242290af5535c8fd7ceebf70b450b68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707923419, "uuid": "e7156278-98ef-4418-ad6d-e5ce0707fb0e", "comment": "Malware payload (RemcosRAT)", "value": "e41beaed53ae453297aa9826cd306a5e5280b8abc2aaa9ca0821f1bf6e159ec5a602b2685b58d3022e2ec228e39eee7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707923419, "uuid": "1a159377-19d0-4bd6-a701-ecc05ceae741", "value": "T186B49E01FAD1C072D57514300D36F776EAB8BD2028364A7BB3D61D5BFE70190B62AAB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707923419, "uuid": "cb79bffa-af92-4076-8ef8-4da48063121d", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707923419, "uuid": "151d3b1e-4a43-48af-b819-250be6399ae4", "value": "6144:hXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZHAX7cNu5GvL:hX7tPMK8ctGe4Dzl4h2QnuPs/ZHicvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707923419, "uuid": "d10d61ee-67e9-4ae3-9617-dc177c76b324", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707923419, "uuid": "f79aba8a-f0dc-4071-b332-14c921694b73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707923419, "uuid": "4c612521-26f3-41d6-96ee-edbdbd897b9f", "value": "595852C92F5DA87CEB5CC7167F015A72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb832e2-cb1d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707903717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903717, "uuid": "653a5dd1-1d0f-4c3d-b4ce-0c520806aa21", "comment": "Malware payload (Formbook)", "value": "0301ee9c0fd76753a65c2a22df27d507", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903717, "uuid": "6fa9828f-3286-437f-aba1-00de0761fa29", "comment": "Malware payload (Formbook)", "value": "df192ebe9ddad7fe208d5c805618efedb195ba2064675f52a29e50291f082929", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903717, "uuid": "9ee01226-a3b1-485f-aa56-5a2ee3749389", "comment": "Malware payload (Formbook)", "value": "bd3438a05863b2de98822e8ff1f388a4994c5520", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903717, "uuid": "bfe64387-cb5d-4b2b-93b3-5a64ce5c2b74", "comment": "Malware payload (Formbook)", "value": "465d7c1520bd01c33f55961ce5fbf50fb17938c3056d11099d4767df5e3949c33e07cffc365e490e47a1b0605bb0748a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903717, "uuid": "9754751a-954a-41ff-8bbb-6277cf144e39", "value": "T125F4231733F2484FC96F0AB2A02254D163B7A6CB2E33DB8E2ED4528C9B92F565741753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903717, "uuid": "933e3137-e8a3-4197-a3ac-a4c40d0b3dff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903717, "uuid": "ea707a35-3b16-427d-b17c-452f129471f7", "value": "12288:RdzN6TmqepTsmBRjuYtkywZCFgU7NfgN9miTzXYESSnqnXXJpV+CGWRo:RdETGT3aY4ZagU7W9HolSMZtNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707903717, "uuid": "bfd325bc-c38d-49c8-99df-996b6cbf978e", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707903717, "uuid": "f614fdb4-d253-43a0-83d2-917604fd626e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903717, "uuid": "59ecf944-cec4-4631-baf9-2845cc53006e", "value": "FedEx_2402657477.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9cde2f-cadc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707875751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875751, "uuid": "f7ea2e6d-093c-4d97-a89c-1f1e0bbcb1f7", "comment": "Malware payload (Mirai)", "value": "1134000962f75b4e46cde9f1d11614b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875751, "uuid": "aafadcb6-0109-4942-aa4c-0f114e6b0131", "comment": "Malware payload (Mirai)", "value": "df29640165f900abb9882f804db386f4ff37b81d185e82c08f532d355d2b50d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875751, "uuid": "c3540a5a-0ab3-4581-a4a8-174660b2df33", "comment": "Malware payload (Mirai)", "value": "55b83236a96f313e309d301a70e1cce8c6f0821c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707875751, "uuid": "1417e8e2-3de6-4114-b0c2-d5485712d379", "comment": "Malware payload (Mirai)", "value": "94af9320ed60006aff670493058a39fd70c5635ed00f17de89c7ef6b255baf6d1b64cf714808a442bebc4dd12610da59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875751, "uuid": "2322e494-a700-4382-893d-b06ad72e1a9a", "value": "T149B2C1648BA1A707C3B0B475D27C8F536A3B15E4C6F639262B2092BCD95149733ECAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875751, "uuid": "73f724bd-88d7-4505-9f81-280ac87edf35", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BXv4QhymdGUop5hu7D:4GaKQFH0rs3zWoDDRsjt7LB9U+BXvRs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707875751, "uuid": "69e39349-47e8-470a-840f-b73f61ffdae1", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707875751, "uuid": "51b75761-fd9a-44f2-a0cc-2ca5de5a429c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707875751, "uuid": "4b786b8e-5533-48df-a5d6-c2570d5faab6", "value": "1134000962f75b4e46cde9f1d11614b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4adcec-cb17-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707901388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901388, "uuid": "abd40dc3-1fed-48c0-b30a-95950ed2ba1e", "comment": "Malware payload", "value": "f941ffef9704232eab50f75eaf86a146", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901388, "uuid": "a83a1c3a-3025-4b5c-a510-21b602c87e42", "comment": "Malware payload", "value": "df83e668b60f36f5e35109179bc94c07e36fc3beef46b02397b1100d7de08eba", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901388, "uuid": "240d9798-0260-4b04-8dbd-507667e401ee", "comment": "Malware payload", "value": "b150c75efc592604c0184b425c568f8e69c0b4cf", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901388, "uuid": "b7c86ca5-fcb5-43ad-a1d7-15fb81c833b9", "comment": "Malware payload", "value": "52531749069dfbbd22584ab6a30cbfacbeff14a1b1ac7311bb5cce901dc64b1df91877773bb1464a5fe7c175641a8feb", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901388, "uuid": "99902d2a-b6f6-4e36-b9f1-d9d829cf6478", "value": "T14D41DE1817F94330D5B38E7A287AE3259672FD0ADE56CB9E1394541C6C56200E935F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901388, "uuid": "d8601fb3-9737-4273-9ad4-2db84f995c1a", "value": "24:8uVhelvDMyDtBZK80WgATWkp+/CWw+/pHrVU1RxdlMD4I0W5UdyD11p3e/lDxqvK:8uV0lwyDZR3JWh2xtIAyD114ZrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707901388, "uuid": "a7e7bcb6-e5d9-4ff7-834c-f1f0dbae7527", "value": 2030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707901388, "uuid": "5787fb27-9948-425b-aee1-aff04f0ecc99", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901388, "uuid": "d58e9eea-ef2b-41aa-8744-ae17f98ac7d7", "value": "JD Digital Marketing recruitment documents.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90cea81c-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1707915859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915859, "uuid": "9188a1b7-c80a-41be-b477-8e3b153e58a8", "comment": "Malware payload (Loki)", "value": "20a696e07e82e821352546b8f9185e9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915859, "uuid": "915e4032-233e-4bbf-bf27-0a72304927f6", "comment": "Malware payload (Loki)", "value": "e0f45f991af19ad7da6f4ddc80f9979dc5c3cf1b6e8166194727dcedba58a8a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915859, "uuid": "1175dbd2-eaab-419a-94a0-aea8dbf4b957", "comment": "Malware payload (Loki)", "value": "3a15b094c737c18ecfe72b59f3a5e825720ef508", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915859, "uuid": "b8459b56-a3db-47f1-b15d-2056f8a3ed16", "comment": "Malware payload (Loki)", "value": "bb4d868507be7057f3f9fccfd481cfc8f382146806746296f8c2ca5b67176879979bb5fb022a89926f97f9e0e2996fad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915859, "uuid": "f1319cdc-e770-47f5-808e-175f68a4c299", "value": "T133B412105324D27BD1AA5BFE645213C663F6533729C5EAABBF00248F4DB3B072726263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915859, "uuid": "e9b613da-2ec7-4726-a4fb-208988262e12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915859, "uuid": "274d5561-e92e-4ee9-9b85-1f9e081f221b", "value": "12288:UvceQ5vziqOUXh2EokPwKbscg514TZt1Uc0ys8+ET2OZFBQ7t:UvcriqhXh1HPbstInUBWBCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915859, "uuid": "c67c82eb-672f-4bbc-a6ab-a25d54774360", "value": 526848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915859, "uuid": "eecd94c9-b6d4-4fe0-a117-7883a0c36e49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915859, "uuid": "c7c864e0-8031-48aa-a68b-d689fae301a2", "value": "FedEx_AWB#530531132046.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffc98db-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707947426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947426, "uuid": "135e5d77-90c2-404e-8471-a9286fe6a6b7", "comment": "Malware payload", "value": "3df4d465e073c9df0fdd0de984067328", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947426, "uuid": "9ceb4161-3149-4ff7-bdc1-914585422e65", "comment": "Malware payload", "value": "e1e949d426bf8835a9569417a9b55ac48ba220878af101314552ecfccf03cab6", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947426, "uuid": "87207149-ac7a-4250-9819-b6614668e3c8", "comment": "Malware payload", "value": "3d3a49c8aec6e528e8ea65513bb2363549ed3ecd", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947426, "uuid": "4a799d85-5eb4-470b-96dd-a39b320feaf0", "comment": "Malware payload", "value": "39ca67758fe570729e20ac1b4268f8d7aedcbffb3e3d31a663564548923387778a6b32efc867fdf79f30036c6725ca6c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947426, "uuid": "95b25b8f-d38a-4e9e-9c7a-66a71ea38cc1", "value": "T139D4230BCACFE099FF604989173E921B59CC2825FB966073DFB512F2F951750632A8E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947426, "uuid": "9036c1a6-d189-4440-86fc-237fa877b107", "value": "12288:wCmXYOFGw8KH8UZPXRTyC3DC+7pqoawoDdTac+eLgvyT5kkDXAQETA:zoJFdB7b/e+7ooardTb90vytNXEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947426, "uuid": "5e660ad8-d71d-445c-ac73-cc19cb4ba000", "value": 648485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947426, "uuid": "0216671f-9422-4dc8-83d7-62caa5ae4877", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947426, "uuid": "724d2ba4-eb23-486f-82a1-0f1a3b2bb907", "value": "\u00c7ankaya \u00dcniversitesi, TEKL\u0130F 12.02.24.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4736f780-cb34-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707913588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913588, "uuid": "17c38500-4db6-4969-a814-4cf61af5c0eb", "comment": "Malware payload", "value": "433812b3b6219a808e36785d41cf642e", "object_relation": "md5", "Tag": [ { "name": "r10", "colour": "#E6E94F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913588, "uuid": "5ce0da00-a517-4e86-b22c-36f94e7515dc", "comment": "Malware payload", "value": "e25cf8f2e4e30d352f64639aea52bae867df7bfb2718075b2013bd203301176e", "object_relation": "sha256", "Tag": [ { "name": "r10", "colour": "#E6E94F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913588, "uuid": "174efd23-2cc0-420a-8866-1569f3dda853", "comment": "Malware payload", "value": "57549fdad3844ea1b5786a1930fa4e673b0942df", "object_relation": "sha1", "Tag": [ { "name": "r10", "colour": "#E6E94F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913588, "uuid": "373c9052-bd83-4773-81f0-cbea689325c3", "comment": "Malware payload", "value": "543a3bd191452a5000d4c4d3b30ceed831aca93dcb471ca5cde880410ac62c0799f1a3b7712e03368c0bc6ea052c0496", "object_relation": "sha3-384", "Tag": [ { "name": "r10", "colour": "#E6E94F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913588, "uuid": "0111b936-8c55-4708-a7d6-bb89d0acd2ef", "value": "T11CD423A433FA678B9BA3F32C9FEC9B2529D41284A9F48034775B71C5EF891505C089DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913588, "uuid": "521cadf1-eda3-4e6a-8cb3-5bbfebd369f4", "value": "12288:jcpvqECjJOn7uOIhOwg1Ui+PzzpQQ1EZli4M0b+E3NB3dY7c7ob2PPtLOi9GQr5c:jcpvqbjJ4uthOwK+JQQ1EZlQ2B/ob2Pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707913588, "uuid": "8152c10e-c8f1-4c2a-8966-d9490db5df99", "value": 649148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707913588, "uuid": "cb17113b-aef1-4347-8170-41d4c36f07d8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913588, "uuid": "6d06ea46-21e1-444e-8486-0e5b01e8ff73", "value": "n2024-02-13-SHV_Holdings-Contract_Proposal.r10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beff0656-cb3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707917655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917655, "uuid": "22a7d072-4d28-4db1-a6e4-35938ca2cead", "comment": "Malware payload (RemcosRAT)", "value": "5c53c1f482e63782670d5d0362b97e51", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917655, "uuid": "a8a22413-bb0d-4d78-b169-bd713b5c0760", "comment": "Malware payload (RemcosRAT)", "value": "e2d96f98cf23ad56d61a4d41848ce9024a9fae0de6037e95d8514debeffc5a68", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917655, "uuid": "d1e33da4-ab46-49d7-be04-a55f23685c36", "comment": "Malware payload (RemcosRAT)", "value": "ec6aac9a28d4770459cd5150737012ecb3300450", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917655, "uuid": "7abdbf82-47b8-44fb-aee0-a30e12467f07", "comment": "Malware payload (RemcosRAT)", "value": "cb73ab7911673e3cb5a176d1b08c4c0de25263becf7777a22ae9688f00c442d0fab16b82bf02ed3c859a90e46a5cab70", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917655, "uuid": "02058638-7bd9-4392-9fc9-882c3dee30ca", "value": "T1DBD42307F66213F9A94837131E1AE4C294506D3F4C4669C30FEAE63912356F2E4A7FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917655, "uuid": "05b785b6-2eff-4d43-b9b7-5f21d7cd95c9", "value": "12288:49jmKUL0GqqkJHQd651Qjp2DOL1HScxAPP96xvyBLaHyLy/CcZ:4Fmd0GIk65O12DOpHScxs9/VLLcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707917655, "uuid": "9b362d8b-aa3b-44ee-9aca-43cff14f5b2e", "value": 613620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707917655, "uuid": "65abed6e-9ccc-453d-9dd8-695d129b5706", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917655, "uuid": "31bd2a01-2583-4f31-9baa-eee89a425856", "value": "nIMG-Oferta-WAAA_46578358595875773775767377535fskygningers.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda57557-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707915961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915961, "uuid": "13502103-61d9-4513-a4c3-b45ed158e961", "comment": "Malware payload (Formbook)", "value": "cae47515a65d018da49a71d0dbb7959a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915961, "uuid": "d4138a15-0936-4343-9900-cacff114d3fa", "comment": "Malware payload (Formbook)", "value": "e2e69fc8667dc36900a0b3499e2084ce8066a6f0912ce44983cd92cb39361bc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915961, "uuid": "becbaaea-95ba-443e-b343-28a5275e885e", "comment": "Malware payload (Formbook)", "value": "54b43ad506d6d04c6d5afacc509e3dcbd12d836b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915961, "uuid": "92912e15-1d2d-481f-9789-8c64a3054705", "comment": "Malware payload (Formbook)", "value": "72e4e66048d63b69cc218d2684384e62b1534300a8e1647f029d4fe1f9af347fdf7079058b7db85d738ff5c48231a3a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915961, "uuid": "bfce3ed1-6b35-47b2-810a-845fba518666", "value": "T139E412002258B7BAC65957FE94E2168953B6637B23A3EF0AFF8024EE4C53707131D74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915961, "uuid": "c5213352-7c37-426c-a07e-10e5cc81f832", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915961, "uuid": "a7f1234b-5fb9-4a78-9894-5fb500ed6540", "value": "12288:4h0eQ5vziHejLBKzt0v9tM1QYpZomRpWdiyOX3w/Ovob4omxD3q:4h0rieL6qvHi/odiyOX3BvoeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915961, "uuid": "4002ff39-a1b5-497e-bd71-92f58d07b36b", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915961, "uuid": "7092206c-bb53-45de-ba62-ea69efe3d749", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915961, "uuid": "156f0a6f-a62f-41f9-ae68-d067e71d4728", "value": "FedEx_24021747701.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19536b4-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707947724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947724, "uuid": "963fe12c-771a-42cd-b55b-7e7982caf00e", "comment": "Malware payload (RedLineStealer)", "value": "1afeee697ee331cd3d6e8ed176735d9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947724, "uuid": "a0c7574a-a682-4b92-b9fd-d8a71b3b87dd", "comment": "Malware payload (RedLineStealer)", "value": "e36ddcdf83c38a6e9cdb09e3f4b179186074799a63ab1d783c63d6a29f3cd9d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947724, "uuid": "7c5ffa6c-0534-47d2-b940-f7db746e3fd8", "comment": "Malware payload (RedLineStealer)", "value": "ccd3babc01bf15f3914f38d2853828d2f948a438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947724, "uuid": "cbc9c6d9-947c-4dba-b68a-0846b82b3a8a", "comment": "Malware payload (RedLineStealer)", "value": "c97b3db72d9a210148ba87ae1a291b890d3de7ea59a2d2e2db644e1029057749422171dc4aa92112f5d3a6d835043fc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947724, "uuid": "b75921a2-c58d-49af-a655-332dfd8ac298", "value": "T10D94CF11B141C433FAD36A72A8D4C4745DB9F4304F6902D737C4A53DAB6ABF3A6382A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947724, "uuid": "f74bd12b-1d36-4215-8a8a-67b0513d5d30", "value": "f5b092552ec597635b0eec0dd811df92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947724, "uuid": "06fee2f7-2b73-438e-a669-83b09346e541", "value": "3072:NMcIDm0sCq3jmDIbnlOyv+GDEa22wjAhsAQuej924UNLx:qcIDm133jmenhDEMhcIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947724, "uuid": "a78dc544-c32f-454a-ab7b-c49b4825f051", "value": 446924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947724, "uuid": "4b9ed1f9-2755-4213-857c-a46fe2b7820c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947724, "uuid": "1cc4f6aa-46d5-4b38-a973-0a1de48f55a4", "value": "1afeee697ee331cd3d6e8ed176735d9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6402fb57-cb18-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707901611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901611, "uuid": "7a6d2174-1554-4f3b-b197-55da78c42460", "comment": "Malware payload (Mirai)", "value": "896775095cde29e1550398662de8cf8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901611, "uuid": "2241e11e-e4b1-427b-8d81-8470307f804b", "comment": "Malware payload (Mirai)", "value": "e535d7b38c2a09d389692503e62a34d52446cd8cd3ddac3a85e0ebd76df7b791", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901611, "uuid": "2533a80b-f4a1-47f4-9825-af8e48822a37", "comment": "Malware payload (Mirai)", "value": "bf7372387261d109c5443ac8b5d9d1faebb9c2a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707901611, "uuid": "9c404e48-743a-457b-80ab-c0fb7ce7600a", "comment": "Malware payload (Mirai)", "value": "8eadb3c4287e881656a859c9d05ccd651cbe02058554390f9a20795c95ca05cad7d38aaa6f9bd3f92c80c9a1e12bc74a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901611, "uuid": "ec01d7ea-9bbf-4679-8072-51941120f7ba", "value": "T105C2E020712E8370E271053FCAE98B639AA60B7CE0D876E764354BE03983A8D4D357E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901611, "uuid": "54a8bc4e-6ab7-4173-a822-7e82d08a51b5", "value": "768:iCGeaj3jnpGLwNc81Rh1a3dZ6XNLgI/hs3UozY:rhajLwocoRha6X+I/MzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707901611, "uuid": "27b06a6c-19a7-4f7b-a13b-bfea76c53e0e", "value": 26780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707901611, "uuid": "885bfafc-c4aa-44c8-9a5b-b825cfcca077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707901611, "uuid": "a8d0ad9c-d4ab-43ba-8e06-7e4eadccfc20", "value": "896775095cde29e1550398662de8cf8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d5a9e2-cb57-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707928915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707928915, "uuid": "86972933-2345-4611-9a4a-b95dd8a179de", "comment": "Malware payload (Formbook)", "value": "505103d52e7960ef145dcb886672daaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707928915, "uuid": "067c6db5-18db-4da6-9f07-556f124f9343", "comment": "Malware payload (Formbook)", "value": "e58c41cb6f52ea51c5a8945d096b0229d3b71a804fd8b3a6d3cdea374decec95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707928915, "uuid": "567af083-1746-4fac-ad94-98d119117f09", "comment": "Malware payload (Formbook)", "value": "abc357e0b0d1f3dab2a787a16eedf3b602ab9b03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707928915, "uuid": "adeb9e82-2cd1-46d5-ba37-cb6780809587", "comment": "Malware payload (Formbook)", "value": "bc714fb575b26665195252ac48ee9244173f6ab4c374d301ba1fc4eac28bb083e0d5201b34b17f8eddcfc9db3406ef0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707928915, "uuid": "9945e5bd-5d5e-4c73-a944-80ffc3211b42", "value": "T16315AD8397D59138E6BE3B7A727465A287B5BDF7D820DA0B1080F0DC7B323855D90A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707928915, "uuid": "49028252-d656-40af-a5f7-715a729abfdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707928915, "uuid": "0d422999-3576-413e-bd00-78febe894e08", "value": "12288:gFoKhU4W/qh9fuoDJure02Zgzcel/Ai4wGllh50elrQTy:GoKmz/Fodu2gzTl/kDzlrQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707928915, "uuid": "b4103ffc-89b1-43fc-9c65-bab0b822dcb1", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707928915, "uuid": "7b3ee93b-26e7-459c-a604-bf554f776261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707928915, "uuid": "bf3eb782-bdfa-41d1-8641-f2b88cb50c8f", "value": "nakliye belgesi pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96d52af-cb12-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707899231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707899231, "uuid": "99c6cdc9-7283-483a-9cfd-8474b961d1b6", "comment": "Malware payload (LummaStealer)", "value": "904e948ebb47e07e603bda9454937d6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707899231, "uuid": "221b9062-96a3-4988-a9f7-69fe1279c606", "comment": "Malware payload (LummaStealer)", "value": "e680b77b086f3132136092a5e9910f62fc1a48276c35739dfd4453594774a202", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707899231, "uuid": "b82214c1-f406-40f3-865a-9ee612109607", "comment": "Malware payload (LummaStealer)", "value": "c57283eff465d5aa3386cde36a6a7f1daf21d4ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707899231, "uuid": "9a9f1b24-e587-4771-8f3c-2f68907b331e", "comment": "Malware payload (LummaStealer)", "value": "a884c9070a9854dea60e93228c5c6cbefdb439444f1aff37ed03c4ca3702cf2eb87abd18c845a80abe7165796aae81d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707899231, "uuid": "557e921a-18fa-4f0a-a3a0-17d1eae29918", "value": "T17256237323A61189D5EACD3A8237BFE0B0F643BECF51687569C92AC12D135F49322917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707899231, "uuid": "d628c0c2-53f5-4775-8a85-3dc67616332b", "value": "c1adb2b33500df75883e17f0a5c33dad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707899231, "uuid": "0bedcc69-e579-441d-8931-2e19b3e3d979", "value": "98304:tHgopzYMTUbO/lHg02ONAMz83H6TXcP9E/VupeINrz+Yh6Qi47vcVBj:eqLjx2ONAi8XkS9MYSeaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707899231, "uuid": "ace9f9f7-c7b9-4699-a722-3a407d3a21ed", "value": 6258688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707899231, "uuid": "5cb19054-6f63-4d37-b706-ee69084d58d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707899231, "uuid": "ea34b038-596b-40e5-bd44-02d5fd4fe47f", "value": "SecuriteInfo.com.Trojan.PWS.Stealer.38511.29078.4933", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5acaa6db-cb15-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707900307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900307, "uuid": "a355bcc5-3a96-4f52-a454-770feaeaeb74", "comment": "Malware payload", "value": "1cef4895af813de334d132c8a8c4995a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900307, "uuid": "b835bf70-5544-4f0f-8aa6-d9a036e381b0", "comment": "Malware payload", "value": "e749d258ab856425335b85c2a15a7902541e896431fd05725b1c35dff7b89d10", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900307, "uuid": "aa5e56b5-fd0c-4d73-a605-d9fb7de2a8e7", "comment": "Malware payload", "value": "540629b7bd97ee548300c9390b740f3d77449fd2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707900307, "uuid": "619b6912-717d-49ce-bfd6-ad77b7a679a6", "comment": "Malware payload", "value": "3674b1928df0eaddf9461539b4d528b9502036da0f6296c2e53472c86cc80c8da47f20b2913557b2200f14c54d2d63fb", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900307, "uuid": "16ecae71-e03f-424f-9f34-dd939f4c8282", "value": "T1C84187445E4349B9277A4975937AD819F7FB4D2721B4F04BB65D9286CF3426C00E8E0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900307, "uuid": "eeaa18e9-3b76-464f-8004-9700401eb6cd", "value": "48:hnEkOHsMiTzVOB19oM9aIQxzsaoFiYuN6a:OVHaxO191aIQ1UFiY46a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707900307, "uuid": "8be221c8-3ef3-4d91-a471-d1cd4319db20", "value": 2004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707900307, "uuid": "b23c807b-775d-48b4-9c94-46958267a7de", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707900307, "uuid": "d28240bb-c474-478d-b0cd-738c9452bc1f", "value": "DOC20241.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fea22d9-cae8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707880988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707880988, "uuid": "9b374c1b-b1cd-442e-9ff7-146d95e0621a", "comment": "Malware payload", "value": "6f09c000d0927d051c658ca3ab7f1ba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707880988, "uuid": "a9caeda0-530f-466f-bc2a-f7df7a158554", "comment": "Malware payload", "value": "e8f17b452f74021b5251a084646034f48d2366a74ae2b62f5173b70005b8a716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707880988, "uuid": "7cc7c907-5f61-43f6-a311-76a17e4af894", "comment": "Malware payload", "value": "4fda4cad7bd4be4ec1bb175a6d1f08a35bcdfa72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707880988, "uuid": "29bd3650-16ae-4b20-ac30-58b7b7d9e92b", "comment": "Malware payload", "value": "b981ee6ce96f65aab11091b4984b7bb44acd347f164e1bbeb4cbb8f529335309336f3df4ea27f2ee8f15db254233b331", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707880988, "uuid": "607fb12e-8f64-4588-9ae3-2b79e323a00a", "value": "T144B4E0F2C58B49ADE85B5235023A5CAE8163AC66897536FF714E71A00EB33770833673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707880988, "uuid": "554d4c97-1abf-4fcd-b60a-62ce522c86cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707880988, "uuid": "96dcb4a0-eb77-4a25-a554-d7fe1e9c4186", "value": "6144:EZSQGz+QyloFA2Xx7bKt049PaVvnMKX9wsyObhVAWYYQTTDd0tdoJS1E9uEnJQ:ESyWlXZyIVvM9syiVAWYYQbdr9ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707880988, "uuid": "38ece204-5897-4fdd-b2e2-31592aa98e05", "value": 507392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707880988, "uuid": "db9fb071-e527-498d-975d-83c14bb2908a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707880988, "uuid": "834ff1d8-d023-4cfc-9fee-84fc7b9faaaf", "value": "SecuriteInfo.com.FileRepMalware.27314.6366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278be931-cb0a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707895496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895496, "uuid": "67134f99-f002-4a54-b90a-3c8f76e28b28", "comment": "Malware payload", "value": "23692e9e905328ad3c5dd2de8e259e52", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895496, "uuid": "8517082d-db2e-4743-babd-7a70b948e8d1", "comment": "Malware payload", "value": "eab6d377a098bda79f6fd32c89b15e9dee1c29981973e8221a13abe63d798006", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895496, "uuid": "698e32a3-8428-446a-8cc4-268f5bf811f0", "comment": "Malware payload", "value": "bdcd5bb9145ddefe14b022bc6a7adf04399fc0d4", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707895496, "uuid": "fa1c94c7-60e7-4c2d-a7d4-43435bf8580b", "comment": "Malware payload", "value": "f1b77ec36b25bb87f344fd61e55e0c757f14d3e0016236508c2be34838e704a608575f0cff7e38e573c76c9a1cf5cc51", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895496, "uuid": "4bbe8b76-a9d5-430d-9cf9-1fea9b58d589", "value": "T10AC40140FAC1CB0AE85507318EF35EDA5329FD829B524A4F311CB71E3DB07A55E2BA25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895496, "uuid": "1f19f451-76be-4bc5-a177-6138a87e5dff", "value": "12288:RTkLSEXMcbNedomzEDQa3bVClMIZ8GcQgcVnGKWk39UC4BmeO3:uSSMMednEDx3bV5GcwOi9F4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707895496, "uuid": "9481b1f1-efce-4e3f-a1ca-f8f2fe316bc9", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707895496, "uuid": "6270190e-5e7c-49b9-b046-be5f22e87458", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707895496, "uuid": "713ac3d6-7909-48df-a7df-9a5766d08a2f", "value": "SHREE GANESH BOOK SERVICES-347274.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edeb3f4-caf7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707887402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707887402, "uuid": "835b05d6-e61f-4976-adf9-6d3fdb220340", "comment": "Malware payload", "value": "597bf2fbcbe805b39fad3c2e05a0781e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707887402, "uuid": "06de9c8c-0d43-4a65-bfba-ee0058a538c3", "comment": "Malware payload", "value": "ec3b978d6d5f82ab8bf9c0d7b8e75468b79bd25b04fdc16fcf393dc5931b369c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707887402, "uuid": "32f94af8-64f1-46e7-9d2a-645867742219", "comment": "Malware payload", "value": "a8fcba34dc101fbd048b97f99b5229ad74dc5541", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707887402, "uuid": "80e1d19a-e74a-45d2-9a6b-d3f648531cb3", "comment": "Malware payload", "value": "9ec44a2a1d9930bfbfa78b2047e245f3c3b7b3ea09145ee237245abdb0a074ed4800216f4c196de630ce2e8ddc95bbe6", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707887402, "uuid": "9aec35b1-8e45-4774-99e4-4fae64aba201", "value": "T143B63344BBC020BAC6B583B097B5EBE36C37BC15DDD381EF31C8885849B16C15EBA691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707887402, "uuid": "3479c3e9-fad7-46eb-a9e1-491e5591af23", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707887402, "uuid": "fe616592-07f7-4766-987b-c55f0bb523fa", "value": "196608:g8vAR6eUAoaH4WJg73LMUumtQ8ubxhwAVQPuOOlAjM0CuXgVxTZeWLTHIUL+IAF:DvU5tH4Kg73LMAtQj9hwI4uFjVx5noM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707887402, "uuid": "19c759fe-04e3-46cb-ae6a-df9d68d27698", "value": 11325440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707887402, "uuid": "7cc0d555-a658-4d4c-9228-8b73619f3c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707887402, "uuid": "4e908cb5-41b5-4842-8d9c-f02a8b40580a", "value": "597bf2fbcbe805b39fad3c2e05a0781e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab8eff4-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707947417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947417, "uuid": "0c222c1b-7ac8-463d-b1be-d9412a11cc63", "comment": "Malware payload (Formbook)", "value": "94c6dfbb36fd9b1478757f2518b050f2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947417, "uuid": "c1101a0d-7ad6-4e2d-9da5-0e947a0bc1d5", "comment": "Malware payload (Formbook)", "value": "ec84179e77efc18934873272da7e35227aab097647376beb7c66dbab8c0374a1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947417, "uuid": "7a8acd38-9786-4293-b526-8b1e7c1e07a6", "comment": "Malware payload (Formbook)", "value": "3efee6ed631028ab22851412c1effa9264f0e453", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947417, "uuid": "27f9686b-2165-4787-b588-e753622bb7ec", "comment": "Malware payload (Formbook)", "value": "d862229d0d55f53222a83d2aecc018a16995552f2fcbb96b6463a30b1c8e7fe3761d26f49b0accb38b13ba0b6aa23d67", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947417, "uuid": "9644ab53-9946-4be1-be8d-3d47e6348e49", "value": "T15CE42374922E8A8331FC759EE7C3AC831D36ED229E97CF131B8C0AD7E48BD89A511455", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947417, "uuid": "de466171-4320-4e38-b6ba-0c82a49fea6f", "value": "12288:xiSWI8yJpGDHiBNdd8U9V9hyjkhol8f5BYxGGqGpqX3HynJfx:xi/M6iBNXBr9hekSOAqIQ3Hyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947417, "uuid": "cb974e19-ac50-494a-84ce-77e4e9d448d0", "value": 680694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947417, "uuid": "aa3a5c4d-eb55-44e1-8da0-587c27cd5857", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947417, "uuid": "915b443f-1445-426b-910b-68475d822af6", "value": "103_1000RT0382400029_2034090349_1.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4065c9-cb47-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707922004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707922004, "uuid": "5b76c614-cedd-454a-94d3-4a1f0870d078", "comment": "Malware payload (Formbook)", "value": "d946626f35a62bbb02e723e4907479f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707922004, "uuid": "9caec2fe-480f-4cee-b319-702c705e9b4a", "comment": "Malware payload (Formbook)", "value": "eeb1fce56ba04e5475ba75483f37f7d036a528c30d6ef143bedf3d79f565935c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707922004, "uuid": "77077456-52cc-4ce2-8894-11ea35d376d5", "comment": "Malware payload (Formbook)", "value": "bc49b1a993d804c633d6910365f29418a0bd7bd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707922004, "uuid": "584290d2-71b2-4fc8-a402-c8a4df2ae851", "comment": "Malware payload (Formbook)", "value": "2ad5231fd384f7ec7fcc788d0c0f564fd50880818e28e79b26af3c6fd2d87c143ba9798146469df5a1ad00c3313b7553", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707922004, "uuid": "a44005b6-7e47-4ffd-a528-e237ffcb2712", "value": "T1A8233A01B3E84732E9EF1FB768B691044371F3A67803E64E11D562954D73B908AE37AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707922004, "uuid": "6937f20b-df60-40ff-bfaf-4cacfebd7a06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707922004, "uuid": "87e28d90-7154-4fac-8799-809988893b6f", "value": "768:b54k6uSlTBBM/gyMh71GtP859krIhIC2ouZsLbVfkidWo:b54ySW/gDh5gT+I7AVfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707922004, "uuid": "ca71139d-d28e-4e79-b1e7-fa3507d912d6", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707922004, "uuid": "28410255-e197-4a31-a61e-de914560103d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707922004, "uuid": "ed8307b1-5001-424f-935d-40257199138e", "value": "2024-09C33T37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90727e23-cafe-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707890518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890518, "uuid": "e2a29092-8dd4-45b9-9d42-d0a4fa0c81c1", "comment": "Malware payload", "value": "6f155dcbdfdd33d8661dff9506e916be", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890518, "uuid": "53571b74-3523-4a4f-8bb4-98d6bd542857", "comment": "Malware payload", "value": "ef7dae1bf970dbaaf5379a09d6f3ce292016e59becf784976dab6ac9bc77e455", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890518, "uuid": "c32d0934-1545-4030-8543-9e5c7b092c1a", "comment": "Malware payload", "value": "f16bb8892481382aeb8e8c7e82e728c2f4af7df1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707890518, "uuid": "7cb7000e-ad18-430a-a5ef-fbe0959018e7", "comment": "Malware payload", "value": "443d9a9bd4a8b1249d60704309b14fa12cc52ab8ee3b59ab9b98cbc991a3573763fb741658121b697bdb05e06d6fafa7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890518, "uuid": "058f275c-3a25-4bcd-8c64-826434ad7109", "value": "T1E113F16D676ED420D68EA3BFA5B663719F38BFD01E69A5D1102183C39751B02C8B0D23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890518, "uuid": "268d9be3-e073-410f-b85e-cfbea476cf6f", "value": "768:+IFCLivNzQ8ZJ7caBzb51vgg/75KpV6lO4c0Wrf3wIWk5OTSbMT/A7XRPX:+I2x8fwaJb598MDc0Qf38k5SSbsQR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707890518, "uuid": "ae79938c-68ff-4d92-8352-dbad00f5d03f", "value": 44528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707890518, "uuid": "96394fa3-7a70-45c8-9479-6d2e2119de31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707890518, "uuid": "cc7a1f97-c66e-4585-9b54-728d1db70d05", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f461335f-cb3f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707918603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918603, "uuid": "156cd707-9ea0-4398-8e28-d9aa9f0324da", "comment": "Malware payload (Mirai)", "value": "5c9134cf9ac17ec5a867703188937097", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918603, "uuid": "b3532e9d-eb31-497c-b522-0ad42afed2a3", "comment": "Malware payload (Mirai)", "value": "f1df43b22d1a97fe97cc98ee1357b702d4ae45284aa7106121205b406885fc23", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918603, "uuid": "be3a785a-b048-4421-981c-a912ecfd6d2b", "comment": "Malware payload (Mirai)", "value": "0808c0a1e1b5d0e592f072c275a5d2862a6640ff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707918603, "uuid": "6c1bb570-9d99-4b87-9574-a06e7e2bb287", "comment": "Malware payload (Mirai)", "value": "6deb69eaf20a75f5c6697a484bfe4739658e559de7c83bd83240fc65ed139c4281c0b5960fa158aae030d7ca6d92844f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918603, "uuid": "9379f8a9-a18c-485e-adf8-ac6fd86305b5", "value": "T12A53192B2A91C83FC59B12F51AE7E661D823B83D1B7354477394BE2DAF368C41C1931A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918603, "uuid": "879b4b2d-070d-4dd3-a03a-3d457dc756e6", "value": "1536:i8yrkbJC05nNC+hXf+MqB0zGHQ8JWzx5Esl:FbJ/N+AG3WAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707918603, "uuid": "40648815-e351-45dc-a39d-dd25f3e78ae2", "value": 63278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707918603, "uuid": "839fe601-396c-4cf0-a5f3-131f491f7a74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707918603, "uuid": "3c879b20-4129-44e6-88df-60749d8e96d4", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa13bd3-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707915849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915849, "uuid": "fa553ddd-efe9-48d8-86a7-abcb2610fb3a", "comment": "Malware payload (Formbook)", "value": "16ab204c82a3ce0f4c63686aab6b695f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915849, "uuid": "53b1486a-1cdd-4134-a3ef-691c43fb8a80", "comment": "Malware payload (Formbook)", "value": "f22b47c47fa760c17cb3d6bfe7b034a6aeaa8258469d711b7e04c9e938b64e1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915849, "uuid": "c8235d7c-dcc1-43be-a5e4-1c5c03dc0918", "comment": "Malware payload (Formbook)", "value": "0f47c5d8a12022e52a2862f9c6debc87aa898d77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915849, "uuid": "5047fa1e-040b-4259-b71c-dbbbdb69cb0b", "comment": "Malware payload (Formbook)", "value": "726b1042fea937a9062e5f3bec044f230ca35ad972eeec2ff57cc336eb0c52c28ce6bab63d44f4d956d0f851962ebfda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915849, "uuid": "c6250685-78d9-4d91-9d74-190b893037cf", "value": "T1EFD4135133BAAF10C8BE57FF9621009153F8AA573683F3B50D8972D919223529F52BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915849, "uuid": "e4d5277f-fd23-4b04-aca2-a0208614733f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915849, "uuid": "64b6085e-6699-4aff-bbde-d8607f13a59c", "value": "12288:WSBEkmXAUrHARCD9o6+0wf71gdXNEJBx0HSqjT/1x2iNQ:WiEkm9rHARsozt71ccYSqjTdx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915849, "uuid": "eb3aa797-cdca-4299-bd0d-26a405ed7b86", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915849, "uuid": "f8b63e68-ecc6-4c54-82cc-2f64d7a7c07e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915849, "uuid": "a7dac631-3b5f-4aac-a714-0bead008da36", "value": "\u0111\u01a1n h\u00e0ng m\u1edbi pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f25aec1-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707947425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947425, "uuid": "65adc4a4-3f63-4f49-9580-8ea898781dce", "comment": "Malware payload (AgentTesla)", "value": "66469c7a7dd603a5910183207c000503", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947425, "uuid": "05d8ca71-034d-4e7a-bd4c-5301d4705ae4", "comment": "Malware payload (AgentTesla)", "value": "f29ca51ab4f94de1be168737174063f7fb8540543160478c64bef4ba611b0e14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947425, "uuid": "44b1ebb9-7717-4704-88a5-18f2cc8e366f", "comment": "Malware payload (AgentTesla)", "value": "c97d702a6c01b2dbfeba714d902d1b0bdcf914d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947425, "uuid": "7a419373-bd26-4849-9a90-b3807fe66b4b", "comment": "Malware payload (AgentTesla)", "value": "03ff6f97000ab16ff77f1b0cfb968ea8251b3e1315545aae7819f1ad74b8a526a1f4ffeefeb80fd57c96a318e43d8004", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947425, "uuid": "0ccbbc4a-98b9-4ac6-82f1-f7723bf4a629", "value": "T1B8E423903394D77BC17E0BBEB7E088505733215A2A01DB1E6E9234EE99B335E4522DDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947425, "uuid": "9798395c-cea2-40ea-8e89-ebe3adc25271", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947425, "uuid": "e37d42ae-d9fc-4423-adf3-5c848a047b6e", "value": "12288:5B/ZeQ5vzikZSFJuWe9ZM4ECgkS6tMdDEGSobtlZI/tYHO:9rikRXvx7gvDX1b0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947425, "uuid": "9b283c36-ad03-4f86-9763-00d0241abbfe", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947425, "uuid": "0a80d724-0752-423f-982b-982494e44572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947425, "uuid": "56921d0e-c0f6-4120-a273-f439bcabece8", "value": "\u00c7ankaya \u00dcniversitesi, TEKL\u0130F 12.02.24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0497df5-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707915939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915939, "uuid": "68c70cf8-587a-4758-8063-fbe5438d15e2", "comment": "Malware payload (Formbook)", "value": "97807eec3095d1f53b3e082310644359", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915939, "uuid": "6a3e89b3-2d31-4155-9cf2-1a076a8c45cf", "comment": "Malware payload (Formbook)", "value": "f364037856ba668a59ccec86771c5f35e45d007192c79f63d83fec463f9d1ffe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915939, "uuid": "cae5877c-828b-4cba-8fcc-cc4d1e289786", "comment": "Malware payload (Formbook)", "value": "c19ad000cf80dc9abac46314de7dc58c76603d7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915939, "uuid": "6cf5478d-9e09-4e31-a774-0bce18928d9f", "comment": "Malware payload (Formbook)", "value": "4ffa3f0c3c0c6500eb5e457a574f3e351e089d1766c89a36e7201dedda31c8bebde5312b0b8fbcd562c6a96b93c1da25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915939, "uuid": "c7297545-ebb5-43e9-bb40-607b49d1ab8c", "value": "T1B1D4122662B80B59D1BF87FA8A31180143F9F502194BF7E90DD460EE5A267538F63F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915939, "uuid": "0f79ebbb-bdca-4680-a6c4-304b60443f83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915939, "uuid": "4f445bd9-b470-489d-89f1-4af80934d39c", "value": "12288:HDBESOGuqSV0DdX8zuiUdq7D4Ci4cIEh2J8N+sZccWuXMrUFRlbnsd5S51BU2iNi:HtEvZq1KzuuD4FFIEhgyccWHwRZu56nm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915939, "uuid": "cff83f1d-d6bc-4348-a5d6-7ade9a429b95", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915939, "uuid": "5a014a98-257d-4f8e-993f-f296184a34a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915939, "uuid": "25579f5d-2d5d-4b46-9ea4-d773dfdb9e53", "value": "Scan_InfoDoc_PO2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6a0f45-cb34-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707913602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913602, "uuid": "42138a43-564e-4920-833c-c39f4a74bcf6", "comment": "Malware payload", "value": "acfe350dce2aafe85c835cdbbf7f5e95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913602, "uuid": "454ed111-4e72-46e6-be65-8e13940f3f18", "comment": "Malware payload", "value": "f3c7eadcb4f33542faae5f0640201d8c11df0121b9baf26320f2bc4ca2a8ae0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913602, "uuid": "bbaa65e6-e5e6-4fdb-a95f-b6e6da49ed1c", "comment": "Malware payload", "value": "3af1ab824c6b5c6fff5195e12be8ec012297f7fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913602, "uuid": "2556a585-0919-42ce-90e5-02187219f3c3", "comment": "Malware payload", "value": "48ba5aa724a9bdfcbd51542cfbd08169eea5c32d313ddfc23718828159aaff0d3f41fb1bdef535426ab15a09773b917e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913602, "uuid": "1840f9d5-4800-4142-b02d-494835702c34", "value": "T166E4122033EA124CC95487381D7A81C613B66A6B7E44CB5D7C69366CCD727638B22AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913602, "uuid": "c60aba3f-6c14-4a69-b122-bd47d3d6ddf5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913602, "uuid": "4cbba6dd-aadb-4d9d-a4a0-b81ef61c2c25", "value": "12288:4YLeQ5vzi0MTTEGhwbNfWuxvXFIs6FcAVNHMJhjB96QJJfnKRxZwH:xri0yvhwbNeux/ys6+ALELXnqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707913602, "uuid": "3ff8e5a7-3229-4361-9015-2bca82a2c974", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707913602, "uuid": "a9ae5fed-f051-44e2-aae2-1d6cf81159b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913602, "uuid": "f111d767-f29a-4a42-b9d6-f935ab728244", "value": "rNCaukpK3Tw9M9Vl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c538b701-cb7d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707945153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707945153, "uuid": "9114ffa6-2127-40cb-b012-f85dc2b5446a", "comment": "Malware payload", "value": "b6c6f8f29d7b4a06b4b206f81f03e139", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707945153, "uuid": "0c05dea5-938b-468c-8f2a-ea74a996bb0c", "comment": "Malware payload", "value": "f67e4bf479953e933376bcce241dd1eb6fe0700718a051466e15a7826cd1360b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707945153, "uuid": "fb0399f2-273e-4606-83f4-7ce2bf7eef69", "comment": "Malware payload", "value": "8fdfa76932ff6c78875ef6e5acb2f44eff3db25a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707945153, "uuid": "1f6a57dc-64f3-4c2c-b2b9-104c2134b77b", "comment": "Malware payload", "value": "7ac6a9ae0e9c29d65e56174ca865c2abf31a6466416da7e60d756888fe7ad9d80cd54e876e3c339c8b8c81ecc78afe5b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707945153, "uuid": "4e005255-69c4-409f-981e-fe93dd1c23f1", "value": "T11F01D34CDA1DC2F9217123DEDA29C790C9E728BE351DFD730349D4D484990654994D6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707945153, "uuid": "449bebb2-07ad-4a69-b636-3c5d68294851", "value": "12:b7MmseFYB9kIAiJ0G5opN0HpVPPCxMEgt4WbURBBRdQBnlNdeqStev:DIAiaG5opNkPAFwfsnQBn9Aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707945153, "uuid": "6c22c142-c62c-4c64-8d98-d42bea6256b5", "value": 669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707945153, "uuid": "bf370759-1915-4b87-b600-1b722e1c1cc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707945153, "uuid": "bac56ff1-bb5d-4ec1-83e3-5ae65c017d5e", "value": "1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67a2892-cb77-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707942578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707942578, "uuid": "aa122963-e401-4e5f-90aa-2225bd4acd09", "comment": "Malware payload", "value": "d437708b5ea038b1ca31c729635ba966", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false }, { "name": "UNIAPT", "colour": "#B39AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707942578, "uuid": "0246c1f2-1206-4305-a530-e0088b6d9c73", "comment": "Malware payload", "value": "f6eb315ec598c33da6bb1302eba8d8122e8b669d733d1339a2d01364cf1ca630", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false }, { "name": "UNIAPT", "colour": "#B39AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707942578, "uuid": "1064eae9-deb9-4da8-84b6-2fa1a60005b1", "comment": "Malware payload", "value": "08dce48878c171e85c37b23ca1b1c5df6ddf7cd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false }, { "name": "UNIAPT", "colour": "#B39AF8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707942578, "uuid": "78db2953-69b4-423e-a54d-373f931c3f50", "comment": "Malware payload", "value": "c43a94f040bbe187e10306a737021ac1f9073ba0870f6019700cec1ffd5f41e15222c689224ba0e7e13e39b66a0321eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false }, { "name": "UNIAPT", "colour": "#B39AF8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707942578, "uuid": "7f59b315-f688-4223-b2b9-18a1c8549889", "value": "T1230833BB2FE1C0B7C229B5B9A5D53028C6C278F6773323D6A94808DD7EE7F250948594", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707942578, "uuid": "ed419fda-abce-4aa6-95cf-9ec229be16e0", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707942578, "uuid": "015f30e3-a0cd-4998-882d-2c9f3c8dcb6a", "value": "1572864:9q+e4h7/tXtlgv4Ok+MK336DKW1j4GDnz26eSGyENu2REomzB5hY1ofS:97e4Tngvxk+MK336714GDz26tGyGBRES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707942578, "uuid": "abd78e89-e3e6-475b-aaee-127ebf9cfa9d", "value": 81776943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707942578, "uuid": "043ea38c-c631-4016-bd3f-5bee7378c1a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707942578, "uuid": "5edb9f78-2b49-47b7-a7e8-93b7a5cc6c86", "value": "Uniapt Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7e548c-cb34-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707913621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913621, "uuid": "3b54a660-43ac-4e25-89ae-3f5dac8d3298", "comment": "Malware payload (AgentTesla)", "value": "709877bfb33bc59716b0d09c79dfa7ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913621, "uuid": "19fad4eb-8f56-4313-8bb0-13547cf0faa3", "comment": "Malware payload (AgentTesla)", "value": "f75d0156599da4c4b6b083ca393904458e7aa85a131453189a47b446841f87dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913621, "uuid": "f5c3f8ef-3e0f-4b0f-9bf8-8eadae2fcce2", "comment": "Malware payload (AgentTesla)", "value": "d911bfe4403c5a7464ea756ffb02b757959555e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707913621, "uuid": "aea2e040-dcce-4a1c-b16e-e8ccb264dd81", "comment": "Malware payload (AgentTesla)", "value": "47387824d398b5afbe0e5cada4b71aace0418c61fc74210d0fbfffa8e50ff82ea145b6fe73143ec69bfee2d70d9b7fc1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913621, "uuid": "b75f691a-f2e7-4dea-ab6a-8da707384755", "value": "T188F412A633F5C82BD96F5ABA203060D0A7B511D63C61EBCD4D9863BC09A7F675348723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913621, "uuid": "d1fbcc04-ecbc-40c1-ad25-cc4145a50090", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913621, "uuid": "6e782720-7b81-480e-bd86-6cdd0373c5e9", "value": "12288:FQfpzN6bUGjyCNWYzLrI8BskdLho3AC5+AOHtxXBKy8vcLH3JIlUCQg/TvSCtKmL:yfpEIGjySLI8BndLaQC5CN1BKy80LXqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707913621, "uuid": "93557378-e220-4459-b06d-3f8715d4837d", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707913621, "uuid": "33a13011-4aa1-4491-a528-5efbef9f2c67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707913621, "uuid": "3cdd9f9f-ad03-4bd9-90de-7b4cb67ebc52", "value": "rV57CmvoRfFlOL6s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1610c5e5-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707915653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915653, "uuid": "120a61aa-07fb-4117-8d2e-c98a462a2a64", "comment": "Malware payload (AgentTesla)", "value": "be65874b56cef22e357e8209fabb7421", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915653, "uuid": "dccb6d95-1999-4870-9313-1950a23c19fc", "comment": "Malware payload (AgentTesla)", "value": "f7d82a5fcd1482f720716ce7fd1549f26f297059d3b417a9fdec7e731d16f4ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915653, "uuid": "56e6250b-ada3-4963-a890-699a246bad8e", "comment": "Malware payload (AgentTesla)", "value": "27098f84c75ccbfa71e1e01c896f32e5e1a1346d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915653, "uuid": "9ad49f1e-671b-4f18-b752-90daf02e948a", "comment": "Malware payload (AgentTesla)", "value": "49bc9bb71ea7b36ef2f6b172d1bf7228ae18864c43d5645a38d42d759d484341a578d585f2115e7e9fa346c2365ec298", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915653, "uuid": "38d0d73c-be60-46e4-a862-156bbfe3cccb", "value": "T166050181B65184AACC1A43B21531D8B057373DAE6A70D78C7DCE3E7B3EBB7924602563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915653, "uuid": "7df497ac-8dbd-4aa6-9f45-1b487b245be6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915653, "uuid": "aa156b99-5827-403f-84e9-9586d631b08f", "value": "24576:6spE1GT3x8ZxbbLc6I0Ofl9wJTF5r5df+bjKAi9GXXU:6sui3efbbLcsX9dfOK998", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915653, "uuid": "15c8baad-f51a-4760-bf6c-6a075c41a2fe", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915653, "uuid": "efec1364-5920-410e-baaf-af135ac1eda4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915653, "uuid": "ef259bc1-7306-4ee0-9038-faab57f4ff9f", "value": "DHL Shipment Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb320e6-cb1d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707903771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903771, "uuid": "8c499d2a-027c-406d-9206-3a021aaa99d3", "comment": "Malware payload (Formbook)", "value": "31e9b0d426d2beb0fec2f68a9e221b25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903771, "uuid": "c1118ed8-dfc6-4b27-9c83-cdd4aadbdca3", "comment": "Malware payload (Formbook)", "value": "f8b02f2dc9ac4da01631f64237e70b3db518159276ede799d8cea2800e8c041f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903771, "uuid": "c5281f6b-4aa6-4c91-994d-2872861a9011", "comment": "Malware payload (Formbook)", "value": "976d457d0e5a8225f64ce765861439177aa753e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707903771, "uuid": "3a8805ca-a933-4803-947f-59319678c960", "comment": "Malware payload (Formbook)", "value": "fab3e76e6eb2c7a90e9b65a54f448209b653b850a8ca28e3cee7a54d92a68ef27504c095180174bcb754595d22cc1237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903771, "uuid": "c04321a0-223d-4590-a7c3-02f8e454b86b", "value": "T128F4234533EA84AFC9AF17FB5820A08187B425893D72D7CD2EE4129D0FE6BA70319757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903771, "uuid": "dbf404ad-3bf4-4cc9-9f06-250a7a36c151", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903771, "uuid": "b49ba731-fb1e-454f-8412-cf9857f629a2", "value": "12288:3uxpzN63y6GPmipc8BZXbMFpj3aPyVxfzcE5qq2geqAan0emqepTv:expEC6kywZXYjKPwxbcFqH0eGT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707903771, "uuid": "a2454b78-68a9-4c32-a70c-9f55a5581e79", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707903771, "uuid": "c33f830a-c465-4850-9eb1-0fcabc23caab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707903771, "uuid": "65b17152-004d-48e4-9e2b-5b7fef55d650", "value": "DHL_AWB#6078538091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e53e2d5-cb83-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707947423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947423, "uuid": "27efd27f-95ec-487b-8018-c868f0e51baa", "comment": "Malware payload (AgentTesla)", "value": "bac34ccb6b4ec2ac7f39c88f17d7a308", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947423, "uuid": "315d664f-9c45-42ab-98e3-c69f060fa2c8", "comment": "Malware payload (AgentTesla)", "value": "f9e68849fd51860a30fd1bcf906536ed4385df924f4f40d1faf58b0aa3dcc2f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947423, "uuid": "f6bd5512-319a-410c-8f4b-667ed72d34a8", "comment": "Malware payload (AgentTesla)", "value": "26f53ec25df750155b0d9213e8286fc99c736151", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707947423, "uuid": "7bd872fb-3fd8-4f08-aa21-beb8b3e71026", "comment": "Malware payload (AgentTesla)", "value": "978009486c401060c75f3e23920a9a9193d94a38df3f2f8dacd51080e987dda3fa827f806226cbb3cff72001d321156b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947423, "uuid": "cf4dd85f-960b-4405-b889-2f5cccb9a645", "value": "T132F40202B2F85F23DA7C97F82A2556454FFA398B6456E28D4CD720DE66A4F804E41F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947423, "uuid": "ae94f724-66c4-4420-b426-80a99c5d256c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947423, "uuid": "5c3ae90a-23d2-4b21-b544-026697b73450", "value": "12288:5Sq2WkzqHKMbTX6/Juu/0ImaOBH4AQ49tVwTNQpeXw+TU2qeGB5FPcuz+DYH2:5OVz87bTq/MK0I6BH4AQ49nQNXw+TU2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707947423, "uuid": "13e6d23c-53bc-4e91-95fb-dee24a4c76f3", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707947423, "uuid": "4b019f02-dde5-4999-8685-e9731ab0cdd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707947423, "uuid": "02b26363-3bb4-4ed8-a119-faf3b70a5880", "value": "5NgCxt4S4obgjTy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefd1b0f-cb24-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707906944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707906944, "uuid": "7327027c-5e6b-4eab-831c-df1b3634d33d", "comment": "Malware payload (AgentTesla)", "value": "a9b9e3276053f7b74cfc5818d457ade5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707906944, "uuid": "6e972bc7-6551-4878-b921-ca946cb1e5a3", "comment": "Malware payload (AgentTesla)", "value": "fbce4f9307bc7a24373da238ae5ecac473463bd9ae41e34b8fe8c68dc5750ff6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707906944, "uuid": "17292812-b384-46ae-a3dd-d10ec4b9a35c", "comment": "Malware payload (AgentTesla)", "value": "3f7727c6b1b30e33a4124cc716884f2e6cf5cafc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707906944, "uuid": "32af2429-3ca1-40a3-9682-61a322ab4944", "comment": "Malware payload (AgentTesla)", "value": "5ddff077afd898f4757f2bfab00d14b754cc66c676128418e7ab1194bd3ab624762991e4c2e0c403a14791955a7fe41e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707906944, "uuid": "20f82d3a-0ae9-44cd-aaea-54af0ac212b5", "value": "T1C3D4238D57F4EF13C18A07B20D7EE0C0DB693ECA7991EB9E469999DA1F2538413909C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707906944, "uuid": "137f876f-5711-4428-b4e7-ba4096a474ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707906944, "uuid": "9c604c93-df20-491b-a907-2feeadb2f218", "value": "12288:FzN/5Ctp8OjQ/Fn555h5Df5o6hHx/pO6+K/O7ZfoydbhS71UXzWp:FTCf8CgFnFDT5o6hJpf1G7+ydbhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707906944, "uuid": "5d47ca7a-b134-4f37-9302-4f78b1f36af5", "value": 627200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707906944, "uuid": "e0d10a35-4112-404d-8d58-1b26b41f7908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707906944, "uuid": "78ec2214-3ad4-4410-8c7b-8a4fded1c5c7", "value": "SecuriteInfo.com.Win32.PWSX-gen.763.2248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8065d4c-cb04-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707893189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893189, "uuid": "6a1e949d-7cb9-43e7-b8bb-1ca1d520f622", "comment": "Malware payload (Mirai)", "value": "4be0b8fafdd15efd508a4a3efa38d20b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893189, "uuid": "6b7fb6a3-2901-41f6-a552-deae2e8b3e05", "comment": "Malware payload (Mirai)", "value": "fc466a0e075340f3e9622cad9280a6025b48b51f57d4668edaaa1494ee2b0c4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893189, "uuid": "48292d02-40cd-4502-9d1e-b43b9fefc633", "comment": "Malware payload (Mirai)", "value": "0ce85fd16e5992f0de9d2b06a27dc5eda77ef7ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707893189, "uuid": "98e24e3c-ea35-4604-b004-83bdfcbee897", "comment": "Malware payload (Mirai)", "value": "07765b198216f50ca42bcd767c8df1484f112ef872ca482772f122a152ce77f72ebc8bfc3ae424d9317492486a3c9970", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893189, "uuid": "db7d4bbc-d35d-4835-8c12-20e34c7565dc", "value": "T15E53A65A6D128FACFB5D873147B78E21AA5837D637D1C641E26CDA002E7034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893189, "uuid": "c57763de-0b77-443a-9ebf-e4fd5f9c696f", "value": "768:LK11B+Aje4WYh4WlNJJFc3KH4MkGcl+5uCY0SmvEEt0MSdOy5nTw9K:ui4t42FcURYkQjdOcncA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707893189, "uuid": "9d8dbafa-e32b-4083-b5ca-83e178389156", "value": 63732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707893189, "uuid": "1fabf892-46a9-4a80-809a-c9cd6e7ca17f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707893189, "uuid": "3856b29f-01e6-472d-a578-0c19e5be109c", "value": "4be0b8fafdd15efd508a4a3efa38d20b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba94788d-cb38-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707915500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915500, "uuid": "e814ff02-d228-4ad5-b812-0cf5eed45b5b", "comment": "Malware payload (AgentTesla)", "value": "d1b2e30fa3a39e439f278603b6e5dd1e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915500, "uuid": "ee9696c6-2471-4d33-903f-4638532df828", "comment": "Malware payload (AgentTesla)", "value": "fc6d35f4452a755df065a169caaecd0bbcfe785da7f9cf4fb6bc195376ac1768", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915500, "uuid": "427e2695-e40a-40a6-aab7-8f7ae6e052b1", "comment": "Malware payload (AgentTesla)", "value": "570d6409ab85430f7329158a5c0f835e7917e01a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915500, "uuid": "1cd2afa4-845e-4400-86b4-46177bd5765d", "comment": "Malware payload (AgentTesla)", "value": "2a2426ca4059f5df7a5b4331ed2896b624bd93d233ac8c14d202cea0054e91a05f3b6a2b741cf471117d8eb0d9a9f464", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915500, "uuid": "bfe59e97-2afa-424b-8ed2-b6b99259d1cb", "value": "T14973C22DD34B02598F520377AB1B1E5142BDBA7EF39552B1306C533933EAC39A1252BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915500, "uuid": "6008c7db-ea4d-42b0-a582-8e2502ad757c", "value": "768:9wAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjZaT6JeYwM8pVnUgMEWi:9wAlRkwAlRkwAlR+mYrUn7ME/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915500, "uuid": "70343169-17f3-4944-b05b-ddfc883ed04b", "value": 78508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915500, "uuid": "f2767f1b-8e71-4ac1-a435-d00de1152c9e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915500, "uuid": "428913a5-1e33-43a3-bd6e-ee7cc7f308ba", "value": "Approved Quotation.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd33dedd-cb39-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707915934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915934, "uuid": "1c2ee6be-80e3-4463-95fb-2e84635db949", "comment": "Malware payload (AgentTesla)", "value": "d6a2dcc723915b657a3285154bb7124b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915934, "uuid": "5fa0ff1f-9d59-4aa6-956d-3d6de57664c7", "comment": "Malware payload (AgentTesla)", "value": "fcb91d1cf9fced1a4f371128695136e668b311768dd02ef0b3ffa051eb396af8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915934, "uuid": "c6d8de2b-e119-497f-8f65-b24b4b9128f6", "comment": "Malware payload (AgentTesla)", "value": "bea457ad6cea2ec7a1e2a334447c4982a54f9183", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707915934, "uuid": "8bad3e17-a253-4fd6-ba8b-edcdac59dbda", "comment": "Malware payload (AgentTesla)", "value": "88b766b399782afafea05a8ed12aad8cb8de94f7bc74fabd7a0929018669f84d887ce0ee40f7cac4d8d1b40195bcdd1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915934, "uuid": "ccb9511e-2740-4d94-affb-65cdc9e72e95", "value": "T1C5D423187FB46212E7F6437A82E13DA0437DD66375B2EF6C9FC0609079E274A84E1827", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915934, "uuid": "b512bf67-4e4f-452e-ae1a-4ee752ada7c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915934, "uuid": "bf05a191-04bd-4fa2-9f12-521424c382f4", "value": "12288:aetvVc0SyqhGMrBd5/yDMa9EK1jLwMnH4JemuczN:aer0X1j5/aJ1jLLH4gpc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707915934, "uuid": "87c03853-36d6-4b1f-ab53-7bce35179f34", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707915934, "uuid": "39b08efa-ee3e-4d49-97c7-cf7f7b05079b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707915934, "uuid": "1f97f1f9-cd96-49a3-ad4b-fc669402fd0e", "value": "CV Mariana Alvarez.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a59cf8-cb3d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707917664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917664, "uuid": "eb297dd1-ee11-4069-92a3-1f6efe494c4b", "comment": "Malware payload (AgentTesla)", "value": "df002408052ba99c32a285d95c956e0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917664, "uuid": "5461e3b6-825d-4474-bbe8-179fd1fb7b6e", "comment": "Malware payload (AgentTesla)", "value": "fea91ebbc0a6bbc20539bfaa10af689229545bdb8ca2ee4c96c4636c52c38aea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917664, "uuid": "02655e93-e113-4253-a55e-08c623598cb6", "comment": "Malware payload (AgentTesla)", "value": "83597375cb802c16d7a598359c67f93aa81bedcc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707917664, "uuid": "bca989eb-54c5-4ec2-85bb-65cb14d579f9", "comment": "Malware payload (AgentTesla)", "value": "4c0396f0c80590ccb16b3b57fd5241a910e59212cf67cf148b50ace4cb669d8770e35ae42cdf197a52dc227d0a616cc4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917664, "uuid": "d71fb33e-c8d3-4539-a6c1-42b25126a258", "value": "T1FED423E7B6722A1ED493CCE5A023A3F1D97D4D70D6F6D92489D104B43FB8C3958AD860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917664, "uuid": "3d817515-35f8-47c9-93b6-95d01293ae38", "value": "12288:TLoldyt/tpjBbHfUxDQsdgDJpj2t18yVvp/kekekj6XaPLS42TU25m50AKrQfgZ:r5tDHsDQcgl8t1TJkW7Xg420xrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707917664, "uuid": "ad6d7c7c-1c05-486d-bcd4-572471f0da06", "value": 630362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707917664, "uuid": "999bed7a-4965-42fe-88c8-7b3ac7129d0a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707917664, "uuid": "a94dafb2-b0cb-44fc-9116-fd3c01cad8ab", "value": "nPayment Advice.pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f4224d-cb78-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Pikabot)", "timestamp": 1707943035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707943035, "uuid": "59881140-0713-4e5e-8f04-2beb1c6a9d74", "comment": "Malware payload (Pikabot)", "value": "f5cea7d74d36624df4e136c6c74b30f0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707943035, "uuid": "9d1705b9-2ac6-45c3-8d77-55d4e2f8e264", "comment": "Malware payload (Pikabot)", "value": "ffc39c3fdbe06c62d04f4853fd2f0dda2e745a2886776b2ee39418c53d764441", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707943035, "uuid": "76924f5f-f052-4c68-9e05-631496320507", "comment": "Malware payload (Pikabot)", "value": "892f2bd2f7582a6a8a98bc5e8c3876f6ec7a5af0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707943035, "uuid": "54cb03d5-9901-4fd3-b2f6-396abcc14335", "comment": "Malware payload (Pikabot)", "value": "0cc5b5034e3b59faa1e9e0b5cdd3393e463cf3c285bf47d8def9b6b13a681ff1792d3d14b3cf75f62e6735cbb26e04c4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707943035, "uuid": "e0be07d8-0337-4fc6-abad-9c953ba611b8", "value": "T1F814BF10E3E98E25F0B71EF854BBB79F0E38B4A6C621B61912E1438F6C16DD0695C763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707943035, "uuid": "63c185cf-5a25-4fdf-9b1b-129292cd5be7", "value": "86ad46c7c89a3ab2eb81b8a37047ef2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707943035, "uuid": "44dff18e-d27c-4d43-a8d5-1a04b7e9be6c", "value": "3072:fhVQkLSPB5/bhWll55++X1qxSKctXzFNI516skIprTf1vngLK/74:fhNLOBNcrPzqxfcrWrPkIpr/74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707943035, "uuid": "5519a27b-c7fa-4a19-ac23-95fffce0af8d", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707943035, "uuid": "87199077-cd21-4aec-abfd-4097fc58455b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707943035, "uuid": "31497232-21a5-4de0-8c8e-7ddfbdd55a3f", "value": "hapgikcpixn.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }